312-50 Question 405
Single answer▪ Mobile Security Guidelines and ToolsA security consultant is performing an authorized assessment of an Android banking application. The client wants evidence that the app follows mobile security best practices for protecting sensitive data at rest and in transit, but they do not want the consultant to modify the APK or rely on static code review alone. Which approach would BEST meet this requirement during the assessment?
- A
Use MobSF to decompile the APK and review the source for hardcoded keys and insecure API calls
- B
Use adb backup to extract all private application data, then inspect the SQLite databases for plaintext credentials
- C
Use a runtime instrumentation and proxy-based approach: intercept traffic with Burp Suite and use Frida/Objection to examine whether certificate pinning, local storage protections, and runtime secrets handling are enforced
- D
Root the device and disable Android sandboxing so the tester can inspect all app memory and system files without restrictions
Show answer and explanation
Correct answer: C
Explanation
The key requirement is to evaluate mobile security controls in a realistic, runtime-focused way without modifying the APK or depending solely on static review. In mobile app assessments, best practice is to combine dynamic analysis tools and traffic inspection to validate actual behavior. Burp Suite is widely used to inspect and test application traffic, while Frida and Objection support runtime instrumentation for testing protections such as certificate pinning, client-side secret handling, and access to local storage. This aligns with guidance from OWASP Mobile Application Security Testing Guide (MASTG), which emphasizes validating both storage and network protections through dynamic testing. Static tools such as MobSF are valuable, but they do not by themselves satisfy the requirement here because the scenario specifically prioritizes runtime evidence over static analysis alone.
- A. Incorrect.
This is not the best answer because the scenario explicitly says the client does not want the consultant to modify the APK or rely on static code review alone. MobSF is a legitimate mobile application security testing framework and is very useful for static and dynamic analysis, but the option emphasizes decompilation and source review rather than validating runtime protections and actual behavior in transit and at rest.
- B. Incorrect.
This is not the best answer because adb backup is not a reliable or broadly applicable method for modern Android assessments. Many apps disable backup, and newer Android versions have significantly restricted or deprecated this capability. It also focuses mainly on data-at-rest artifacts and does not address transport security controls such as TLS validation or certificate pinning. A tester choosing this may be assuming older Android backup behavior still applies universally.
- C. Correct.
This is the best answer. It aligns with the client's requirement to assess data protection in transit and at rest without modifying the APK and without relying only on static analysis. Burp Suite can help validate transport-layer protections, TLS behavior, and whether sensitive data is exposed over the network. Frida and Objection are commonly used for dynamic mobile assessment to inspect runtime behavior, test for certificate pinning, observe how secrets are handled in memory, and evaluate whether the app stores sensitive data insecurely on the device. This approach matches practical mobile testing guidance and real-world CEH-style assessment methodology.
- D. Incorrect.
This is incorrect because rooting a device may be useful in some lab scenarios, but disabling Android sandboxing is not a normal or appropriate assessment approach and does not reflect mobile security best practices. It also changes the execution environment significantly, which can reduce the reliability of findings about how the app behaves on a standard device. A tester might select this because root access can increase visibility, but it is overly invasive and not the best fit for the stated constraints.