A security analyst is testing an Android app that uses a native library for license verification. The analyst has successfully used Frida to hook the native function and bypass the license check. However, the app also performs a server-side license validation. Which additional step is necessary to fully bypass the license check?

Repackage the app to remove the server-side validation code

Use a proxy to intercept the HTTPS traffic and return a valid license response

Disable the device's network connection to prevent the server-side check from completing

Hook the network function that sends the license request and modify the response to indicate a valid license

A mobile app vendor is concerned about repackaging attacks. They have implemented code obfuscation and runtime integrity checks, but they want to add an additional layer of protection that specifically makes it harder for attackers to create a repackaged version that passes the integrity checks. Which approach is most effective?

Using a white-box cryptographic implementation to protect the integrity check logic

Relying on the app store's code signing to prevent repackaging

Publishing the integrity check algorithm in the app's documentation

Using a simple checksum of the DEX file as the integrity check

Which mitigation strategy is specifically designed to make it harder for an attacker to understand and modify an app's code?

Runtime application self-protection (RASP)

A mobile app development team wants to make it harder for attackers to reverse engineer and modify their app. They are considering several techniques. Which combination would provide the most defense-in-depth?

Certificate pinning and SSL/TLS encryption

Code obfuscation, runtime integrity checks, and server-side validation

Root detection and debugger detection

Code obfuscation and a custom packer

GIAC Mobile Device Security Analyst

Domain 4Objective 1

Manipulating Mobile Application Behavior GMOB Practice Questions (Page 7)

Part of the Mobile Malware and Application Behavior domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 31–35

31foundation · easy
Which technique involves taking a legitimate mobile application, modifying its code, and then redistributing the modified version as if it were the original?
Select an answer first
32expert · hard
A security analyst is testing an Android app that uses a native library for license verification. The analyst has successfully used Frida to hook the native function and bypass the license check. However, the app also performs a server-side license validation. Which additional step is necessary to fully bypass the license check?
Select an answer first
33expert · hard
A mobile app vendor is concerned about repackaging attacks. They have implemented code obfuscation and runtime integrity checks, but they want to add an additional layer of protection that specifically makes it harder for attackers to create a repackaged version that passes the integrity checks. Which approach is most effective?
Select an answer first
34foundation · easy
Which mitigation strategy is specifically designed to make it harder for an attacker to understand and modify an app's code?
Select an answer first
35application · medium
A mobile app development team wants to make it harder for attackers to reverse engineer and modify their app. They are considering several techniques. Which combination would provide the most defense-in-depth?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.

Manipulating Mobile Application Behavior GMOB Practice Questions (Page 7)

Questions 31–35

Which technique involves taking a legitimate mobile application, modifying its code, and then redistributing the modified version as if it were the original?

Which mitigation strategy is specifically designed to make it harder for an attacker to understand and modify an app's code?

A mobile app development team wants to make it harder for attackers to reverse engineer and modify their app. They are considering several techniques. Which combination would provide the most defense-in-depth?

Keep studying — Mobile Malware and Application Behavior