Mobile Application Security Assessments GMOB Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team is testing a banking app that uses certificate pinning and also detects a jailbroken device. The team has a jailbroken test device and a non-jailbroken device. The app's traffic must be intercepted to assess API security. The team has limited time and cannot modify the app. Which approach is most effective?

   • AUse the non-jailbroken device with a proxy and install the CA certificate in the system trust store.
   • BUse a network sniffer on the same Wi-Fi network to capture traffic from the non-jailbroken device.
   • CUse Frida on the jailbroken device to bypass both jailbreak detection and certificate pinning, then intercept traffic with a proxy.
   • DUse the jailbroken device but disable the proxy and use a VPN to capture traffic.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   During a dynamic analysis of an iOS app, the analyst configures a proxy and installs a CA certificate. The app uses certificate pinning, so HTTPS traffic is not intercepted. Which technique should the analyst use to observe the app's network traffic?

   • AInstall the CA certificate in the system trust store using a jailbroken device.
   • BUse Frida to hook the SSL pinning verification function and bypass the check at runtime.
   • CUse a VPN to capture traffic instead of a proxy.
   • DDisable the app's network security configuration in the Info.plist.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A game app has a high score that is stored locally and submitted to a server. The app uses root detection and code obfuscation. The assessment team finds that the high score can be modified by editing a local file. The team must recommend a fix that is both effective and practical for a game app. Which recommendation is best?

   • AUse a checksum to verify the integrity of the high score file.
   • BEncrypt the local high score file with a key stored in the app binary.
   • CUse stronger obfuscation to hide the local file format.
   • DMove the high score validation to the server and treat the client as untrusted.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the main advantage of dynamic analysis over static analysis?

   • AIt can identify all vulnerabilities without false positives
   • BIt does not require any tools
   • CIt can reveal runtime behaviors and interactions that are not visible in code
   • DIt is faster and requires no setup
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   You are testing a mobile app's authorization mechanism. The app uses a role-based access control (RBAC) system where users have roles like 'user' and 'admin'. You intercept an API request and notice that the role is sent as a parameter in the request body. Which of the following is the most critical finding?

   • AThe role parameter should be removed from the request to reduce the attack surface.
   • BThe server trusts the client-supplied role parameter, allowing privilege escalation by changing the role to 'admin'.
   • CThe app should use OAuth 2.0 instead of RBAC.
   • DThe role parameter is not encrypted, exposing the user's role to network sniffers.
   Reveal Solution Discussion Select an answer first