An organization's MDM policy states that rooted devices must be blocked from accessing corporate resources. A user's device is detected as rooted, but the user claims they only unlocked the bootloader and did not gain root access. Which response is most appropriate?

Re-lock the bootloader remotely using the MDM.

Allow the device because the user did not actually root it.

Ignore the issue because the user has a valid excuse.

Treat the device as non-compliant because an unlocked bootloader is a prerequisite for rooting and weakens the device's security model.

A user wants to root their Android device to use a tethering app that requires root. The device is a recent model with a locked bootloader. Which method is most likely to be required first?

Unlock the bootloader using the manufacturer's official tool.

Install a third-party app that roots the device without unlocking the bootloader.

Use a cloud-based rooting service that remotely roots the device.

Flash a custom recovery using the stock bootloader.

A security analyst is reviewing a compromised Android device. The device has a locked bootloader, but the analyst finds that the device is rooted. Which method is most likely to have been used to root the device?

Using an MDM to grant root access.

The manufacturer's official bootloader unlock method.

Flashing a custom recovery image via fastboot.

An exploit that takes advantage of a vulnerability in the kernel or a privileged service to gain root access without unlocking the bootloader.

A security team is evaluating root detection methods for a fleet of Android devices. They want to detect devices that have been rooted using a method that hides root from common detection apps (e.g., Magisk's MagiskHide). Which approach is most likely to detect such devices?

Check for the presence of Magisk's package name and its associated files, and also check for modifications to the system partition.

Rely solely on the presence of the su binary.

Ask the user to run a root-checker app.

Check the device's build fingerprint for the word 'userdebug'.

A user wants to remove pre-installed carrier bloatware from their Android device. The device is not rooted. Which approach is the most appropriate and least risky?

Root the device and then use a system app remover to delete the bloatware.

Unlock the bootloader and flash a custom ROM that excludes the bloatware.

Use the Android 'Disable' feature for the unwanted apps.

Contact the carrier and request a device without bloatware.

GIAC Mobile Device Security Analyst

Domain 1Objective 4

Unlocking and Rooting Mobile Devices GMOB Practice Questions (Page 1)

Part of the Mobile Device Management and Security domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–28 in this domain), expect 5–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 1–5

1application · medium
An organization's MDM policy states that rooted devices must be blocked from accessing corporate resources. A user's device is detected as rooted, but the user claims they only unlocked the bootloader and did not gain root access. Which response is most appropriate?
Select an answer first
2application · medium
A user wants to root their Android device to use a tethering app that requires root. The device is a recent model with a locked bootloader. Which method is most likely to be required first?
Select an answer first
3application · medium
A security analyst is reviewing a compromised Android device. The device has a locked bootloader, but the analyst finds that the device is rooted. Which method is most likely to have been used to root the device?
Select an answer first
4expert · hard
A security team is evaluating root detection methods for a fleet of Android devices. They want to detect devices that have been rooted using a method that hides root from common detection apps (e.g., Magisk's MagiskHide). Which approach is most likely to detect such devices?
Select an answer first
5application · medium
A user wants to remove pre-installed carrier bloatware from their Android device. The device is not rooted. Which approach is the most appropriate and least risky?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.