Mobile Security MCQs: 60 Practice Questions & Answers (2026)

Incorrect·D: Hardcoding or associating a specific expected server certificate within the app to prevent Man-in-the-Middle attacks

Certificate pinning embeds the expected server certificate's public key or hash directly in the app, so the TLS handshake fails if a proxy or rogue CA presents a different certificate — preventing MitM interception.

Incorrect·B: "Exported" intents can allow malicious third-party apps to intercept sensitive data or trigger restricted internal app functions

When an Activity or BroadcastReceiver is declared with android:exported="true" without proper permission checks, any third-party app can send it an Intent, potentially triggering privileged operations or intercepting sensitive broadcast data.

Incorrect·B: To intentionally scramble the source code to make reverse engineering and static analysis significantly more difficult for attackers

Tools like ProGuard or R8 rename classes, methods, and variables to meaningless identifiers and remove debug information, dramatically increasing the effort required to understand the logic when an attacker decompiles the APK.

Incorrect·A: Frida

Frida is an open-source dynamic instrumentation platform that injects a JavaScript engine into a running process, allowing researchers to hook functions, intercept API calls, and modify runtime behavior on Android and iOS without source code.

Incorrect·B: Implementing runtime checks to see if the OS is modified, and altering app behavior (e.g., refusing to run) if it is

Root/jailbreak detection checks for indicators such as su binaries, Cydia app presence, writable /system partitions, or SafetyNet/Play Integrity attestation failures, then limits app functionality on compromised devices to protect sensitive data.

Incorrect·A: AndroidManifest.xml

AndroidManifest.xml is the mandatory app descriptor that the Android OS reads to understand the app's components (Activities, Services, Receivers, Providers), declared permissions, intent filters, and exported status before installation.

Incorrect·C: Improperly validated URIs that can force the app to execute unintended actions, bypass authentication, or leak data when clicked

When an app registers a custom URL scheme (e.g., myapp://action?param=value) without rigorous input validation, an attacker can craft a malicious link that forces the app to navigate to sensitive screens or perform privileged actions.

Incorrect·C: Using hardcoded, static symmetric encryption keys embedded directly in the app's binary

Hardcoded encryption keys embedded in the binary can be trivially extracted via static analysis (strings tool, JADX, Ghidra), completely defeating the purpose of encryption — a critical OWASP M9 (Insecure Cryptography) violation.

Incorrect·A: Securing, managing, and enforcing corporate policies on specific enterprise applications and their data, rather than controlling the entire device

MAM targets the app container level — enabling selective wipe of corporate app data, enforcing app-level policies, and managing app configurations — without requiring full MDM device enrollment, making it ideal for BYOD scenarios.

Incorrect·B: Mandatory Code Signing Enforcement

iOS enforces mandatory code signing: every executable must be signed by a certificate chaining to Apple's root CA. The kernel verifies this signature before executing any binary, preventing unsigned or tampered code from running.

Incorrect·C: An app component that is explicitly permitted to be launched by other applications on the device

Setting android:exported="true" on an Activity makes it accessible to any app on the device via an explicit or implicit Intent; without proper permission enforcement, attackers can exploit this to bypass authentication or access restricted functionality.

Incorrect·C: Decompiling or disassembling the app binary to view the original source code, assets, and business logic

Mobile reverse engineering uses tools like JADX, apktool, Ghidra, or Hopper to decompile/disassemble an APK or IPA, revealing hardcoded secrets, proprietary algorithms, API keys, and authentication logic.

Incorrect·A: JADX (or apktool)

JADX decompiles Android DEX bytecode back into readable Java source code, while apktool decodes resources and converts bytecode to Smali assembly — both are standard tools in Android static analysis workflows.

Incorrect·A: Vulnerabilities introduced by integrating compromised third-party SDKs, open-source libraries, or flawed CI/CD pipelines

OWASP M2 (Inadequate Supply Chain Security) highlights risks from malicious or vulnerable third-party SDKs, advertising libraries, and compromised build tools that can introduce backdoors without the developer's direct knowledge.

Incorrect·B: Within the iOS Keychain, which utilizes hardware-backed encryption

The iOS Keychain stores sensitive items (passwords, tokens, cryptographic keys) in an encrypted container backed by the Secure Enclave, with access controls tied to device PIN and biometrics — far more secure than UserDefaults or plaintext SQLite.

Incorrect·A: The sensitive data is written to the system log, which can be read by attackers with physical access, ADB access, or malicious apps with log-reading permissions

Android's logcat and iOS's ASL/unified logs are globally readable on many devices; any app with READ_LOGS permission (or an attacker with ADB) can capture passwords, tokens, and PII written by careless debug logging left in production builds.

Incorrect·D: It forces the application to use secure network connections (HTTPS) and blocks unencrypted HTTP traffic by default

Introduced in iOS 9, ATS mandates TLS 1.2+ with strong cipher suites and forward secrecy for all outbound network connections, blocking plaintext HTTP unless the developer explicitly whitelists domains in NSAppTransportSecurity.

Incorrect·C: An embedded browser component used to display web content; it can be vulnerable to Cross-Site Scripting (XSS) if JavaScript is enabled and inputs aren't sanitized

WebView embeds a web rendering engine inside a native app; if JavaScript is enabled and user-supplied content is rendered without sanitization, attackers can inject malicious scripts (XSS) that execute with the app's native context and permissions.

Incorrect·D: The data is stored in plaintext XML files that can be easily extracted from rooted devices or insecure backups

SharedPreferences stores data as plaintext XML in the app's data directory; on rooted devices or via ADB backups (if allowBackup=true), these files are trivially accessible and expose sensitive values like user tokens or preferences.

Incorrect·C: Hooking the local biometric API prompt (e.g., using Frida) to force it to return a "success" boolean without actually providing a fingerprint or face

When apps implement biometric authentication using only a boolean return value (e.g., onAuthenticationSucceeded) without hardware-backed cryptographic verification through the KeyStore, Frida can hook these callbacks and return success unconditionally.

Incorrect·A: By injecting the V8 JavaScript engine directly into the target application's memory space, allowing runtime manipulation of functions and memory

Frida spawns a frida-agent shared library into the target process's address space (via ptrace on Android or task_for_pid on jailbroken iOS), which hosts the Duktape/V8 JavaScript engine and exposes the Interceptor and Memory APIs for runtime hooking.

Incorrect·A: FBE allows different files to be encrypted with different keys and unlocked independently, enabling features like Direct Boot; FDE encrypts the entire partition with a single key

FDE uses a single key for the entire userdata partition, requiring a full unlock before boot completes. FBE (introduced in Android 7.0) uses per-file/per-directory keys: Credential Encrypted (CE) files unlock with the PIN, while Device Encrypted (DE) files are available in Direct Boot before authentication.

Incorrect·A: A critical kernel exploit that grants the attacker arbitrary read and write access to the kernel's memory space

task_for_pid(0) returns a kernel task port, granting the caller arbitrary kernel memory read/write — the holy grail for iOS jailbreaking. A tfp0 exploit gives attackers full kernel control and enables sandbox escape, code injection, and persistent root access.

Incorrect·B: Mach-O (Mach Object)

iOS apps compile to ARM Mach-O binaries (Mach Object format). Tools like Hopper, IDA Pro, and Ghidra parse the Mach-O structure (load commands, segments, sections) to perform disassembly and decompilation of native Swift/Objective-C code.

Incorrect·C: To declaratively customize network security settings, such as forcing HTTPS, disabling cleartext traffic, or specifying custom certificate trust anchors without modifying app code

The Network Security Configuration file (introduced in Android 7.0) allows developers to disable cleartext HTTP, pin specific certificates, trust custom CAs for debug builds, and override system-wide network trust settings at app level without code changes.

Incorrect·A: By using instrumentation frameworks like Frida or Xposed to hook the app's SSL verification functions and force them to return a "valid" boolean

Testers use Frida scripts (e.g., ssl-pinning-bypass.js) or the Xposed/LSPosed framework with modules like TrustMeAlready to hook SSL/TLS validation methods (X509TrustManager, SecTrustEvaluate) and force them to accept any certificate presented by an intercepting proxy.

Incorrect·B: A mathematical technique designed to hide cryptographic keys and execution logic within the code itself, preventing key extraction even if the attacker has full memory access

White-box cryptography (e.g., by Irdeto or Dexprotector) mathematically merges the secret key into the cryptographic implementation code itself using lookup tables and encodings, aiming to prevent key extraction even when an attacker has full runtime memory access.

Incorrect·D: To serve as the kernel-level driver that facilitates high-performance Inter-Process Communication (IPC) and Remote Procedure Calls (RPC)

Binder is a Linux kernel driver (/dev/binder) that implements Android's primary IPC mechanism, enabling cross-process method calls with automatic parameter marshalling, caller UID injection for permission enforcement, and secure reference counting.

Incorrect·A: A component that manages access to a structured set of data; if exported without proper permissions, it can be exploited via SQL injection or path traversal

Content Providers expose app data (SQLite databases, files) via a URI interface. If exported without restrictive permissions, attackers can query the underlying SQL database (injection), traverse to arbitrary file paths, or read sensitive corporate data via crafted content:// URIs.

Incorrect·B: It serves as a primitive anti-debugging technique by preventing debuggers (like GDB or LLDB) from attaching to the application process

Calling ptrace(PT_DENY_ATTACH, 0, 0, 0) on iOS causes the process to terminate if a debugger later tries to attach; however, this is a weak control easily bypassed by patching the ptrace call or using Frida before the call executes.

Incorrect·C: A token granting a foreign application the right to execute code with the permissions of the originating app; vulnerable to privilege escalation if implicitly created or improperly delegated

A PendingIntent wraps an Intent with the calling app's identity; when passed to a third-party app (e.g., via AlarmManager or NotificationManager), if the wrapped Intent is implicit or mutable, the recipient can modify the Intent's action/data to perform operations with the originator's elevated privileges.

Incorrect·D: MASVS-RESILIENCE

MASVS-RESILIENCE defines defense-in-depth controls for high-risk apps: jailbreak/root detection, anti-debugging, integrity verification, obfuscation, and device binding — all aimed at increasing the cost of reverse engineering and tampering.

Incorrect·C: It signs memory pointers with a cryptographic hash to ensure they haven't been modified, heavily mitigating Return-Oriented Programming (ROP) and memory corruption attacks

ARM's PAC (deployed on Apple A12+ via QARMA algorithm) embeds a cryptographic signature into the unused high bits of pointers. Attempts to redirect control flow via corrupted return addresses or function pointers fail the PAC authentication check and fault, neutralizing most ROP/JOP exploit chains.

Incorrect·A: They are key-value pairs verified by the kernel that explicitly grant the app restricted executable permissions, such as accessing iCloud, Push Notifications, or the Keychain

iOS entitlements (embedded in the code signature's Entitlements.plist) are enforced by AMFI and the kernel; they gate access to privileged capabilities like Keychain groups, iCloud containers, push notifications, and inter-process communication services.

Incorrect·C: To read sensitive UI content (like 2FA codes), observe user actions, and automatically click permission prompts without user interaction

Banking trojans (e.g., Anubis, BankBot) abuse Accessibility Services to perform overlay attacks, auto-click permission dialogs, capture on-screen OTP codes, log keystrokes, and silently grant themselves additional permissions — all without user interaction.

Incorrect·A: Setting the filterTouchesWhenObscured attribute to "true", which drops touch events when a malicious window obscures the legitimate app

android:filterTouchesWhenObscured="true" instructs the Android framework to ignore touch events delivered to a View when another window is visually obscuring it, preventing overlay-based attacks from stealing taps meant for the underlying UI.

Incorrect·C: It prevented the DYLD dynamic linker from injecting external dynamic libraries via environment variables, serving as a primitive anti-hooking mechanism

When the __RESTRICT,__restrict segment is present in a Mach-O binary, DYLD ignores DYLD_INSERT_LIBRARIES and similar environment variables, blocking basic library injection techniques — though this was trivially bypassed on jailbroken devices via DYLD patches.

Incorrect·C: By registering the exact same URL scheme in a malicious app to hijack incoming deep links, intercepting sensitive data or OAuth authorization tokens

Unlike Universal Links (iOS) or App Links (Android) — which require HTTPS ownership verification — custom schemes have no ownership enforcement. A malicious app can register the same scheme and the OS will present an ambiguous app chooser, allowing it to intercept OAuth redirect tokens or sensitive deep-link parameters.

Incorrect·D: It provides a cryptographic attestation to backend servers verifying that the device environment is genuine, unrooted, and has not been tampered with

Play Integrity API generates a signed JWT attestation (verified by Google's servers) that reports MEETS_DEVICE_INTEGRITY, MEETS_BASIC_INTEGRITY, and app licensing verdicts — allowing backend APIs to reject requests from rooted, emulated, or tampered device environments.

Incorrect·B: Modifying the mapping of a selector to its underlying implementation function at runtime, allowing attackers to intercept, log, or alter Objective-C method calls

Objective-C's dynamic dispatch uses a selector-to-IMP (implementation pointer) table. Method swizzling (via method_exchangeImplementations or Frida's ObjC.classes) replaces an existing method's IMP with a custom one at runtime, enabling interception and logging of any Objective-C call without source code access.