LabYard_

Hacking Mobile Platforms

Answer all 15 questions, then submit. You need 75% to pass. If you don't pass, the reattempt unlocks after 24 hours.

Q1. SMS-based one-time codes are considered weaker than app-based codes because:

They are slower SIM swapping and SS7 interception can redirect them They cost more They are shorter

Q2. Root detection in an application is best regarded as:

A replacement for encryption Required by law A speed bump that a determined attacker will bypass An absolute guarantee

Q3. Hardcoded API keys in a mobile app are dangerous because:

They increase the download size Anyone can extract them from the distributed package They slow the app They expire quickly

Q4. Insecure data storage on mobile most often means:

Using too much space Storing tokens or personal data in plaintext on the device Slow database access Excessive caching

Q5. Screenshots in the app switcher can leak data unless the app:

Obscures sensitive screens when entering the background Uses more memory Disables rotation Disables the camera

Q6. Which mobile attack can target SMS?

Rolling Code SMishing SQL Injection BlueBorne

Q7. Frida is used in mobile testing to:

Scan networks Compile APKs Sign packages Instrument and hook a running application at runtime

Q8. Which is a mobile platform vulnerability?

Trusted stores Malicious Apps in Stores Secure updates Strong encryption

Q9. Tapjacking on mobile is analogous to:

Session fixation Clickjacking on the web Buffer overflow SQL injection

Q10. Certificate pinning in a mobile app is intended to:

Speed up TLS Compress traffic Reduce battery use Prevent interception by rejecting certificates outside an expected set

Q11. Mobile device management (MDM) primarily provides:

Free applications Faster networking Better battery life Policy enforcement, configuration and remote wipe

Q12. Which mobile vulnerability involves storing sensitive information insecurely?

DNS Poisoning Port Scanning Rate Limiting Sensitive Data Storage

Q13. Which network attack is listed in the mobile attack anatomy?

Packet Sniffing LDAP WHOIS NTP Sync

Q14. Mobile applications should perform authorisation checks:

Only in the app Only at first launch Only in the UI layer On the server for every request

Q15. Outdated mobile operating systems are a concern because:

They use more data Unpatched platform vulnerabilities remain exploitable They run slower They look dated

LabYard · hands-on security & data training · flags look like ctflab{...}