An analyst is performing dynamic analysis of an Android app that detects whether it is running on an emulator. The app refuses to launch under the standard Android Emulator. The analyst needs to continue testing without modifying the app's code. Which approach is most effective?

Disable the emulator's network connection

Use a physical device with a custom ROM that hides root status

Patch the app with apktool to remove the emulator check

Run the app in a different emulator with a different Android version

An analyst is reverse engineering an iOS app that uses a native library for cryptographic operations. The analyst has identified that the library is statically linked and contains symbols. The analyst needs to determine whether the library uses a known vulnerable version of a cryptographic library. Which approach is most efficient?

Use Frida to hook the library's functions and infer the version from behavior

Run the app in an emulator and use a vulnerability scanner on the device

Use Hopper to disassemble the library and search for known function signatures or strings that indicate the library version

Use jadx to decompile the library into Java source and look for version numbers

A security team has completed a reverse engineering assessment of a mobile app and found several vulnerabilities, including hardcoded API keys, insecure data storage, and a lack of certificate pinning. The team must present the findings to the development team and management. The management wants to know the business impact, while the developers need to know how to fix the issues. What is the best way to structure the report?

Create two separate reports: one for management with only the business impact, and one for developers with only the technical details

Provide a list of vulnerabilities with CVSS scores and no further explanation

Focus the report on the technical details and let the management interpret the business impact

Provide a single report with an executive summary, a risk matrix, and detailed technical findings with remediation steps

After completing a reverse engineering assessment of a mobile banking app, an analyst must present the findings to a mixed audience of developers, security managers, and executives. The report should highlight the most critical security risks and provide actionable recommendations. What is the most effective way to structure the report?

Provide only the technical details and let the audience interpret the risks

Focus only on the vulnerabilities that have known exploits

List every finding in order of discovery without prioritizing

Start with an executive summary that lists the top risks and then provide technical details and recommendations for each

GIAC Mobile Device Security Analyst

Domain 2Objective 3

Reverse Engineering Mobile Applications GMOB Practice Questions (Page 5)

Part of the Mobile Application Analysis and Assessment domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 21–25

21application · medium
An analyst is performing dynamic analysis of an Android app that detects whether it is running on an emulator. The app refuses to launch under the standard Android Emulator. The analyst needs to continue testing without modifying the app's code. Which approach is most effective?
Select an answer first
22expert · hard
An analyst is reverse engineering an iOS app that uses a native library for cryptographic operations. The analyst has identified that the library is statically linked and contains symbols. The analyst needs to determine whether the library uses a known vulnerable version of a cryptographic library. Which approach is most efficient?
Select an answer first
23foundation · easy
Which technique involves running a mobile app in a controlled environment to observe its runtime behavior, such as network calls and file system changes?
Select an answer first
24expert · hard
A security team has completed a reverse engineering assessment of a mobile app and found several vulnerabilities, including hardcoded API keys, insecure data storage, and a lack of certificate pinning. The team must present the findings to the development team and management. The management wants to know the business impact, while the developers need to know how to fix the issues. What is the best way to structure the report?
Select an answer first
25application · medium
After completing a reverse engineering assessment of a mobile banking app, an analyst must present the findings to a mixed audience of developers, security managers, and executives. The report should highlight the most critical security risks and provide actionable recommendations. What is the most effective way to structure the report?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.

Reverse Engineering Mobile Applications GMOB Practice Questions (Page 5)

Questions 21–25

An analyst is performing dynamic analysis of an Android app that detects whether it is running on an emulator. The app refuses to launch under the standard Android Emulator. The analyst needs to continue testing without modifying the app's code. Which approach is most effective?

Which technique involves running a mobile app in a controlled environment to observe its runtime behavior, such as network calls and file system changes?

Keep studying — Mobile Application Analysis and Assessment