Android Development Android Security 2 — Questions and Answers
Question 1: What is SQL injection and how does Room protect against it?
- Room uses parameterized queries with placeholders that prevent user input from being interpreted as SQL (Correct answer)
- Room encrypts all queries
- Room validates input length
- Room uses stored procedures
Correct answer: Room uses parameterized queries with placeholders that prevent user input from being interpreted as SQL
Room's @Query annotation uses parameterized queries where user input is bound as data, not parsed as SQL, preventing injection attacks.
Question 2: What is the purpose of the android:exported attribute in AndroidManifest.xml?
- To control whether other apps can access the component (Correct answer)
- To export app data to external storage
- To enable debug mode
- To share resources with other apps
Correct answer: To control whether other apps can access the component
android:exported=false prevents other apps from starting or interacting with your Activity, Service, or BroadcastReceiver.
Question 3: Which HTTPS security feature verifies the server's identity using a predefined certificate fingerprint?
- Certificate Pinning (Correct answer)
- SSL/TLS
- HSTS
- Certificate Transparency
Correct answer: Certificate Pinning
Certificate pinning embeds the expected server certificate or public key hash in the app, rejecting connections with certificates that don't match.
Question 4: What does the FLAG_SECURE window flag do in Android?
- Prevents the screen content from appearing in screenshots and screen recordings (Correct answer)
- Encrypts window data
- Locks the screen
- Prevents screenshots from being saved
Correct answer: Prevents the screen content from appearing in screenshots and screen recordings
FLAG_SECURE marks an Activity's window as secure, preventing its content from appearing in screenshots, recent apps thumbnails, and screen recordings.
Question 5: Which Android feature prevents apps from running unsigned or tampered code?
- APK Signature Verification (Correct answer)
- ProGuard
- SafetyNet
- Android Verified Boot
Correct answer: APK Signature Verification
APK Signature Verification ensures that apps are signed with a trusted key and have not been tampered with since signing.
Question 6: What is the purpose of the EncryptedSharedPreferences in Android?
- To encrypt both keys and values stored in SharedPreferences (Correct answer)
- To share encrypted files between apps
- To encrypt network traffic
- To store encrypted database credentials
Correct answer: To encrypt both keys and values stored in SharedPreferences
EncryptedSharedPreferences from Jetpack Security encrypts both the keys and values using AES-256, protecting sensitive preference data at rest.
Android Development Android Security 2
What is SQL injection and how does Room protect against it?