Mobile Application Security Assessments GMOB Practice Questions (Page 12)

Questions 56–58

1. 56application · medium

   You are threat modeling a mobile payment app. The app allows users to send money to other users via a backend API. Which of the following is the most critical asset to protect in your threat model?

   • AThe app's source code, because it contains proprietary business logic.
   • BThe user's device ID, because it is used for fraud detection.
   • CThe backend API's rate limiting, because it prevents denial-of-service attacks.
   • DThe user's authentication token, because its compromise allows an attacker to perform unauthorized transactions.
   Reveal Solution Discussion Select an answer first
2. 57application · medium

   During static analysis of a mobile app, you find that it uses AES in ECB mode to encrypt a user's personal identification number (PIN) before storing it locally. What is the most significant issue with this implementation?

   • AAES is a weak algorithm and should be replaced with a stronger one like ChaCha20.
   • BThe PIN should be hashed instead of encrypted to prevent decryption.
   • CECB mode is deterministic and does not use an initialization vector, so identical plaintext blocks produce identical ciphertext, revealing patterns.
   • DThe encryption key should be stored in the Android Keystore to protect it.
   Reveal Solution Discussion Select an answer first
3. 58foundation · easy

   Which of the following is a common cryptographic implementation flaw in mobile apps?

   • AUsing AES-256 with a randomly generated key
   • BHardcoding encryption keys in the app source code
   • CStoring keys in the device's secure enclave
   • DUsing TLS 1.3 for network communication
   Reveal Solution Discussion Select an answer first