Mobile Application Security Assessments GMOB Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   During an architecture review, the analyst finds that a mobile app communicates with a backend using HTTP instead of HTTPS. The app also sends a device identifier as a query parameter. Which remediation should be prioritized?

   • AEnforce HTTPS for all client-server communication and move the device identifier to the request body or header.
   • BStore the device identifier in a cookie instead of a query parameter.
   • CSwitch to UDP to reduce latency and avoid HTTP overhead.
   • DUse a custom encryption algorithm to encrypt the device identifier before sending it.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a common third-party integration in mobile apps that could introduce security risks?

   • AThe app's splash screen image
   • BThe device's battery level indicator
   • CAnalytics SDKs
   • DThe app's font style
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is privilege escalation in the context of mobile app authorization testing?

   • AGaining access to functionality or data beyond what the user is authorized for
   • BEncrypting data with a stronger algorithm
   • CAdding more features to the app
   • DIncreasing the app's performance speed
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   You are performing dynamic analysis of a mobile app that uses a login flow. You intercept the login request and notice that the password is sent in plaintext in the request body, but the app uses HTTPS. What is the most appropriate finding?

   • AThe password should be encrypted with a public key before sending.
   • BThe password is protected in transit by HTTPS, but the app should avoid logging the request body to prevent accidental exposure.
   • CThe password is at risk because HTTPS can be bypassed with a man-in-the-middle attack.
   • DThe app should hash the password before sending it to the backend.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst is performing dynamic analysis of an iOS app on a jailbroken device. The app detects the jailbreak and terminates itself. Which technique should the analyst use to continue the analysis?

   • AUse a non-jailbroken device with a proxy to intercept traffic.
   • BDisable the jailbreak detection by editing the app's Info.plist.
   • CUse Frida to hook the jailbreak detection function and bypass the check.
   • DUse an Android emulator to run the iOS app.
   Reveal Solution Discussion Select an answer first