ADR-001 Exam Questions

Why is it important to carefully set the permissions for a content provider?

Which of the following statements is TRUE about session tokens?

Which of the following in asymmetric encryption should NOT be transmitted?

When applying PBKDF2 to a password, what would be the MORE secure number of iterations to use?

To protect a Content Provider from abuse a developer might implement:

Which of the following describes a process by which one party confirms the identity of another party?

Which of the following describes what is wrong with the following sample code? public class MyActivity extends Activity{ public void onCreate(Bundle myBundle){ foo( ); } }

What is an advantage of mutually authenticated SSL over standard HTTP authentication methods?

What additional task is accomplished by using mutual-authentication SSL as opposed to standard SSL?

Which of the following is the primary reason for web services to output encode all data sent to Android application clients?

When an app "logs out" of a back end system the developer should also ensure:

In public key cryptography which problem can occur when the public key is transmitted?

Which of the following is a reason to take mobile app security seriously when developing a social networking app that does NOT accept payments? (Select TWO).

When reviewing the security architecture of a mobile app, which of the following is the MOST important piece of data to start with?

What level of security is provided by placing sensitive methods and data inside its own Java package?

When storing a PIN used to logon to the app, by applying a cryptographic hash function a developer will:

Which of the following is TRUE regarding permissions?

How does HTTP Basic Authentication work?

Which of the following attempts to inhibit an application from being trojanized and proliferating?

Which of the following defines the difference between static and dynamic analysis of an application?

An attacker intercepts and potentially tampers with communication between two entities without the knowledge of either of the two entities. This BEST describes which of the followi...

Which of the following methodologies is BEST for a developer to find input validation weaknesses in their own mobile app source code?

Which of the following describes why a developer should define private wrappers around native and public native methods?

The MOST likely reason the developer might want to define their own permission in the manifest is because:

A file with Unix permissions `700' allows:

In an application architecture diagram, what categories of weaknesses are considered using Microsoft's threat modeling process?

In the AndroidManifest.xml file which element is used to define the permissions an app is requesting access to?

Which of the following attempts to prevent Javascript from accessing a session cookie in a mobile browser?

Which statement about native code in apps is TRUE?

Which of the following sensitive data items must be protected in transit at all times?

On an unencrypted rooted Android device, which of the following BEST describes which data is recoverable?

The filterTouchesWhenObscured property helps protect against which of the following attacks?

An example of APIs protected by permissions would bE.(Select TWO).

How does HTTP Digest Authentication work?

A onetime pad is considered cryptographically secure, which are two ways it can be broken? (Select TWO).

What are two advantages to using OAuth as the authentication method for an Android application to access a web application or service? (Select TWO).

Which of the following describes a best practice in a software system?

A SQL database password should be:

What is meant by one way function?

Why should the Secure attribute be set on any session cookie sent to an Android application?

Unencrypted temporary private user data cached in the application directory should be:

Signing data with a digitalsignature.(Select TWO)

A developer is using a third-party cloud service via Web APIs for backup of unencrypted user photos. The use of this service is invisible to the end user. Incorporation of this ser...

Which of the following must be protected in a symmetric encryption system?

Why should a developer ensure the debug flag is set to "false" in the manifest for a production build?

Which of the following are widely considered appropriate uses of reverse engineering? (Select TWO).

Which of the following techniques are useful in a secure software development process? (Select TWO).

Which of the following describes a security risk that may have to be accepted when using a commercial cross-platform mobile application framework?

When generating a key from a password why would a developer want to iterate this process many times?

Why should a developer add a `salt' to a password?