An analyst needs to capture traffic from a mobile app that uses a non-standard port for its API. The app is configured to use a proxy. Which proxy setting is essential to ensure the traffic is captured?

Set the proxy to only intercept HTTP traffic.

Use a different proxy for each port.

Configure the proxy to listen on all interfaces and allow traffic on the non-standard port.

Disable SSL/TLS interception to avoid certificate issues.

A penetration tester is assessing a mobile app that uses a session token in a cookie. The tester has intercepted a valid session and wants to test for session fixation. The app sets the session cookie after login. Which test is most appropriate?

Replay the session cookie after logout to see if it is still valid.

Use a different user's session cookie to access the account.

Change the session cookie's domain attribute to a different domain and see if the server accepts it.

Set the session cookie to a known value before login and see if the server uses that value after login.

An analyst is configuring a proxy to intercept traffic from a mobile app that uses both HTTP and HTTPS. The analyst wants to ensure that all traffic is captured, including HTTPS, without causing certificate errors on the device. Which configuration is required?

Install a proxy CA certificate on the device and enable SSL/TLS interception in the proxy.

Disable HTTPS interception and rely on HTTP traffic only.

Set the proxy to only forward HTTPS traffic without interception.

Use a VPN instead of a proxy to capture all traffic without certificate installation.

An analyst needs to capture traffic from a non-rooted Android device to analyze which domains the device contacts. The analyst has control of the corporate Wi-Fi network. Which method is most suitable?

Use a packet capture app on the device that uses the VPN API to capture traffic locally.

Configure a proxy on the device to route traffic through a laptop running Burp Suite, and install Burp's CA certificate on the device.

Use a SIM card cloning technique to intercept the device's cellular data traffic.

Use a laptop with Wireshark in monitor mode to capture all wireless traffic in the area.

An analyst is intercepting HTTPS traffic from an iOS app. The app uses certificate pinning, and the analyst has a jailbroken device. The analyst installs a custom CA certificate in the device's trust store and configures a proxy. However, the app still fails to connect. What is the most likely reason for the failure?

The app's certificate pinning is still active and rejects the proxy's certificate.

The app is using HTTP/2, which the proxy does not support.

The custom CA certificate is not installed in the system keychain.

The proxy is not configured to listen on the correct port.

GIAC Mobile Device Security Analyst

Domain 3Objective 2

Manipulating Network Traffic GMOB Practice Questions (Page 5)

Part of the Network Traffic Manipulation and Security domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

Questions 21–25

21application · medium
An analyst needs to capture traffic from a mobile app that uses a non-standard port for its API. The app is configured to use a proxy. Which proxy setting is essential to ensure the traffic is captured?
Select an answer first
22expert · hard
A penetration tester is assessing a mobile app that uses a session token in a cookie. The tester has intercepted a valid session and wants to test for session fixation. The app sets the session cookie after login. Which test is most appropriate?
Select an answer first
23application · medium
An analyst is configuring a proxy to intercept traffic from a mobile app that uses both HTTP and HTTPS. The analyst wants to ensure that all traffic is captured, including HTTPS, without causing certificate errors on the device. Which configuration is required?
Select an answer first
24application · medium
An analyst needs to capture traffic from a non-rooted Android device to analyze which domains the device contacts. The analyst has control of the corporate Wi-Fi network. Which method is most suitable?
Select an answer first
25application · medium
An analyst is intercepting HTTPS traffic from an iOS app. The app uses certificate pinning, and the analyst has a jailbroken device. The analyst installs a custom CA certificate in the device's trust store and configures a proxy. However, the app still fails to connect. What is the most likely reason for the failure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.