312-50 Question 407
Single answer▪ Mobile Security Guidelines and ToolsA security consultant is performing an authorized assessment of a company's Android mobile banking application. The client wants to know whether sensitive data such as session tokens, cached credentials, or API responses can be recovered from the app after normal use on a test device. The consultant wants an approach that follows common mobile testing guidance and provides the most direct evidence of insecure local data storage. Which action is the BEST choice?
- A
Use Drozer or ADB to inspect the application's sandbox, databases, shared preferences, and files on the test device after exercising the app
- B
Run Nmap against the mobile device to identify open ports and recover session tokens stored by the application
- C
Use Aircrack-ng to capture the wireless traffic and prove that the application stores credentials insecurely on the device
- D
Perform a Denial-of-Service test against the backend API to see whether the app clears cached data after a crash
Show answer and explanation
Correct answer: A
Explanation
The best answer is to inspect the Android application's local storage using Android-focused testing methods and tools. In real-world mobile assessments, verifying insecure data storage means checking where the app persists data after normal usage: shared preferences, SQLite databases, internal/external storage files, logs, and WebView or cache artifacts. This approach is consistent with widely accepted mobile security guidance such as the OWASP Mobile Application Security Testing Guide (MASTG) and OWASP Mobile Top 10 categories related to insecure data storage. ADB is a standard Android debugging and inspection utility, and Drozer is a recognized tool for assessing Android application attack surface and identifying weaknesses in exposed components and app behavior. Network tools like Nmap or Aircrack-ng may be valuable in other phases of testing, but they do not directly validate whether sensitive information remains recoverable from the app's storage on the device.
- A. Correct.
Correct. To verify insecure local storage on Android, the most direct approach is to inspect the app's local storage areas after normal app use. On a properly authorized test device, tools such as ADB can be used to access application data where permitted, and Drozer is specifically useful for assessing Android application attack surface, exported components, and certain storage-related weaknesses. Examining shared preferences, SQLite databases, local files, WebView caches, and logs aligns with standard mobile assessment practices and directly answers the client's question about recoverable sensitive data at rest.
- B. Incorrect.
Incorrect. Nmap is useful for network discovery and port scanning, not for examining how an Android application stores sensitive information locally. While it may identify exposed services on a device, it does not provide evidence that tokens or credentials are stored insecurely in the application's local sandbox.
- C. Incorrect.
Incorrect. Aircrack-ng is a wireless security toolset primarily used for assessing Wi-Fi security. Capturing traffic may help identify sensitive data transmitted over the network, but that is different from proving insecure local data storage on the mobile device. This option reflects the common misconception that insecure transmission and insecure storage are the same issue.
- D. Incorrect.
Incorrect. A DoS test against the backend API is not an appropriate or direct method for determining whether the app leaves sensitive data in local storage. It also shifts focus from mobile application data-at-rest testing to service availability testing. Even if a crash occurs, that would not reliably demonstrate the presence or absence of insecurely stored tokens, cached credentials, or API responses.