AAD Risk Management & Mitigation 2

Question 1

Which Android API prevents screenshots and screen recordings of sensitive content within your app?

Accepted Answer

WindowManager.LayoutParams.FLAG_SECURE

Answer

FLAG_SECURE marks a window as containing sensitive content, preventing it from appearing in screenshots or being captured by screen recording tools.

Question 2

A developer stores an API key directly in the strings.xml resource file. What is the primary risk?

Accepted Answer

The key is extractable via decompiling the APK

Answer

Resource files are bundled into the APK and can be extracted by decompiling the APK with tools like apktool, exposing hardcoded secrets.

Question 3

What is the recommended mitigation for SQL injection vulnerabilities in Android SQLite databases?

Accepted Answer

Use parameterized queries or prepared statements

Answer

Parameterized queries ensure user input is treated as data rather than executable SQL, preventing injection attacks.

Question 4

Which mitigation strategy helps detect if an Android app has been tampered with or repackaged by an attacker?

Accepted Answer

Signature verification at runtime

Answer

Checking the app's signing certificate at runtime detects repackaged APKs, since attackers must re-sign the app with a different key.

Question 5

What risk does an exported Activity with no permission requirement introduce?

Accepted Answer

Any app on the device can launch it, potentially bypassing authentication

Answer

An exported Activity with no android:permission attribute can be started by any app or component on the device, potentially exposing sensitive functionality.

(AAD) Associate Android Developer Certification Practice Test

(AAD) Associate Android Developer Certification Practice Test

AAD Risk Management & Mitigation 2