What is the purpose of root/jailbreak detection in a mobile app?

To verify the app's digital signature

To enhance the app's performance on rooted devices

To prevent the app from running on devices that have been modified to bypass security controls

To allow the app to access more system resources

A security analyst receives a suspicious mobile app and wants to determine whether it contains hidden malicious behavior. Which activity best describes the goal of this reverse engineering effort?

Intellectual property protection

An analyst is testing an iOS app that uses jailbreak detection to prevent analysis on a jailbroken device. The analyst has a jailbroken device and wants to bypass the detection without modifying the app's binary. Which technique is most appropriate?

Use an emulator that mimics a non-jailbroken device

Patch the app's binary with a hex editor to remove the jailbreak check

Use a tweak like Liberty or Shadow to disable jailbreak detection

Restore the device to a non-jailbroken state

An analyst is tasked with assessing a new Android app that uses a custom packer to protect its code. The app's classes are not visible in jadx after decompilation. The analyst needs to unpack the app to analyze the actual code. Which approach is most effective?

Use a memory dump of the running app to extract the unpacked dex code

Use apktool to decode the APK and manually remove the packer

Use Hopper to decompile the packer's native library and reverse the unpacking algorithm

Use Frida to hook the class loader and dump the loaded classes

GIAC Mobile Device Security Analyst

Domain 2Objective 3

Reverse Engineering Mobile Applications GMOB Practice Questions (Page 7)

Part of the Mobile Application Analysis and Assessment domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 31–35

31foundation · easy
Which technique is commonly used to hinder static analysis by making code harder to read and understand?
Select an answer first
32foundation · easy
What is the purpose of root/jailbreak detection in a mobile app?
Select an answer first
33foundation · easy
A security analyst receives a suspicious mobile app and wants to determine whether it contains hidden malicious behavior. Which activity best describes the goal of this reverse engineering effort?
Select an answer first
34application · medium
An analyst is testing an iOS app that uses jailbreak detection to prevent analysis on a jailbroken device. The analyst has a jailbroken device and wants to bypass the detection without modifying the app's binary. Which technique is most appropriate?
Select an answer first
35expert · hard
An analyst is tasked with assessing a new Android app that uses a custom packer to protect its code. The app's classes are not visible in jadx after decompilation. The analyst needs to unpack the app to analyze the actual code. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.