Mobile Application Security Assessments GMOB Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   You are assessing an Android app that uses a native library for license verification. The library is compiled with the NDK and is not obfuscated. During static analysis, you find that the license check function returns a boolean value. What is the most likely way an attacker would bypass the license check?

   • APatch the native library to always return true from the license check function.
   • BRe-sign the app with a different certificate to bypass the license check.
   • CUse a debugger to change the value of the boolean variable at runtime.
   • DRemove the native library from the APK and replace it with a stub.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   You are assessing an Android app that uses a token-based authentication scheme. The app stores the access token in SharedPreferences without encryption. The token is sent in the Authorization header of every API request. Which of the following is the most critical risk to highlight in your report?

   • AThe token could be intercepted by a network attacker if TLS is not enforced.
   • BThe token might expire too quickly, causing frequent re-authentication and poor user experience.
   • CThe app should use OAuth 2.0 instead of a custom token scheme.
   • DAn attacker with physical access to a rooted device can read the token from SharedPreferences and impersonate the user.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   When analyzing a mobile app's architecture, which component is typically responsible for handling user authentication?

   • AThe app's notification sound
   • BThe app's icon
   • CThe device's screen brightness
   • DThe backend server
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   You are performing dynamic analysis of an Android app that uses certificate pinning. You have installed your CA certificate in the system trust store on a rooted device, but the app still refuses to connect. Which of the following is the most likely reason?

   • AThe app implements certificate pinning that does not rely on the system trust store, so your CA is not trusted.
   • BThe app is using TLS 1.3, which is not supported by your proxy.
   • CThe proxy is not configured to decrypt HTTPS traffic, so the app cannot establish a connection.
   • DThe app detects that the device is rooted and blocks all network connections.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What should a good remediation recommendation include?

   • AThe name of the developer who wrote the code
   • BSpecific, actionable steps to fix the vulnerability
   • CA list of all possible vulnerabilities in the app
   • DA promise that the vulnerability will never occur again
   Reveal Solution Discussion Select an answer first