You are finalizing a security assessment report for a mobile app that handles personal health information. The app stores data in a SQLite database without encryption and uses a four-digit PIN for authentication. The client has limited budget and asks you to prioritize the findings. Which finding should be listed as the highest priority?

The absence of two-factor authentication, because it weakens account security.

The four-digit PIN, because it can be brute-forced in a short time.

The lack of certificate pinning, because it allows man-in-the-middle attacks.

The unencrypted SQLite database, because it exposes all sensitive health data if the device is lost or stolen.

What is the purpose of key management in mobile app cryptography?

To reduce the app's memory usage

To simplify the app's user interface

To securely generate, store, and rotate cryptographic keys

A mobile app assessment finds that the app stores a user's date of birth in plain text in a local database. The app also uses a weak password policy. Which finding should be reported as the highest priority?

The app does not use certificate pinning.

Lack of two-factor authentication.

Plain text storage of personally identifiable information (PII) in the local database.

Weak password policy on the server.

What is the purpose of a privacy assessment in a mobile app security review?

To check the app's compatibility with different screen sizes

To test the app's user interface for usability

To measure the app's battery consumption

To ensure the app handles personal data in compliance with privacy regulations and best practices

What is the purpose of prioritizing risks in a security assessment report?

To help the organization focus on the most critical issues first

To satisfy regulatory requirements only

GIAC Mobile Device Security Analyst

Domain 2Objective 2

Mobile Application Security Assessments GMOB Practice Questions (Page 4)

Part of the Mobile Application Analysis and Assessment domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

12concepts

Questions 16–20

16expert · hard
You are finalizing a security assessment report for a mobile app that handles personal health information. The app stores data in a SQLite database without encryption and uses a four-digit PIN for authentication. The client has limited budget and asks you to prioritize the findings. Which finding should be listed as the highest priority?
Select an answer first
17foundation · easy
What is the purpose of key management in mobile app cryptography?
Select an answer first
18application · medium
A mobile app assessment finds that the app stores a user's date of birth in plain text in a local database. The app also uses a weak password policy. Which finding should be reported as the highest priority?
Select an answer first
19foundation · easy
What is the purpose of a privacy assessment in a mobile app security review?
Select an answer first
20foundation · easy
What is the purpose of prioritizing risks in a security assessment report?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.