Mobile Application Security Assessments GMOB Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A mobile app stores user credentials in a SQLite database in the app's private directory. The security assessment report must recommend a more secure storage location. Which recommendation is most appropriate for both iOS and Android?

   • AMove the database to external storage to avoid the app sandbox.
   • BUse the platform's secure enclave or hardware-backed keystore to store the credentials.
   • CEncrypt the SQLite database with a key stored in the app's assets folder.
   • DUse a custom file format with XOR obfuscation to hide the credentials.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A mobile app developer claims that their app is tamper-proof because it uses code signing and checks its own signature at runtime. During your assessment, you find that the signature check can be bypassed by patching a single conditional branch in the smali code. What is the most accurate conclusion to include in your report?

   • AThe runtime signature check is a form of obfuscation, not a strong security control, because it can be bypassed by modifying the app's code.
   • BThe app should use a hardware-backed attestation mechanism to prevent tampering.
   • CThe app is tamper-proof because code signing is a cryptographic guarantee that cannot be broken.
   • DThe signature check is unnecessary because the app store already verifies the signature before installation.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the purpose of the iOS App Sandbox?

   • ATo provide a user interface for app settings
   • BTo speed up app development
   • CTo restrict the app's access to system resources and other apps' data
   • DTo allow apps to share all data freely
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security assessor is reviewing an Android banking app. The app uses native C++ code for its PIN pad and claims to have 'military-grade' obfuscation. During static analysis, the assessor finds that the Java/Kotlin layer is heavily obfuscated, but the native library exports many JNI functions with descriptive names. Which finding best describes the most significant gap in the app's tamper resistance?

   • AThe obfuscation of the Java/Kotlin layer is ineffective because all Android apps can be decompiled to source code.
   • BThe app uses C++ code, which is inherently more secure than Java/Kotlin and cannot be reverse engineered.
   • CThe native library's exported JNI symbols reveal the purpose of each function, making it easier for an attacker to locate and patch security-critical routines.
   • DThe app should have used a commercial packer to protect the native library, otherwise the DEX bytecode is fully readable.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following is a common attack vector specific to mobile applications?

   • ASQL injection through a web browser
   • BPhysical theft of a server rack
   • CDNS cache poisoning on a corporate server
   • DMalicious QR code scanning leading to phishing
   Reveal Solution Discussion Select an answer first