CMT Security & Data Protection Standards 3 — Questions and Answers
Question 1: Which type of attack involves an attacker intercepting communication between a mobile device and a Wi-Fi access point without either party knowing?
- Phishing attack
- Man-in-the-middle (MitM) attack (Correct answer)
- Brute force attack
- SQL injection
Correct answer: Man-in-the-middle (MitM) attack
A man-in-the-middle attack intercepts and potentially alters communications between two parties who believe they are communicating directly.
Question 2: A customer reports their device was stolen. They want to prevent the thief from reselling it. Which feature specifically ties a device to an account and blocks activation on a new account?
- Remote lock
- Activation Lock (Find My / FRP) (Correct answer)
- Device encryption
- Screen PIN
Correct answer: Activation Lock (Find My / FRP)
Activation Lock on iOS and Factory Reset Protection (FRP) on Android prevent a device from being set up under a new account without the original owner's credentials.
Question 3: What is the purpose of certificate pinning in a mobile application?
- To speed up SSL handshake negotiations
- To prevent MitM attacks by validating the server's specific certificate (Correct answer)
- To store user passwords securely on the device
- To enable offline authentication
Correct answer: To prevent MitM attacks by validating the server's specific certificate
Certificate pinning ensures the app only trusts a specific known certificate, preventing attackers from using a rogue but technically valid certificate to intercept traffic.
Question 4: Which of the following BEST describes 'jailbreaking' a mobile device from a security standpoint?
- Resetting the device to factory defaults
- Bypassing OS security restrictions to allow unauthorized code execution (Correct answer)
- Unlocking the carrier SIM restriction
- Updating the device to a newer OS version
Correct answer: Bypassing OS security restrictions to allow unauthorized code execution
Jailbreaking removes OS-level security sandboxing, exposing the device to malware and unauthorized access that the stock OS would normally block.
Question 5: A shop receives a device for liquid damage repair that contains sensitive health data. Under HIPAA, what obligation does the repair shop have?
- None, HIPAA only applies to healthcare providers
- The shop must sign a Business Associate Agreement (BAA) and handle data appropriately (Correct answer)
- The shop must upload the data to a HIPAA-compliant cloud
- The shop must immediately wipe the device before repair
Correct answer: The shop must sign a Business Associate Agreement (BAA) and handle data appropriately
Repair shops that handle devices containing protected health information (PHI) may qualify as business associates and must execute a BAA and follow HIPAA safeguards.
Question 6: Which app permission model approach is considered MOST secure for a mobile device?
- Grant all permissions at app install time
- Prompt the user for each permission at the time it is needed (runtime permissions) (Correct answer)
- Allow apps to self-declare their required permissions without user approval
- Grant permissions based on app store rating
Correct answer: Prompt the user for each permission at the time it is needed (runtime permissions)
Runtime permissions give users contextual control over what data an app can access exactly when it needs it, reducing unnecessary data exposure.
Question 7: What is the role of a Trusted Execution Environment (TEE) in mobile device security?
- It manages app download permissions from the app store
- It provides an isolated, hardware-backed environment for processing sensitive data like biometrics and cryptographic keys (Correct answer)
- It monitors battery health during intensive tasks
- It controls network bandwidth allocation per app
Correct answer: It provides an isolated, hardware-backed environment for processing sensitive data like biometrics and cryptographic keys
A TEE (e.g., ARM TrustZone) runs in a separate, hardware-isolated zone that protects sensitive operations even if the main OS is compromised.
CMT Security & Data Protection Standards 3
Which type of attack involves an attacker intercepting communication between a mobile device and a Wi-Fi access point without either party knowing?