Mobile Application Security Assessments GMOB Practice Questions (Page 11)

Questions 51–55

1. 51expert · hard

   A security assessment of a mobile app is required to meet a compliance standard. The assessment team has a limited budget and must choose between a full static analysis and a dynamic analysis that includes traffic interception. The app is a simple utility app that does not handle sensitive data. Which approach is most appropriate?

   • APerform a static analysis to identify code-level vulnerabilities, and use dynamic analysis only if time permits.
   • BPerform only dynamic analysis to observe runtime behavior and network traffic.
   • CPerform a full static and dynamic analysis regardless of the app's risk level.
   • DSkip both static and dynamic analysis and rely on the app store's security review.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A mobile app uses a third-party analytics SDK that sends data to an external server. The app also uses a custom encryption protocol for its own API. The assessment team must evaluate the risk of the third-party SDK. Which factor is most important to consider?

   • AWhether the SDK is obfuscated to prevent reverse engineering.
   • BWhether the SDK uses the same custom encryption protocol as the app.
   • CWhether the SDK is a native library or a web-based SDK.
   • DWhether the SDK transmits data over HTTPS and what data it collects.
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   You are assessing a mobile app that uses a third-party SDK for advertising. The SDK is integrated into the app and has access to the device's location data. The app's privacy policy states that location data is not shared with third parties. What is the most appropriate action to take during the assessment?

   • AAssume the SDK is compliant because it is a well-known advertising SDK.
   • BAnalyze the SDK's code to determine if it actually collects and transmits location data, and compare that with the privacy policy.
   • CIgnore the SDK because it is third-party code and outside the scope of the assessment.
   • DRecommend removing the SDK because it accesses location data.
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A mobile app security assessment is being planned for a healthcare app that handles patient data. The assessment team has limited time and budget. Which approach best defines the scope and methodology?

   • AFocus on the most critical assets, such as patient data and authentication, and use a combination of static and dynamic analysis.
   • BTest all possible attack vectors without prioritization.
   • CUse only automated tools to avoid manual effort.
   • DPerform only static analysis to save time and budget.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   During a dynamic analysis of an iOS health app, you intercept TLS traffic using a proxy with a user-installed CA certificate. You observe that the app sends a request to a third-party analytics endpoint, but the request body is encrypted with a key that appears to be hardcoded in the app binary. What is the most appropriate next step to determine whether the encryption is properly implemented?

   • AIgnore the encrypted body because TLS already protects the data in transit, making the additional encryption unnecessary.
   • BExtract the hardcoded key from the binary and attempt to decrypt the request body to verify the encryption algorithm and mode.
   • CReport the app as secure because it uses encryption, which is a best practice for protecting sensitive data.
   • DSwitch to a different interception tool because the proxy cannot decrypt the request body.
   Reveal Solution Discussion Select an answer first