AAD Risk Management & Mitigation 4

Question 1

What is the recommended way to store OAuth tokens securely on Android?

Accepted Answer

In the Android Keystore System or EncryptedSharedPreferences

Answer

The Android Keystore System stores cryptographic keys in hardware-backed secure storage, and EncryptedSharedPreferences encrypts data at rest.

Question 2

Which risk is mitigated by setting android:allowBackup="false" in the AndroidManifest.xml?

Accepted Answer

Blocking ADB backup extraction of the app's private data

Answer

With allowBackup=true (the default), ADB backup can extract app data without root access; setting it to false blocks this extraction path.

Question 3

A third-party SDK included in an Android app requests the CONTACTS permission. What risk management practice should be applied?

Accepted Answer

Audit SDK permissions and use Permission Reviewer or a dependency scanner to assess necessity

Answer

Third-party SDKs can merge permissions into the final manifest; auditing SDK requirements ensures no unnecessary or risky permissions are granted.

Question 4

What is a primary risk of using Android's WebView to load untrusted external URLs without disabling JavaScript?

Accepted Answer

Cross-site scripting (XSS) attacks can execute arbitrary JavaScript in the app's context

Answer

JavaScript enabled in a WebView loading untrusted content can execute scripts that access native Android bridges or steal app data via XSS.

Question 5

What does enabling StrictMode in Android development help identify?

Accepted Answer

Policy violations like disk I/O or network calls on the main thread, which can cause ANR risks

Answer

StrictMode detects inadvertent disk or network access on the main thread that could lead to Application Not Responding (ANR) errors in production.

(AAD) Associate Android Developer Certification Practice Test