AAD Professional Ethics & Standards 3

Question 1

You discover a critical security vulnerability in a popular third-party Android library your app depends on. What is the ethical course of action?

Accepted Answer

Privately disclose the vulnerability to the maintainer and allow reasonable time to patch before any public disclosure

Answer

Responsible disclosure gives maintainers time to patch the issue before attackers can exploit public knowledge of the vulnerability.

Question 2

Your Android app bundles an open-source library licensed under GPL v2. What legal and ethical obligation does this create?

Accepted Answer

You may be required to release your app's source code under a GPL-compatible license

Answer

The GPL is a copyleft license that typically requires derivative works to also be distributed under the GPL.

Question 3

Which open-source license allows you to include a library in a closed-source commercial Android app without sharing your source code?

Accepted Answer

MIT License

Answer

The MIT License is a permissive license that imposes no requirement to open-source your own code, making it compatible with proprietary apps.

Question 4

A security researcher contacts you to report a vulnerability in your published Android app. What is the industry-standard ethical response?

Accepted Answer

Acknowledge the report, fix the issue promptly, and credit the researcher with their consent

Answer

A professional bug bounty culture encourages researchers to report responsibly, which improves security for all users.

Question 5

When storing sensitive authentication tokens in an Android app, which approach is most secure and ethical?

Accepted Answer

Use the Android Keystore System to protect cryptographic keys

Answer

The Android Keystore System stores keys in secure hardware, preventing extraction even if the device is compromised.

(AAD) Associate Android Developer Certification Practice Test