Mobile Application Security Assessments GMOB Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A threat model for a mobile banking app identifies the following assets: user credentials, transaction data, and the device's GPS location. Which threat is most relevant to the GPS location asset?

   • AAn attacker intercepting the GPS data transmitted to the backend over an insecure channel.
   • BAn attacker using a debugger to modify the app's transaction amount.
   • CAn attacker performing a man-in-the-middle attack to steal the session token.
   • DAn attacker reading the app's source code to find hard-coded API keys.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   You have completed a mobile app security assessment and found several vulnerabilities. The client wants a report that is actionable for developers. Which of the following is the most effective way to present the findings?

   • AGroup findings by severity and provide specific remediation steps for each vulnerability, including code examples where applicable.
   • BFocus only on the most critical vulnerability to avoid overwhelming the developers.
   • CProvide the raw scan output from automated tools to save time.
   • DList all findings in a single table without prioritization to avoid bias.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A security assessment of an Android app reveals that the app can be easily decompiled and modified, and the modified APK runs without any integrity checks. Which control should be recommended to increase tampering resistance?

   • AStore the app's source code on a remote server and load it dynamically.
   • BRemove all logging statements from the production build.
   • CImplement integrity verification of the APK signature at runtime.
   • DUse ProGuard to obfuscate the code and make reverse engineering harder.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   An iOS app stores user credentials in the Keychain with the kSecAttrAccessibleWhenUnlocked attribute. The app also enables backup to iCloud. What is the primary security concern with this configuration?

   • AThe credentials may be included in an unencrypted iCloud backup, allowing an attacker with cloud account access to retrieve them.
   • BThe credentials are accessible when the device is locked, which is a violation of iOS security guidelines.
   • CThe credentials are stored in plaintext, which is a violation of the iOS App Store review guidelines.
   • DThe Keychain is not encrypted, so any app can read the credentials.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A mobile app uses a backend API that returns JSON responses. During traffic analysis, you notice that the app sends the user's session token in a custom header called 'X-Session-Token'. The token is also stored in a cookie. Which of the following is the most likely security concern?

   • AThe session token is exposed in two places, increasing the risk of leakage through logs or referrer headers.
   • BThe cookie is not secure because it lacks the Secure flag.
   • CThe custom header is not encrypted, so the token can be read by network sniffers.
   • DThe session token should be sent in the URL to avoid header size limits.
   Reveal Solution Discussion Select an answer first