A mobile app vendor has discovered that a repackaged version of their app is being distributed. The repackaged app has the same package name and version number, but the signing certificate is different. The vendor wants to implement a mitigation that will prevent the repackaged app from running on users' devices. Which mitigation is most effective?

Implementing a runtime check that verifies the app's signing certificate against a hardcoded expected value

Publishing a security advisory that warns users about the repackaged app

Using code obfuscation to make the repackaged app harder to analyze

Encouraging users to only download the app from the official app store

How can a debugger be used to manipulate a mobile application's behavior?

By re-signing the application with a new certificate

By pausing execution and modifying registers or memory values

By scanning the app for known malware signatures

By encrypting the app's network traffic

A company distributes an internal Android app to employees. They are concerned about an attacker repackaging the app to inject spyware. Which mitigation strategy would be most effective at preventing repackaging?

Use code obfuscation to make the app's logic difficult to understand

Implement a server-side integrity check that validates the app's signature and hash before allowing access to sensitive data

Disable installation from unknown sources on all employee devices

Use a debugger detection library that prevents the app from running if a debugger is attached

A development team is building a mobile app that handles sensitive financial data. They want to implement anti-tampering mechanisms that are effective against both static repackaging and runtime hooking. Which approach best addresses both threats?

Using only certificate pinning to secure network communications

Combining code obfuscation with runtime integrity checks that detect hooking frameworks

Relying on the app store's security review process

Removing all sensitive functionality from the app

A security analyst is attempting to bypass certificate pinning in an Android app. The app uses a native library for TLS and also checks for the presence of Frida. The analyst has a rooted device. Which approach would be most likely to succeed?

Use Frida with a script that hooks the native SSL functions and also disables the Frida detection

Use a debugger to attach to the process and manually change the return values of the SSL functions

Use an emulator with a modified Android system image that disables certificate validation

Repackage the app to remove both the pinning and the Frida detection code

GIAC Mobile Device Security Analyst

Domain 4Objective 1

Manipulating Mobile Application Behavior GMOB Practice Questions (Page 6)

Part of the Mobile Malware and Application Behavior domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 26–30

26expert · hard
A mobile app vendor has discovered that a repackaged version of their app is being distributed. The repackaged app has the same package name and version number, but the signing certificate is different. The vendor wants to implement a mitigation that will prevent the repackaged app from running on users' devices. Which mitigation is most effective?
Select an answer first
27foundation · easy
How can a debugger be used to manipulate a mobile application's behavior?
Select an answer first
28application · medium
A company distributes an internal Android app to employees. They are concerned about an attacker repackaging the app to inject spyware. Which mitigation strategy would be most effective at preventing repackaging?
Select an answer first
29application · medium
A development team is building a mobile app that handles sensitive financial data. They want to implement anti-tampering mechanisms that are effective against both static repackaging and runtime hooking. Which approach best addresses both threats?
Select an answer first
30expert · hard
A security analyst is attempting to bypass certificate pinning in an Android app. The app uses a native library for TLS and also checks for the presence of Frida. The analyst has a rooted device. Which approach would be most likely to succeed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.