A security analyst is performing dynamic analysis of an Android app that communicates with a backend server. The analyst needs to intercept and inspect the HTTPS traffic to identify any insecure data transmission. The app uses certificate pinning to prevent man-in-the-middle attacks. Which approach is most effective?

Use Frida to hook the certificate pinning functions and bypass the pinning, then intercept traffic with a proxy

Use an emulator with a modified trust store

Install a custom CA certificate on the device and use a proxy

Disable SSL verification in the app by patching the APK

What is the primary purpose of a reverse engineering report?

To serve as legal evidence in court

To communicate findings and risks to stakeholders in a clear, actionable manner

To provide a detailed log of all reverse engineering steps

To document the app's source code for reuse

During dynamic analysis of an Android app, the analyst notices that the app stores user credentials in a SQLite database in its internal storage. The analyst wants to extract and inspect the database to see if the credentials are stored in plaintext. Which tool or method is most appropriate?

Use Frida to dump the database from memory.

Use Hopper to disassemble the app and find the database path.

Use adb to run 'run-as' and pull the database from the app's data directory.

Use apktool to decode the APK and find the database file in the assets folder.

An analyst is investigating an Android app that stores user credentials in a local database. The analyst needs to extract the database from a rooted device and inspect its contents to determine if the credentials are stored in plaintext. Which sequence of steps is most appropriate?

Use jadx to decompile the app and read the database from the source code

Use adb to pull the app's private data directory, then open the database with a SQLite browser

Use Frida to hook the database encryption function and dump the decrypted database

Use apktool to decode the APK and read the database from the assets folder

A reverse engineer is analyzing a heavily protected Android app that uses both root detection and anti-debugging. The app also performs integrity checks on its own APK. The analyst needs to perform dynamic analysis on a rooted device. Which approach best balances the need to bypass protections while minimizing the risk of detection by the app?

Use a debugger to attach to the process and manually skip the anti-debugging checks

Use Magisk to hide root from the app and use Frida with early instrumentation to bypass anti-debugging

Use an emulator with root access and disable the root detection by editing build.prop

Patch the APK to remove root detection and anti-debugging, then re-sign and install

GIAC Mobile Device Security Analyst

Domain 2Objective 3

Reverse Engineering Mobile Applications GMOB Practice Questions (Page 8)

Part of the Mobile Application Analysis and Assessment domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 36–40

36application · medium
A security analyst is performing dynamic analysis of an Android app that communicates with a backend server. The analyst needs to intercept and inspect the HTTPS traffic to identify any insecure data transmission. The app uses certificate pinning to prevent man-in-the-middle attacks. Which approach is most effective?
Select an answer first
37foundation · easy
What is the primary purpose of a reverse engineering report?
Select an answer first
38application · medium
During dynamic analysis of an Android app, the analyst notices that the app stores user credentials in a SQLite database in its internal storage. The analyst wants to extract and inspect the database to see if the credentials are stored in plaintext. Which tool or method is most appropriate?
Select an answer first
39application · medium
An analyst is investigating an Android app that stores user credentials in a local database. The analyst needs to extract the database from a rooted device and inspect its contents to determine if the credentials are stored in plaintext. Which sequence of steps is most appropriate?
Select an answer first
40expert · hard
A reverse engineer is analyzing a heavily protected Android app that uses both root detection and anti-debugging. The app also performs integrity checks on its own APK. The analyst needs to perform dynamic analysis on a rooted device. Which approach best balances the need to bypass protections while minimizing the risk of detection by the app?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.

Reverse Engineering Mobile Applications GMOB Practice Questions (Page 8)

Questions 36–40

What is the primary purpose of a reverse engineering report?

During dynamic analysis of an Android app, the analyst notices that the app stores user credentials in a SQLite database in its internal storage. The analyst wants to extract and inspect the database to see if the credentials are stored in plaintext. Which tool or method is most appropriate?

An analyst is investigating an Android app that stores user credentials in a local database. The analyst needs to extract the database from a rooted device and inspect its contents to determine if the credentials are stored in plaintext. Which sequence of steps is most appropriate?

Keep studying — Mobile Application Analysis and Assessment