AAD Risk Management & Mitigation 3

Question 1

What is the purpose of certificate pinning in Android network security?

Accepted Answer

To prevent man-in-the-middle attacks by validating the server's expected certificate

Answer

Certificate pinning rejects connections to servers presenting unexpected certificates, stopping MITM attacks even from compromised certificate authorities.

Question 2

Which Gradle configuration option enables R8/ProGuard to reduce attack surface by removing unused code from the release APK?

Accepted Answer

minifyEnabled true

Answer

Setting minifyEnabled true activates R8/ProGuard code shrinking, removing unused classes and methods that could otherwise be exploited.

Question 3

A user's Android device is stolen while unlocked. What app-level mitigation best protects sensitive data in this scenario?

Accepted Answer

Requiring re-authentication after a short inactivity timeout

Answer

Requiring re-authentication after a timeout ensures that even physical access to an unlocked device does not bypass in-app authentication.

Question 4

What risk is introduced when an app logs sensitive user data using Log.d() in production builds?

Accepted Answer

Sensitive data can be read from device logs by other apps with READ_LOGS permission or via ADB

Answer

Android logs can be accessed via ADB or by apps with READ_LOGS permission, making production debug logs a data leakage risk.

Question 5

Which approach mitigates the risk of sensitive data persisting in Android's task switcher (recent apps screen)?

Accepted Answer

Using FLAG_SECURE or excluding the Activity from the Recents screen

Answer

FLAG_SECURE prevents the system from capturing a snapshot of the window for the Recents screen, protecting sensitive content from being visible.

(AAD) Associate Android Developer Certification Practice Test

(AAD) Associate Android Developer Certification Practice Test

AAD Risk Management & Mitigation 3