GIAC GMOB Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Mobile Device Security Analyst (GMOB) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GMOB certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GMOB Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Mobile Device Security Analyst (GMOB) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Mobile Device Security Analyst exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GMOB Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GMOB Sample Questions:
01. Triaging a suspect Android phone, an analyst runs a routine that searches for a superuser binary, finds none, and is ready to conclude the device's platform integrity is intact. The device's bootloader, however, is unlocked.
Why is the integrity-intact conclusion premature?
a) An unlocked bootloader only affects the carrier network, so it is irrelevant to device integrity.
b) The conclusion is fine, because a device's platform integrity depends solely on whether a superuser process is active at this moment.
c) An unlocked bootloader already accepts unsigned boot images, so verified boot no longer holds despite no root binary.
d) Finding no superuser binary proves nothing, because every rooted phone reliably hides that binary from any on-device search routine.
02. An iOS app stores a long-lived credential in the Keychain. After a device is stolen, the owner's account is later restored onto a brand-new phone, and the team wants to be certain that credential cannot also be revived from a backup restored onto the thief's device.
Which choice enforces that?
a) Store the item with an AfterFirstUnlock accessibility attribute, so it stays readable while the device is locked once it has been unlocked since boot.
b) Store the item with a ThisDeviceOnly accessibility attribute so it does not migrate through backup or restore.
c) Generate the key inside the secure coprocessor so it never leaves the device.
d) Set the item to WhenUnlocked so its key is evicted on lock.
03. Two devices both have storage encryption enabled and a screen lock set: one uses a short numeric PIN, the other a long alphanumeric passphrase. An attacker captures both while locked and attempts on-device guessing.
Why is the passphrase device far better protected?
a) A passphrase forces the device to store its encryption keys somewhere off the device.
b) A longer passcode causes the device to select a stronger encryption cipher.
c) Alphanumeric passcodes activate the secure coprocessor while numeric ones do not.
d) The passcode roots the key hierarchy, so its entropy sets the guessing cost.
04. During an iOS assessment, the tester's jailbroken phone loses its jailbroken state after the battery drains and it reboots. The instrumentation tooling stops working until the phone is reconnected to the tester's computer and the jailbreak is re-applied.
Which type of jailbreak is in use, and what does it mean for the test setup?
a) A carrier unlock, which only changes the mobile networks the device is permitted to use.
b) A tethered jailbreak, which a host must re-apply after every reboot.
c) A bootloader unlock, the Android step used to enable rooting.
d) An untethered jailbreak, which persists across reboots on its own with no host attached and no re-application needed.
05. Staff receive a text message urging them to install a "mailbox security update" from a linked site outside any app store. What combination most directly reduces successful installs from this lure?
a) User awareness plus a policy blocking installs from unknown sources.
b) Certificate pinning added to the corporate mail application's connections.
c) An on-device antivirus signature written for that specific message text.
d) Enabling full-disk encryption across all of the organization's managed devices.
06. On an Android device, a team must decide where an app should persist a user's decrypted financial records so the data is unavailable if the phone is stolen while switched off and not yet unlocked after a restart.
Which storage choice meets that requirement?
a) Credential-Encrypted storage, whose keys derive from the user credential and are unavailable until the first unlock after boot.
b) Any location, provided allowBackup is set to false on the app.
c) Device-Encrypted storage, whose key is available early in the boot sequence before the user authenticates, so the records would be reachable on a just-restarted device.
d) An iOS Complete Data Protection class assignment.
07. To protect an API token on Android devices that might be rooted, a developer proposes tightening the Unix file permissions on the app's private file so that only the app's own UID can read it.
How should an analyst evaluate this proposal?
a) It is sufficient once SELinux is set to enforcing, which blocks all cross-app reads.
b) It is sufficient, because Unix permissions are enforced by the kernel and root cannot override them.
c) It fails, but only because Android ignores file permissions on external storage.
d) It fails on a rooted device, because file permissions rely on the UID sandbox a root process transcends, so the durable fix is to not persist the secret on the device and to enforce trust on the server.
08. On a managed Android phone, staff install personal apps freely alongside a corporate email and files app. The company wants a compromised personal app to be unable to read the corporate data.
Which arrangement provides that separation?
a) Keep the corporate apps and data in a managed work profile that the platform isolates from the personal profile.
b) Install an antivirus app that scans the personal apps every hour.
c) Require a strong device passcode so personal apps cannot run.
d) Enable storage encryption so personal apps cannot read the corporate files even while both are installed on the running device.
09. A suspected malicious Android app has activated the device administrator capability and now resists ordinary uninstallation. What is the correct response, and why does the ordinary uninstall fail?
a) Clear the app from the platform key store, which is what is holding the install in place.
b) Accept that nothing can remove it, because the app has effectively rooted the device.
c) Factory-reset immediately, since a device-administrator app can never be removed any other way.
d) Revoke the app's device administrator privilege first, because that capability can block uninstalling, then remove the app.
10. Static review of an app that should only display a menu shows that it downloads and loads additional executable code at runtime and heavily obfuscates that path.
Why is this a vetting concern?
a) Dynamic code loading is required for all apps and is never a concern.
b) It is safe, because obfuscation encrypts the app and prevents tampering.
c) Loading code at runtime hides behavior from static review and can change what the app does after approval, which fits a malware pattern in an app with no such need.
d) It only matters on rooted devices, not on standard ones.
Answers:
|
Question: 01 Answer: c |
Question: 02 Answer: b |
Question: 03 Answer: d |
Question: 04 Answer: b |
Question: 05 Answer: a |
|
Question: 06 Answer: a |
Question: 07 Answer: d |
Question: 08 Answer: a |
Question: 09 Answer: d |
Question: 10 Answer: c |
Note: For any error in GIAC Mobile Device Security Analyst (GMOB) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
