Mobile Application Security Assessments GMOB Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst is reviewing an Android app that stores a session token in SharedPreferences. The analyst decompiles the APK and finds the token is encrypted with a hard-coded AES key. Which action best addresses the root cause identified during the assessment?

   • ARecommend switching to a longer AES key, such as 256-bit, to make the hard-coded key harder to brute-force.
   • BRecommend obfuscating the code with ProGuard to hide the hard-coded key from static analysis.
   • CRecommend moving the token to the Android Keystore and encrypting it with a key generated on-device.
   • DRecommend storing the token in external storage so it is not part of the app's private data.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which environment is commonly used for dynamic analysis of mobile apps?

   • AAn emulator or a rooted/jailbroken device
   • BA static code repository
   • CA network firewall
   • DA production server
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A mobile app uses OAuth 2.0 with the authorization code flow. The app stores the client secret in the app binary. The assessment team must decide whether to report this as a finding. The app is a public client (native app). Which conclusion is most accurate?

   • AThe app should use the implicit flow instead of the authorization code flow to avoid the client secret.
   • BStoring a client secret in a native app is a finding because the secret can be extracted, but the impact is limited if the app uses PKCE.
   • CThe client secret should be stored in the app's keychain to make it secure.
   • DStoring the client secret is not a finding because native apps are considered public clients.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is typically included in the scope definition of a mobile application security assessment?

   • AThe company's annual revenue targets
   • BThe app's user interface design guidelines
   • CThe marketing strategy for the app's launch
   • DThe specific app versions, platforms, and backend services to be tested
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An Android app requests the READ_CONTACTS permission at runtime. The analyst determines that the app only needs to access contacts when the user explicitly selects a contact from a picker. Which recommendation best aligns with the principle of least privilege?

   • ARequest READ_CONTACTS only when the user opens the contact selection screen.
   • BUse the system contact picker (Intent.ACTION_PICK) instead of requesting READ_CONTACTS.
   • CRequest READ_CONTACTS at app startup to ensure the permission is granted before use.
   • DUse the GET_ACCOUNTS permission instead of READ_CONTACTS.
   Reveal Solution Discussion Select an answer first