6 - Mobile and Embedded Device Security

As part of your software test engineering role at a corporation, you need to set up a system that generates random input to trigger events such as exceptions, memory corruption, and other security breaches. Which of the following will you deploy? Select two. a. Fuzzing process b. Static code analysis c. Dynamic code analysis d. Random input tester e. Deterministic test engine

a, c

Guang buys a mobile device at an Apple store. He wants to harden the device using two strong methods of authentication. Which of the following would you advise Guang to use? Select two. a. Password b. Swipe pattern c. Facial recognition d. Use the Smart Lock feature e. A PIN with at least four digits

a, c

A senior software engineer starts working at a small company that wants to incorporate secure coding practices. Quality assurance currently begins after the application has been tested but before production. The engineer sees an opportunity and recommends adopting a method that breaks down the project into smaller biweekly development "bursts" that include testing. Which of the following statements are true? Select two. a. The engineer prefers using the agile model. b. The engineer is suggesting the iterative model. c. The engineer is advocating for the waterfall model. d. The company is currently using the waterfall model. e. The model suggested by the engineer uses a system that has sequential characteristics.

a, d

Which of the following statements represents steps that can be taken to harden SCADA systems? Select two. a. Disconnect unnecessary connections to the SCADA network. b. Make sure proprietary protocols used to protect the network are secure. c. Do not use security features provided by devices because they are typically weak. d. Identify all connections to SCADA networks.

a, d

Which of the following statements best describe why it is beneficial to use a RTOS in a SoC? a. A RTOS can handle very large amounts of data very quickly. b. A RTOS is tuned to endure extreme environmental conditions. c. It has many configurable security features that are embedded. d. It orchestrates communication between IC chips very efficiently.

a. A RTOS can handle very large amounts of data very quickly.

At a software development company, team Alpha is responsible for static code analysis while team Beta is responsible for dynamic code analysis. Which of the following statements accurately describes the differences or similarities relative to how the teams conduct their analysis? Select two. a. Dynamic code analysis uses an automated process before the code is compiled. b. Static code analysis is performed on executable files while they are not running. c. Static code analysis may include actively examining each line of code visually. d. Dynamic code analysis is performed while the code is running.

c, d

You work at a very large water treatment facility. Which of the following best describes systems you should secure and harden to help minimize any potential downtime? Select two. a. Embedded systems b. IoT systems c. SCADA systems d. Control and response systems e. ICS systems

c, e

You are hired as a consultant to create a SecDevOps program at a software development firm. Which of the following are you most likely to implement? Select two. a. Dedicate human resources (a team of individuals) to monitor the process. b. Ensure repetitive tasks that are not necessarily easy to automate are well documented. c. Employ automation wherever possible. d. Ensure modifications to immutable systems use the agile model. e. Use a hybrid model that employs elements of both the waterfall and agile model. f. Embrace continuous modifications through the process with provision to roll back as needed.

c, f

For security reasons, an app has the restriction that it can only be used within a one-kilometer radius of a secure facility. What is being used to enforce this restriction? a. Appguard b. Appfencing c. Geofencing d. Geoguard

c. Geofencing

A parent, who is a small business owner, takes their child on a business trip. The child uses the parent's phone during the flight. Unfortunately, the child leaves the phone on the plane, but the parent realizes it after it is too late to retrieve it. What kind of security could have prevented this type of vulnerability? a. Screen lock b. Remote wipe c. Physical security d. Location tracking

c. Physical security

A company uses the COPE enterprise deployment model. Every six months they delete outdated sales data from the mobile devices. However, sometimes users submit a help desk ticket to restore personal data that was accidentally deleted. How could this problem be prevented? a. Use the CYOD enterprise deployment model. b. Use a sandbox to separate corporate and personal data. c. Use containerization. d. Use a folder for corporate data and another for personal data.

c. Use containerization.

A threat actor uses an unpatched application to launch a specific executable file that has a vulnerability. The attacker uses the vulnerability in the executable as a means to make changes to the Microsoft Windows registry keys. What type of attack is the threat actor engaging in? Select two. a. Two-tier vulnerability attack b. Executable startup attack c. Executable file attack d. System tampering e. Process spawning control

d, e

Kaven, an app developer, works for an organization that requires the implementation of dead code. Why would the organization have such a policy? Select two. a. To provide an unnecessary attack vector for attackers. b. Because it is one of the secure coding techniques the organization uses. c. Because the dead code serves as a placeholder for secure third-party libraries. d. To further obfuscate or camouflage the code, making it difficult for attackers to understand. e. To store the digital signature in a concealed location that is only accessible by the organization.

a, b

Which of the following best describes characteristics of embedded systems? Select two. a. They are designed for a specific function. b. They are contained within a larger system. c. They have specialized ports used for direct human input. d. They are fully functional computers integrated into a single chip. e. Due to their size and degree of difficulty to access, they are easier to secure.

a, b

Which of the following statements are true relative to security constraints and cryptography regarding embedded systems and specialized devices? Select two. a. A cryptographic algorithm should have low latency. b. Decreasing latency in a cryptographic algorithm makes it run faster. c. It is better to apply complex and comprehensive security measures to small devices. d. Decreasing latency in a cryptographic algorithm speeds up normal operations of low-power devices

a, b

Which of the following represents capabilities that UEM provides? Select all that apply. a. Install applications remotely. b. Enforce encryption settings. c. Push notification services. d. Record changes to digital documents. e. Apply default device settings.

a, b, c, d, e

A commuter sees a flyer on a train with a QR code advertising high interest rates at an online bank. The commuter scans the code, but the website indicates the promotion has ended. Within a few days the commuter's phone starts sending messages to everyone in the contacts with a malicious link. How could this have been prevented? a. Do not scan QR codes from unfamiliar sources. b. Ensure the antivirus software installed on the phone is up to date. c. Open a browser in private mode before scanning the QR code. d. Download and install a secure browser before scanning the QR code.

a. Do not scan QR codes from unfamiliar sources.

An elderly person withdraws money from an ATM at a bus terminal. They are speaking on their cell phone and overlook retrieving the bank card from the card reader. A malicious actor is watching and steals the card. Unfortunately, the card has a small piece of tape with the PIN. The attacker waits a couple of hours after the elderly person has boarded a bus and goes to the ATM to withdraw money. Even though the elderly person has not yet realized their card is missing, the attacker is unsuccessful. Which of the following most likely thwarted the attacker's intent? a. Geolocation b. Face recognition c. The PIN was incorrect d. An incorrect quick-response OTP

a. Geolocation

An individual places a new USB cable near one of the charging stations at a busy airport. They wait from a nearby distance hoping someone will use the cable. What is the intent of the individual? a. To send malicious commands to the device. b. To be able to use someone else's internet connection. c. To use the cable as a tracking device. d. To use the cable as an antenna to intercept traffic.

a. To send malicious commands to the device.

. Horacio is on a space team developing a RTOS for a mission-critical device that may be exposed to radiation. Which of the following best describes ways in which the team can improve the functionality and security of the RTOS? Select two. a. Embed antivirus capabilities. b. Implement OS self-inspection. c. Implement hardware monitoring. d. Create a complex and encrypted password that is burned in

b, c

Identify the differences or similarities between the Raspberry Pi and the Arduino. Select three. a. Both have strong built-in native security features. b. ICs on the Raspberry Pi and Arduino are not user programmable. c. The Raspberry Pi has more processing power than the Arduino. d. The Raspberry Pi has an FPGA, and the Arduino has an SoC. e. The Arduino is designed as a controller for other devices.

b, c, e

Which of the following are features typically available when enabling loss or theft services on a mobile device? Select two. a. Ability to use a very-low-power GPS tracking mode even after the battery dies. b. Ability to remotely erase sensitive data stored on the device. c. Ability to remotely change the password. d. Ability to remotely spy on the thief. e. Ability to remotely lock the device.

b, e

. Excel is watching a game with friends in a public forum. He is an avid fan and enjoys debating how his favorite player happens to be the best player in the league. Shortly after the game he receives a message on his mobile device with a link purporting to be advertising T-shirts and other merchandise with his favorite player. What may have caused this to happen? a. Malware on his phone turned on the geotracking app. b. Malware on his phone was engaged in unauthorized recording. c. Someone in the public forum who knows Excel is a threat actor. d. The Bluetooth-enabled television heard his conversation.

b. Malware on his phone was engaged in unauthorized recording.

Why has there been a heightened interest by threat actors toward attacking mobile devices? a. They have limited OTA capabilities. b. They have access to sensitive data. c. They use wireless technology. d. They are easy to steal.

b. They have access to sensitive data.

Which statement best describes why devices and systems that are optimized to draw very low levels of power lack the ability to perform strong security measures? a. The batteries do not supply enough energy. b. To preserve battery life. c. The device would heat up too quickly. d. The battery would heat up too much.

b. To preserve battery life.

7. Jailbreaking an Apple iOS device or rooting on Android devices opens opportunities that allow the user to download and install apps from a larger pool of available sources. What are the risks, if any, associated with this type of activity? a. Apps downloaded from unofficial sites will void the warranty and risk not receiving OS updates. b. It gives the user too much access and they may accidentally corrupt the OS. c. There are no significant risks due to the built-in security protections. d. Downloaded apps may contain malware that bypass the phone's security.

d. Downloaded apps may contain malware that bypass the phone's security.

Anita is visiting a client when she discovers an app that was internally developed is missing from her mobile device. She contacts the home office, and they install the app remotely. What tool most likely provided this capability? a. RAI b. RAM c. MMA d. MAM e. MAI f. RAD

d. MAM

Abeni is responsible for managing mobile devices where she works. She needs the ability to restrict jailbroken and rooted devices. In addition, she wants the ability to approve or quarantine new mobile devices. What tool should she deploy? a. MMD b. MMA c. MMC d. MDM e. MAM f. MCM

d. MDM

. A small company decides to adopt the COPE enterprise deployment model and supplies Android devices to its employees. Due to a significant downturn in the economy, they have not upgraded the devices in five years. What should the company do to limit the risk relative to the mobile devices? a. Use the CYOD enterprise deployment model instead. b. Ensure devices are not used for personal activities. c. Ensure OTA updates are being applied. d. Replace the devices with newer models.

d. Replace the devices with newer models.

A firm is developing a new generation of a complex app for mobile devices. They expect the digital user's guide to contain at least 300 pages. It will be created in a collaborative effort authored by six individuals who work remotely. What tool can they use to help them keep track of editing history and version control regarding the user's guide? a. MHC b. MVC c. MAM d. MCC e. GIT f. MCM

f. MCM