AAD Risk Management & Mitigation 2 — Questions and Answers
Question 1: Which Android API prevents screenshots and screen recordings of sensitive content within your app?
- WindowManager.LayoutParams.FLAG_SECURE (Correct answer)
- View.setVisibility(View.INVISIBLE)
- Window.setSecureMode(true)
- ActivityManager.FLAG_PREVENT_CAPTURE
Correct answer: WindowManager.LayoutParams.FLAG_SECURE
FLAG_SECURE marks a window as containing sensitive content, preventing it from appearing in screenshots or being captured by screen recording tools.
Question 2: A developer stores an API key directly in the strings.xml resource file. What is the primary risk?
- Increased APK size
- The key is extractable via decompiling the APK (Correct answer)
- The key cannot be used at runtime
- The build process will fail
Correct answer: The key is extractable via decompiling the APK
Resource files are bundled into the APK and can be extracted by decompiling the APK with tools like apktool, exposing hardcoded secrets.
Question 3: What is the recommended mitigation for SQL injection vulnerabilities in Android SQLite databases?
- Encrypt the database file
- Use parameterized queries or prepared statements (Correct answer)
- Store data in SharedPreferences instead
- Limit database size to under 1 MB
Correct answer: Use parameterized queries or prepared statements
Parameterized queries ensure user input is treated as data rather than executable SQL, preventing injection attacks.
Question 4: Which mitigation strategy helps detect if an Android app has been tampered with or repackaged by an attacker?
- Enabling StrictMode
- Signature verification at runtime (Correct answer)
- Using a ConstraintLayout
- Enabling lint checks in Gradle
Correct answer: Signature verification at runtime
Checking the app's signing certificate at runtime detects repackaged APKs, since attackers must re-sign the app with a different key.
Question 5: What risk does an exported Activity with no permission requirement introduce?
- Increased battery consumption
- Any app on the device can launch it, potentially bypassing authentication (Correct answer)
- The Activity cannot access the internet
- ProGuard will strip the Activity class
Correct answer: Any app on the device can launch it, potentially bypassing authentication
An exported Activity with no android:permission attribute can be started by any app or component on the device, potentially exposing sensitive functionality.
Question 6: A developer uses MD5 to hash passwords before storing them. Why is this a security risk?
- MD5 is not supported on Android
- MD5 produces hashes that are too long
- MD5 is cryptographically broken and vulnerable to collision and preimage attacks (Correct answer)
- MD5 cannot hash strings longer than 128 characters
Correct answer: MD5 is cryptographically broken and vulnerable to collision and preimage attacks
MD5 is considered cryptographically broken; attackers use rainbow tables and collision attacks to reverse MD5 hashes quickly.
Question 7: Which Android security feature isolates each app's data so other apps cannot directly access it without explicit sharing?
- ProGuard obfuscation
- Android sandbox and app-specific storage (Correct answer)
- Runtime permissions
- Doze mode
Correct answer: Android sandbox and app-specific storage
Android's sandbox model assigns each app a unique user ID and restricts file access to app-specific directories, preventing cross-app data leakage.
AAD Risk Management & Mitigation 2
Which Android API prevents screenshots and screen recordings of sensitive content within your app?