A company wants to implement a layered defense against mobile malware. Which set of measures represents a defense-in-depth approach?

Only using a VPN and a firewall.

Only providing user awareness training.

App store review, OS updates, MDM policies, and user training.

Only relying on the official app store's review process.

A company's mobile devices are infected with malware that uses a legitimate cloud service for C2. The security team has identified the malware and wants to disrupt the C2 channel. The malware uses HTTPS to communicate with the cloud service, and the company has a next-generation firewall (NGFW) that can decrypt HTTPS. Which action is most effective?

Require users to change their cloud service passwords.

Use the NGFW to block the specific cloud service domain and associated IP addresses.

Disable the cloud service's API access for all corporate accounts.

Turn off the Wi-Fi network to disconnect all devices.

A company's employees frequently travel and use public Wi-Fi in airports and hotels. The security team wants to reduce the risk of malware communicating with C2 servers. Which network security measure is most effective?

Instruct users to only use websites that start with HTTPS.

Require a VPN for all corporate device traffic, even when on trusted networks.

Disable Wi-Fi and use only cellular data.

Use a public DNS service to block known malicious domains.

A security analyst is reviewing an Android app that was approved by the Google Play Store. The app requests permissions to access the camera, microphone, and location. The app's functionality does not appear to require these permissions. What should the analyst conclude?

The app may be malicious, but further analysis is needed to determine if the permissions are actually used for harmful purposes.

The app is definitely malicious because it requests unnecessary permissions.

The app is safe because it passed Google Play Store review.

The app should be removed from the device immediately.

What is the primary purpose of the permission model on mobile operating systems?

To provide a backup of app data

To allow users to grant or deny specific capabilities to apps, such as camera or location access

To automatically update apps to the latest version

To speed up the device's processor

GIAC Mobile Device Security Analyst

Domain 4Objective 2

Mitigating Against Mobile Malware GMOB Practice Questions (Page 8)

Part of the Mobile Malware and Application Behavior domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

7concepts

Questions 36–40

36application · medium
A company wants to implement a layered defense against mobile malware. Which set of measures represents a defense-in-depth approach?
Select an answer first
37expert · hard
A company's mobile devices are infected with malware that uses a legitimate cloud service for C2. The security team has identified the malware and wants to disrupt the C2 channel. The malware uses HTTPS to communicate with the cloud service, and the company has a next-generation firewall (NGFW) that can decrypt HTTPS. Which action is most effective?
Select an answer first
38application · medium
A company's employees frequently travel and use public Wi-Fi in airports and hotels. The security team wants to reduce the risk of malware communicating with C2 servers. Which network security measure is most effective?
Select an answer first
39expert · hard
A security analyst is reviewing an Android app that was approved by the Google Play Store. The app requests permissions to access the camera, microphone, and location. The app's functionality does not appear to require these permissions. What should the analyst conclude?
Select an answer first
40foundation · easy
What is the primary purpose of the permission model on mobile operating systems?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.