Which of the following is a common insecure data storage practice in mobile apps?

Storing sensitive data in plain text in SharedPreferences on Android

Encrypting data with AES-256 before storing it

Using the device's Keychain to store passwords on iOS

Using Android's Keystore for cryptographic keys

What is the primary goal of a mobile application security assessment?

To optimize the application's performance and resource usage

To ensure the application is free of all bugs and errors

To identify and evaluate security vulnerabilities and risks in the application

To verify that the application meets all functional requirements

During a static analysis of an Android app, the analyst finds that the app uses MD5 to hash passwords before sending them to the server. Which recommendation is most appropriate?

Use a strong, salted hashing algorithm like bcrypt or PBKDF2 on the server side, and send passwords over TLS.

Use SHA-256 instead of MD5 for hashing passwords.

Hash the password with MD5 and add a static salt.

Encrypt the password with AES before sending it to the server.

What is the purpose of intercepting network traffic during a mobile app security assessment?

To block malicious traffic from the app

To identify insecure communication, such as plaintext data transmission

To change the app's server-side logic

To improve the app's network speed

GIAC Mobile Device Security Analyst

Domain 2Objective 2

Mobile Application Security Assessments GMOB Practice Questions (Page 2)

Part of the Mobile Application Analysis and Assessment domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

12concepts

Questions 6–10

6foundation · easy
Which of the following is a common insecure data storage practice in mobile apps?
Select an answer first
7foundation · easy
Which tool is commonly used to intercept and analyze mobile app network traffic?
Select an answer first
8foundation · easy
What is the primary goal of a mobile application security assessment?
Select an answer first
9application · medium
During a static analysis of an Android app, the analyst finds that the app uses MD5 to hash passwords before sending them to the server. Which recommendation is most appropriate?
Select an answer first
10foundation · easy
What is the purpose of intercepting network traffic during a mobile app security assessment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.