AAD Risk Management & Mitigation 5

Question 1

What is the risk of setting android:debuggable="true" in a production release manifest?

Accepted Answer

Attackers can attach a debugger, inspect memory, and bypass security controls at runtime

Answer

A debuggable production app allows anyone with ADB access to attach a debugger, dump memory, and extract sensitive data or bypass security logic.

Question 2

Which Android feature should be used to protect sensitive IPC communication between app components?

Accepted Answer

Defining android:permission on exported components

Answer

Specifying a custom android:permission on exported Services, Activities, or BroadcastReceivers restricts which callers can interact with those components.

Question 3

A developer uses a self-signed certificate and disables SSL validation in production to avoid certificate errors. What is the consequence?

Accepted Answer

The app becomes fully vulnerable to man-in-the-middle attacks on all network traffic

Answer

Disabling SSL certificate validation removes the cryptographic trust chain, allowing any intercepting party to read and modify HTTPS traffic undetected.

Question 4

What is the purpose of the Android Network Security Configuration file (network_security_config.xml)?

Accepted Answer

To declaratively define trusted CAs, certificate pins, and cleartext traffic rules per domain

Answer

The Network Security Configuration file lets developers customize SSL/TLS behavior, including certificate pinning and blocking cleartext HTTP, without code changes.

Question 5

What risk does an implicit BroadcastReceiver registered in the manifest for a custom action expose?

Accepted Answer

Other apps can send intents matching that action, potentially triggering unintended behavior

Answer

An unprotected implicit BroadcastReceiver allows any app to send matching broadcasts and trigger the receiver's logic, which may expose sensitive operations.

(AAD) Associate Android Developer Certification Practice Test

(AAD) Associate Android Developer Certification Practice Test

AAD Risk Management & Mitigation 5