Which action is an example of containing a mobile malware infection in an enterprise?

Increasing the device's storage capacity

Ignoring the infection until the user reports it again

Updating the device's wallpaper to a security notice

Disabling the device's network access or remotely locking the device

A security analyst is testing a mobile app in a sandbox environment. The app requests permission to access the device's location, but the analyst notices the app also attempts to access the network. The app is from an official store. What does the sandbox environment primarily protect against?

The app communicating with external servers.

The app being installed on the device.

The app requesting permissions.

The app accessing other apps' data or the OS kernel.

A company uses an MDM to manage corporate-owned devices. A device is infected with malware that uses a legitimate cloud storage service for C2 and data exfiltration. The malware is not detected by the EMM's built-in threat detection. The security team wants to contain the infection while preserving the ability to investigate. Which action should be taken first?

Immediately factory reset the device.

Use the MDM to disable network access and then perform a logical acquisition of the device.

Block the cloud storage service's domain at the firewall.

Revoke the device's certificate and remove it from the MDM.

A company is developing a mobile app and wants to ensure it is not flagged as malware by app store security controls. Which practice is most important?

Use code signing certificates from a trusted authority.

Minimize the number of permissions requested.

Test the app on multiple devices.

Use an obfuscation tool to hide the app's code.

A user receives a text message with a link to a 'free gift card' and clicks it. The link installs a malicious app. The user reports this to IT. What should IT do first?

Disconnect the device from the network and begin a forensic investigation.

Send a company-wide email warning about the phishing text.

Factory reset the device immediately.

Instruct the user to delete the app and change their passwords.

GIAC Mobile Device Security Analyst

Domain 4Objective 2

Mitigating Against Mobile Malware GMOB Practice Questions (Page 7)

Part of the Mobile Malware and Application Behavior domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

7concepts

Questions 31–35

31foundation · easy
Which action is an example of containing a mobile malware infection in an enterprise?
Select an answer first
32application · medium
A security analyst is testing a mobile app in a sandbox environment. The app requests permission to access the device's location, but the analyst notices the app also attempts to access the network. The app is from an official store. What does the sandbox environment primarily protect against?
Select an answer first
33expert · hard
A company uses an MDM to manage corporate-owned devices. A device is infected with malware that uses a legitimate cloud storage service for C2 and data exfiltration. The malware is not detected by the EMM's built-in threat detection. The security team wants to contain the infection while preserving the ability to investigate. Which action should be taken first?
Select an answer first
34application · medium
A company is developing a mobile app and wants to ensure it is not flagged as malware by app store security controls. Which practice is most important?
Select an answer first
35application · medium
A user receives a text message with a link to a 'free gift card' and clicks it. The link installs a malicious app. The user reports this to IT. What should IT do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.