A company allows employees to install apps from both the official app store and the vendor's website for a custom line-of-business tool. After a malware incident traced to a sideloaded app, the security team wants to reduce risk without blocking the custom tool. Which approach best balances usability and security?

Continue allowing sideloading but require users to confirm a warning prompt before installation.

Configure the MDM to allow installation only from the official app store and distribute the custom tool through the MDM's app catalog with a signed enterprise certificate.

Block all third-party app stores but allow direct downloads from any website.

Use a public app store for the custom tool without enterprise signing.

Which user behavior should be discouraged to reduce the risk of installing malicious apps?

Keeping the operating system updated

Reading app permission requests before installation

Sideloading apps from unknown third-party sources

An enterprise uses Android devices with a strict MDM policy that blocks all sideloading and restricts app installs to the managed Play Store. A user needs a specialized app that is not available in the managed store but is available as an APK from the vendor's website. The app is critical for the user's job. What is the best course of action?

Use an MDM to push the APK directly to the device, bypassing the Play Store.

Instruct the user to install the APK and then uninstall it after use.

Allow the user to sideload the APK temporarily and then remove the policy.

Have the vendor publish the app to the managed Play Store through the enterprise's private channel.

An enterprise MDM administrator is configuring a policy for a group of executives who handle sensitive data. The policy must prevent malware from exfiltrating data via cloud storage apps, but the executives need to use a specific approved cloud storage app for work. Which MDM configuration best meets this requirement?

Allow the app but disable the device's camera and microphone.

Block all cloud storage apps, including the approved one.

Use app-level VPN and data loss prevention (DLP) policies to restrict the approved app's data-sharing capabilities.

Require the executives to use a personal device for cloud storage.

A company has experienced several malware infections from employees installing apps that impersonate popular games. The apps are distributed through third-party websites and request accessibility permissions. Which user education approach is most likely to reduce this specific threat?

Advise users to use a different web browser.

Instruct users to regularly clear their browser cache.

Teach users how to identify phishing emails.

Train users to only install apps from official app stores and to verify the developer name and download count.

GIAC Mobile Device Security Analyst

Domain 4Objective 2

Mitigating Against Mobile Malware GMOB Practice Questions (Page 4)

Part of the Mobile Malware and Application Behavior domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

7concepts

Questions 16–20

16application · medium
A company allows employees to install apps from both the official app store and the vendor's website for a custom line-of-business tool. After a malware incident traced to a sideloaded app, the security team wants to reduce risk without blocking the custom tool. Which approach best balances usability and security?
Select an answer first
17foundation · easy
Which user behavior should be discouraged to reduce the risk of installing malicious apps?
Select an answer first
18expert · hard
An enterprise uses Android devices with a strict MDM policy that blocks all sideloading and restricts app installs to the managed Play Store. A user needs a specialized app that is not available in the managed store but is available as an APK from the vendor's website. The app is critical for the user's job. What is the best course of action?
Select an answer first
19expert · hard
An enterprise MDM administrator is configuring a policy for a group of executives who handle sensitive data. The policy must prevent malware from exfiltrating data via cloud storage apps, but the executives need to use a specific approved cloud storage app for work. Which MDM configuration best meets this requirement?
Select an answer first
20application · medium
A company has experienced several malware infections from employees installing apps that impersonate popular games. The apps are distributed through third-party websites and request accessibility permissions. Which user education approach is most likely to reduce this specific threat?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.

Mitigating Against Mobile Malware GMOB Practice Questions (Page 4)

Questions 16–20

Which user behavior should be discouraged to reduce the risk of installing malicious apps?

A company has experienced several malware infections from employees installing apps that impersonate popular games. The apps are distributed through third-party websites and request accessibility permissions. Which user education approach is most likely to reduce this specific threat?

Keep studying — Mobile Malware and Application Behavior