An analyst is examining an Android APK that contains both Java code and a native library. The analyst needs to determine if the native library contains any hardcoded secrets. The library is not obfuscated. Which approach is most efficient?

Use the 'strings' command on the native library to extract printable strings and search for secrets

Use Frida to hook the library's functions and log all string arguments

Use Hopper to disassemble the entire library and manually inspect every function

Use jadx to decompile the native library into Java source and search for strings

During a malware analysis of an Android app, an analyst discovers that the app contains a native library with obfuscated functions. The analyst needs to understand what the native code does, particularly whether it performs any suspicious system calls. Which approach is most effective?

Disassemble the native library with a tool like Hopper or Ghidra and trace system calls

Run the app in an emulator and use strace to trace system calls

Use jadx to decompile the native library into readable C code

Use apktool to decompile the native library into Java source

An analyst is reverse engineering an Android app that uses code obfuscation and string encryption. The analyst has used jadx to decompile the app, but the Java code is heavily obfuscated and the strings are encrypted. The analyst needs to understand the app's logic and extract the plaintext strings. Which approach is most effective?

Use a custom emulator that automatically deobfuscates the code.

Use Hopper to disassemble the native library and find the decryption keys.

Use apktool to decode the resources and then manually search for the decryption routines in the smali code.

Use Frida to hook the string decryption functions and intercept the plaintext strings at runtime.

A mobile app security assessment has revealed that the app stores sensitive user data in an unencrypted SQLite database and sends it over HTTP. The analyst must write a report for the development team. What is the most important element to include?

A detailed description of the reverse engineering tools used.

A clear explanation of the security risks and specific recommendations to fix them.

A list of all files that were extracted during analysis.

The exact code snippets that show the vulnerability.

GIAC Mobile Device Security Analyst

Domain 2Objective 3

Reverse Engineering Mobile Applications GMOB Practice Questions (Page 4)

Part of the Mobile Application Analysis and Assessment domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 16–20

16expert · hard
An analyst is examining an Android APK that contains both Java code and a native library. The analyst needs to determine if the native library contains any hardcoded secrets. The library is not obfuscated. Which approach is most efficient?
Select an answer first
17application · medium
During a malware analysis of an Android app, an analyst discovers that the app contains a native library with obfuscated functions. The analyst needs to understand what the native code does, particularly whether it performs any suspicious system calls. Which approach is most effective?
Select an answer first
18expert · hard
An analyst is reverse engineering an Android app that uses code obfuscation and string encryption. The analyst has used jadx to decompile the app, but the Java code is heavily obfuscated and the strings are encrypted. The analyst needs to understand the app's logic and extract the plaintext strings. Which approach is most effective?
Select an answer first
19application · medium
A mobile app security assessment has revealed that the app stores sensitive user data in an unencrypted SQLite database and sends it over HTTP. The analyst must write a report for the development team. What is the most important element to include?
Select an answer first
20foundation · easy
Which type of file would an analyst examine to analyze native code in an Android app?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.

Reverse Engineering Mobile Applications GMOB Practice Questions (Page 4)

Questions 16–20

An analyst is examining an Android APK that contains both Java code and a native library. The analyst needs to determine if the native library contains any hardcoded secrets. The library is not obfuscated. Which approach is most efficient?

During a malware analysis of an Android app, an analyst discovers that the app contains a native library with obfuscated functions. The analyst needs to understand what the native code does, particularly whether it performs any suspicious system calls. Which approach is most effective?

A mobile app security assessment has revealed that the app stores sensitive user data in an unencrypted SQLite database and sends it over HTTP. The analyst must write a report for the development team. What is the most important element to include?

Which type of file would an analyst examine to analyze native code in an Android app?

Keep studying — Mobile Application Analysis and Assessment