Free GMOB Practice Questions

Question 1

An Android 14 app targeting API 34 exposes ExportReceiver with an action filter and no permission requirement. The receiver forwards accepted requests to a nonexported ExportService. A test app signed with a different certificate explicitly addresses the receiver with the expected action and causes the service to export a synthetic record. The legitimate caller is a companion app signed with the same certificate as the receiving app but running under a different UID.

Which change blocks the demonstrated entry point while preserving the companion integration?

Accepted Answer

Protect ExportReceiver with a custom signature permission requested by the companion.

Answer

Make ExportReceiver nonexported and have the companion continue addressing it explicitly.

Answer

Require a custom signature permission on ExportService while leaving ExportReceiver unchanged.

Answer

Remove ExportReceiver's intent filters while retaining its exported status and request handler.

Question 2

An assessor is configuring an intercepting proxy for a service that requires mutual TLS. The handshake log records:

Phone → proxy: TLS established
Proxy → service: server chain and hostname accepted
Service → proxy: client certificate requested
Proxy → service: no client certificate supplied
Service: handshake rejected

The service owner can provide a lab-only client certificate and its matching private key. Which configuration addresses the observed failure while retaining plaintext inspection at the proxy?

Accepted Answer

Configure the proxy's upstream connection with the authorized client certificate and matching key.

Answer

Copy the handset's public client certificate to the proxy without its private key.

Answer

Configure the proxy to request a handset certificate instead of configuring upstream credentials.

Answer

Add the proxy's CA to the handset and retry the same upstream configuration.

Question 3

An iPhone protected by a passcode runs an app permitted to record audio in the background. The app must keep writing after the screen locks and create the next recording while still locked. A recording closed during this locked period must remain unreadable on disk until the user unlocks. Which file protection setting fits this lifecycle?

Accepted Answer

NSFileProtectionCompleteUnlessOpen

Answer

NSFileProtectionNone

Answer

NSFileProtectionCompleteUntilFirstUserAuthentication

Answer

NSFileProtectionComplete

Question 4

A mobile app encrypts each saved report with AES-256-GCM. Its key is generated once per installation and retained in protected storage. Every encryption call supplies the same 12-byte nonce; the report contents change. The developer proposes rotating the key with each app update. Which revision fixes the underlying cryptographic error?

Accepted Answer

Ensure every encryption under a given key uses a different nonce.

Answer

Include each report's unique identifier only as authenticated additional data.

Answer

Generate a longer nonce once and retain it with the installation key.

Answer

Generate a new installation key while retaining the fixed-nonce procedure.

Question 5

A device-to-device migration restores an app's still-usable, device-specific refresh token from shared_prefs/session.xml. The app runs on Android 14 and targets API 34. Its android:dataExtractionRules excludes session.xml under cloud-backup, but device-transfer has no exclusions. Other nonsensitive SharedPreferences files must continue migrating. Select the configuration correction that preserves migration of the other preferences.

Accepted Answer

Exclude session.xml in the sharedpref domain under device-transfer; retain its cloud-backup exclusion.

Answer

Set android:fullBackupContent to an XML file excluding session.xml, leaving android:dataExtractionRules unchanged.

Answer

Move the token to an ordinary SQLite database and keep the current extraction rules.

Answer

Exclude the entire sharedpref domain from both cloud backup and device transfer.

Question 6

A read-only native hook logs a POSIX read() from a connected socket during a mobile assessment. The supplied buffer is 64 bytes long, 64 bytes are requested, and read() returns 16. The logger then dumps all 64 bytes; a token-like string begins at byte offset 32. The buffer was reused without being cleared. What can the assessor conclude from this event?

Accepted Answer

The token lies outside the bytes returned by this particular socket read.

Answer

The partial read proves the connection lost bytes before the server's reply finished.

Answer

The token is stale data from an earlier response on this same connection.

Answer

The complete dump proves the server returned the token within this socket response.

Question 7

"The APK is signed, and each plugin passes a SHA-256 check before loading," says an Android developer. The executable plugin and its expected digest are both stored in a writable cache. Replacing both files with a marker plugin and its matching digest causes the marker to execute. The installed APK remains unmodified, and the publisher's private signing key is uncompromised.

Legitimate plugin updates must remain possible. Which design would authenticate their origin?

Accepted Answer

Verify the bytes to be loaded against a publisher signature using a trusted key embedded in the APK.

Answer

Replace SHA-256 with SHA-512 and continue reading the expected digest from the cached manifest.

Answer

Verify the installed APK's signing certificate immediately before accepting each cached module.

Answer

Pin the download server's certificate and reuse cached modules after their initial HTTPS download.

Question 8

During an iOS Universal Links review, the app's signed entitlement correctly lists applinks:portal.example.com. Its matching apple-app-site-association file is valid, but a request to https://portal.example.com/.well-known/apple-app-site-association receives an HTTP 302 redirect to login.example.com. A browser can retrieve the file after sign-in. What must change before the site can establish the production association?

Accepted Answer

Serve the association file directly over valid HTTPS without redirects or authentication.

Answer

Keep the protected endpoint and configure the app to sign in before handling each incoming link.

Answer

Add login.example.com to the entitlement and retain the redirect.

Answer

Relax App Transport Security so the platform can complete the authenticated redirect.

Question 9

At 09:14, monitoring confirms that a newly installed Android app is uploading company contacts from one managed phone. The phone remains connected, and its enterprise session token is also being used by an unauthorized host. Relevant logs have been retained. Response controls can isolate this phone individually, and the identity service supports immediate session revocation. No other device is implicated. What takes priority over completing the package analysis?

Accepted Answer

Isolate the phone and revoke the exposed enterprise session.

Answer

Revoke Contacts permission but retain the enterprise session.

Answer

Factory-reset the affected phone and suspend its cellular subscription.

Answer

Complete the package analysis before changing the affected phone's connectivity.

Question 10

The assessed app uses system routing and is included in a lab VPN. IPv6 tunnel addressing and forwarding are configured, and the collector supports IPv6. However, the capture configuration routes only 0.0.0.0/0 through the VPN; IPv6 still routes over Wi-Fi. A device trace shows the app connecting to [2001:db8::42]:443, with no matching packets at the collector. To capture the observed IPv6 path, the assessor should:

Accepted Answer

Add ::/0 to the VPN's captured routes and repeat the IPv6 connection.

Answer

Remove AAAA responses so the app has to use its service's IPv4 address.

Answer

Install the lab CA in the app's trust store before capturing another connection.

Answer

Apply an IPv6 display filter to the traffic already retained by the collector.

Free GMOB Practice Questions

Domain 1: Analyzing Mobile Applications

Question 1

Question 2

Domain 2: Attacking Encrypted Traffic

Question 3

Domain 3: Managing Android Devices and Applications

Question 4

Domain 4: Managing iOS Devices and Applications

Question 5

Question 6

Domain 5: Manipulating Mobile Application Behavior

Question 7

Domain 6: Manipulating Network Traffic

Question 8

Domain 7: Mitigating Against Mobile Malware

Question 9

Domain 9: Mobile Application Security Assessments

Question 10

The rest of the GMOB blueprint

That's 10 of 1,030