Pentest+ Practice Exam Chapter 5 Mobile Device and Application Testing (Jonathan Ammerman) Flashcards
Smartphones and tablet devices are typically built using a system on a chip (SoC), which is a small integrated circuit composed of several physical components, including which of the following? (Choose two.) A. Central processing unit (CPU) B. Firmware C. RAM D. Operating system
A. Central processing unit (CPU)
C. RAM
Explanation:
The system on a chip (SOC) is a small, integrated circuit that connects common components of a mobile device, including the central processing unit (CPU), graphics processing unit (GPU), random access memory (RAM), read-only memory (ROM), and modem. B and D are incorrect. Device firmware and operating system are both types of software that is loaded onto SOC components, rather than physical components of the device.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 113). McGraw-Hill Education. Kindle Edition.
The GPU in a computing system (mobile or otherwise) serves what function?
A.Processing and rendering of visual data to be displayed
B.Computation of program or application instructions, including mathematical, logical, and input/output (I/O) operations
C.Communication to remote hosts or systems (for example, via phone call)
D.Long-term, nonvolatile storage for firmware and operating systems
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 108). McGraw-Hill Education. Kindle Edition.
A. Processing and rendering of visual data to be displayed
Explanation:
A graphics processing unit (GPU) processes the data used to render images that are meant to be output to a display device such as a monitor or touchscreen. B, C, and D are incorrect. B is incorrect because the central processing unit (CPU) of a system is responsible for the computation of program instructions; examples of such instructions include mathematical, logical, and input/output (I/O) operations. C is incorrect because the modem handles communications with remote hosts and systems by connecting to mobile or other networks. D is incorrect because system read-only memory (ROM) provides long-term, nonvolatile storage for a device’s firmware or operating system.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 113). McGraw-Hill Education. Kindle Edition.
Which of the following best describes the role of a subscriber identity module (SIM) on a mobile device?
A.Provides temporary, typically volatile storage for mobile applications
B.Enables transmission of Short Message Service (SMS) and Multimedia Message Service (MMS) messages
C.Communication to remote hosts or systems (for example, via phone call)
D.Identifies and authenticates a user’s device on a cellular network
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 108). McGraw-Hill Education. Kindle Edition.
D. Identifies and authenticates a user’s device on a cellular network
Explanation:
A subscriber identity module (SIM) enables mobile communications by identifying and authenticating a user’s device on a cellular network. A, B, and C are incorrect. A is incorrect because random access memory (RAM) provides temporary, typically volatile storage for mobile applications; think of it as “scratch space” that applications use while running to retain data pertinent to their execution. B and C are incorrect because transmission of SMS or MMS messages and other communication to remote hosts or systems is provided by the device’s modem.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (pp. 113-114). McGraw-Hill Education. Kindle Edition.
iOS runs on Apple hardware and is based on Darwin, an open-source OS originating from which operating system family?
A. Windows
B. Debian
C. Unix
D. Red Hat
C. Unix
Explanation:
Darwin is an open-source operating system developed by Apple that forms the foundation of macOS and iOS; it is itself based on OPENSTEP, an operating system in the Unix family. A, B, and D are incorrect. A is incorrect because Windows Phone was the most recent variant of Windows developed primarily for mobile platforms; it has since been discontinued due to a lack of developer interest and market penetration. B and D are incorrect because these are two of the main families of the Linux operating system for standard computing environments; Slackware is also in this list. Linux’s main contribution to mobile devices has been the Android operating system.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 114). McGraw-Hill Education. Kindle Edition.
Which abstraction layer of iOS facilitates fundamental services such as networking and file access?
A. Media
B. Cocoa Touch
C. Core OS
D. Core Services
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 108). McGraw-Hill Education. Kindle Edition.
D. Core Services
Explanation:
The Core Services abstraction layer facilitates fundamental services such as networking and file access in iOS. A, B, and C are incorrect. A is incorrect because the Media abstraction layer provides audio, graphics, and over-the-air capabilities. B is incorrect because the Cocoa Touch abstraction layer is a UI framework for developing apps to run on iOS. C is incorrect because the Core OS abstraction layer provides critical functionality such as power management and the file system.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 114). McGraw-Hill Education. Kindle Edition.
As defined by the OWASP Mobile Security Testing Guide, which core feature of the iOS security architecture ensures that only applications explicitly approved by Apple can run on the device?
A. Secure Boot
B. Encryption and data protection
C. Code signing
D. Hardware security
C. Code signing
Explanation:
Code signing is a practice employed by Apple that ensures that only approved applications may be run on an iOS device. A, B, and D are incorrect. A is incorrect because Secure Boot (or more completely, the Secure Boot chain) employs an Apple-issued root certificate used to ensure that a device has not been tampered with. B is incorrect because encryption, the use of passcodes, and other data protection mechanisms ensure data confidentiality by preventing unauthorized access to encrypted data. D is incorrect because the hardware security feature provides dedicated cryptographic hardware to secure the operation of the device. Using two AES-256 encryption keys, the Group ID (or GID) and Unique ID (or UID), iOS devices prevent modification of firmware or physical tampering with components meant to bypass data protections
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 115). McGraw-Hill Education. Kindle Edition.
JTAG is an IEEE standard component that is best defined as serving what purpose?
A.Provides testing capabilities for mobile device modems
B.Provides a means for the burning of mobile operating systems and their initial configuration
C.Provides a means of physical connection to an embedded system for debugging and other testing
D.Provides a means for video output
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 115). McGraw-Hill Education. Kindle Edition.
C. Provides a means of physical connection to an embedded system for debugging and other testing
Explanation:
JTAG (named for the Joint Test Action Group, which cemented the standard) is an IEEE standard component that provides a means of physical connection to an embedded system for debugging and other testing.
JTAG was originally developed to define a means of verifying and testing PCBs (printed circuit boards) after manufacture.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 115). McGraw-Hill Education. Kindle Edition.
Which component of an Android application is functionally a SQLite database that stores data in the form of a flat file?
A. Activities
B. Intents
C. Content providers
D.Broadcast receivers
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 109). McGraw-Hill Education. Kindle Edition.
C. Content providers
Explanation:
The content provider component of an Android application is a SQLite database that stores data in the form of a flat file. A, B, and D are incorrect. A is incorrect because activities in an Android application are the parts that are visible to the user. B is incorrect because intents are used to send messages between other Android application components. D is incorrect because broadcast receivers serve to facilitate receipt of notifications from other apps.
The native C and C++ libraries present in Android provide support for which of the following applications? (Choose two.)
A. Gmail
B. Hangouts
C. HAL
D. ART
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 109). McGraw-Hill Education. Kindle Edition.
C. HAL
D. ART
Explanation:
The Hardware Abstraction Layer (HAL) and Android Runtime (ART) are components of the Android operating system that are written in native code, supported by the C and C++ libraries present in Android. HAL interfaces with built-in hardware components of a given device, and ART is the Java virtual machine in which user applications run. A and B are incorrect. Google’s Gmail and Hangouts apps for Android are end-user applications, and as such are applications written in Java and run in ART or DVM, depending on the version of Android in use.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 116). McGraw-Hill Education. Kindle Edition.
Static analysis (sometimes called static application security testing, or SAST) is a debugging method used to examine source code, bytecode, and binaries without execution. Which of the following is not a test case commonly employed as part of static analysis?
A.Disassembly or decompiling of the application from its original format
B.Analysis of files and application permissions
C.Searching for information disclosure weaknesses, such as hard-coded credentials
D.Client-side injection attack attempts, such as SQL injection or local file inclusion
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 109). McGraw-Hill Education. Kindle Edition.
D. Client-side injection attack attempts, such as SQL injection or local file inclusion
Explanation:
Client-side injection attack attempts must necessarily occur while code is in its running state. As such, this is a test case typical of dynamic application security testing, or DAST.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (pp. 116-117). McGraw-Hill Education. Kindle Edition.
Which tool, with the minimalist UI shown next, is used to transfer jailbreak IPAs to devices running iOS for installation?
A. Android Studio
B. Phoenix
C. Cydia Impactor
D. Electra
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (pp. 109-110). McGraw-Hill Education. Kindle Edition.
C. Cydia Impactor
Explanation:
The tool presented is Cydia Impactor, which is used to transfer IPA files (such as jailbreak applications that are not available in Apple’s App Store) to devices running iOS for installation.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 117). McGraw-Hill Education. Kindle Edition.
Which tool is an all-in-one, automated penetration testing framework for mobile applications for Android, iOS, and Windows mobile platforms, providing SAST for Android, iOS, and Windows mobile devices and DAST for Android platforms?
A. Drozer
B. Pangu
C. MobSF
D. Clutch
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 110). McGraw-Hill Education. Kindle Edition.
C. MobSF
Explanation:
MobSF is an all-in-one, “Swiss army knife” penetration testing framework for mobile applications, capable of facilitating SAST for Android, iOS, and Windows phone platforms and DAST for Android. Its broad capabilities make it an excellent tool for mobile penetration testing of mobile apps for both Android and iOS.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 117). McGraw-Hill Education. Kindle Edition.
Which tool, shown next, is primarily used to develop and build packages for its target mobile environment and has some utility in static application analysis when provided with the project file used to create the installable application package?
A. Drozer
B. Android Studio
C. MobSF
D. Cydia Impactor
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 110). McGraw-Hill Education. Kindle Edition.
B. Android Studio
Explanation:
The tool presented in the image is Android Studio. A, C, and D are incorrect. A is incorrect because Drozer is a security-auditing framework for Android that helps penetration testers identify and validate vulnerabilities discovered in applications. It consists of two components: an agent installed on a mobile device, and a command line–based console installed on a tester’s workstation. See the following illustration for a console usage example, specifically searching for modules targeting SMS functionality.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 118). McGraw-Hill Education. Kindle Edition.
Which terms describe the process of enabling low-level execution of user applications with elevated privileges in mobile environments? (Choose two.)
A. DAST
B. Rooting
C. Pivoting
D. Jailbreaking
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 111). McGraw-Hill Education. Kindle Edition.
B. Rooting
D. Jailbreaking
Explanation:
Rooting and jailbreaking are the terms for the process of enabling low-level execution of user applications with elevated privileges in Android and iOS, respectively. A and C are incorrect. A is incorrect because DAST (dynamic application security testing) is the process of testing and analyzing an application in real time, as it executes. C is incorrect because pivoting is a technique used in penetration testing wherein an attacker’s traffic is routed through hosts and systems that have been compromised. The goal of pivoting is to increase the attacker’s footprint and their visibility of the target’s networks and subnets that may be accessible from internal hosts but not from the attacker’s initial point of entry.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (pp. 119-120). McGraw-Hill Education. Kindle Edition.
Which tool for Android is a reverse engineering framework with a graphical interface, code editor, and an APK signing feature that allows users to modify and repackage code as needed?
A. APKX
B. MobSF
C. APK Studio
D. Drozer
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 111). McGraw-Hill Education. Kindle Edition.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 111). McGraw-Hill Education. Kindle Edition.
C. APK Studio
Explanation:
APK studio is a reverse engineering framework useful in static analysis of Android applications by
disassembling and reassembling APK files. It features a graphical user interface, code editor, and an APK signing ability that allows a penetration tester to repackage an APK if necessary. A, B, and D are incorrect. A is incorrect because APKX is a decompiler used to extract Java source code directly from Android APK files. B is incorrect because MobSF is an all-in-one, “Swiss army knife” penetration testing framework for mobile applications, capable of facilitating SAST for Android, iOS, and Windows phone platforms and DAST for Android. D is incorrect because Drozer is a security auditing framework for Android that helps penetration testers identify and validate vulnerabilities discovered in applications. It consists of two components: an agent installed on a mobile device, and a console installed on a testers workstation
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 120). McGraw-Hill Education. Kindle Edition.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 120). McGraw-Hill Education. Kindle Edition.
