Which of the following is an indicator that a mobile app may have been tampered with?

The app is available on multiple app stores

The app requests permissions that are not necessary for its stated functionality

The app's version number is higher than the latest official release

A security team is reviewing an Android APK that was sideloaded onto a corporate device. They notice the app requests permission to read SMS messages, but the legitimate version from the official store does not. What is the most likely explanation?

The app uses a third-party SDK that requires SMS permissions

The APK has been repackaged with additional permissions to exfiltrate SMS data

The device is rooted and the app is using root privileges to read SMS

The app is using a runtime permission model and only requests SMS access when needed

A mobile app vendor discovers that a repackaged version of their app is being distributed on a third-party website. The repackaged app contains a malicious library that steals user credentials. Which mitigation strategy would be most effective in reducing the impact of this repackaged app?

Using code obfuscation to make the repackaged app harder to analyze

Implementing runtime integrity checks that verify the app's signature and detect modifications

Encouraging users to download the app only from the official app store

Publishing a list of known malicious hashes of the repackaged app

Which of the following is a common method used to repackage a mobile application?

Changing the app's permissions in the Android manifest without re-signing

Decompiling the app, modifying the smali code, and re-signing the APK

Using a hooking framework to change the app's behavior at runtime

Encrypting the app's network traffic with a proxy

GIAC Mobile Device Security Analyst

Domain 4Objective 1

Manipulating Mobile Application Behavior GMOB Practice Questions (Page 5)

Part of the Mobile Malware and Application Behavior domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 21–25

21foundation · easy
Which of the following is an indicator that a mobile app may have been tampered with?
Select an answer first
22application · medium
A security team is reviewing an Android APK that was sideloaded onto a corporate device. They notice the app requests permission to read SMS messages, but the legitimate version from the official store does not. What is the most likely explanation?
Select an answer first
23application · medium
A security analyst is analyzing a suspicious Android app that was found on a user's device. The analyst notices that the app's behavior changes when the device is rooted. The app appears to load additional code from a remote server only when root is detected. Which manipulation technique is being used?
Select an answer first
24application · medium
A mobile app vendor discovers that a repackaged version of their app is being distributed on a third-party website. The repackaged app contains a malicious library that steals user credentials. Which mitigation strategy would be most effective in reducing the impact of this repackaged app?
Select an answer first
25foundation · easy
Which of the following is a common method used to repackage a mobile application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.