Mobile Application Security Assessments GMOB Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which technique is used to detect tampering with a mobile app?

   • AChecksum verification of the app's code
   • BChanging the app's icon
   • CIncreasing the app's font size
   • DAdding more animations
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An Android app requests the READ_SMS permission at runtime. During your assessment, you find that the app only uses SMS for one-time password (OTP) verification. Which of the following is the most appropriate recommendation?

   • ARequest the READ_SMS permission only when the user initiates the OTP verification.
   • BUse the GET_ACCOUNTS permission instead to access the user's phone number for OTP delivery.
   • CUse the SMS Retriever API to read the OTP without requiring the READ_SMS permission.
   • DKeep the READ_SMS permission because it is the only way to read OTP messages.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a common static analysis tool for Android apps?

   • ABurp Suite
   • BAPKTool
   • CFrida
   • DWireshark
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   While analyzing a mobile app's architecture, you discover that the app communicates with multiple backend endpoints, including one that uses HTTP (not HTTPS) for a 'non-sensitive' feature. The app also embeds an API key for a third-party analytics service. Which of the following is the most appropriate finding to include in the assessment report?

   • AThe API key should be moved to the backend and the app should use a proxy to hide it.
   • BThe app should use a VPN to protect all traffic, eliminating the need for HTTPS.
   • CThe HTTP endpoint is acceptable because the feature is non-sensitive, and the API key is only for analytics.
   • DThe HTTP endpoint should be upgraded to HTTPS because even 'non-sensitive' traffic can be manipulated or observed, and the API key should be protected.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A mobile app stores user data in a local database. On Android, the database is stored in the app's private directory and is not encrypted. On iOS, the database is stored in the app's sandbox and is protected by NSFileProtectionComplete. Which platform has a higher risk of data exposure if the device is lost?

   • AiOS, because NSFileProtectionComplete is not available on all devices.
   • BNeither platform is at risk because the databases are in the app's private storage.
   • CBoth platforms have the same risk because the databases are stored locally.
   • DAndroid, because the app's private directory is not encrypted by default on many devices, and the database is accessible if the device is rooted.
   Reveal Solution Discussion Select an answer first