Practice Test Geeks(AAD) Associate Android Developer Certification Practice Test
← All AAD Flashcard Decks

Risk Management & Mitigation Flashcards

7 cards from real AAD practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Risk Management & Mitigation flashcards as text

  1. What is the risk of setting android:debuggable="true" in a production release manifest?

    Answer: Attackers can attach a debugger, inspect memory, and bypass security controls at runtime

    A debuggable production app allows anyone with ADB access to attach a debugger, dump memory, and extract sensitive data or bypass security logic.

  2. Which Android feature should be used to protect sensitive IPC communication between app components?

    Answer: Defining android:permission on exported components

    Specifying a custom android:permission on exported Services, Activities, or BroadcastReceivers restricts which callers can interact with those components.

  3. A developer uses a self-signed certificate and disables SSL validation in production to avoid certificate errors. What is the consequence?

    Answer: The app becomes fully vulnerable to man-in-the-middle attacks on all network traffic

    Disabling SSL certificate validation removes the cryptographic trust chain, allowing any intercepting party to read and modify HTTPS traffic undetected.

  4. What is the purpose of the Android Network Security Configuration file (network_security_config.xml)?

    Answer: To declaratively define trusted CAs, certificate pins, and cleartext traffic rules per domain

    The Network Security Configuration file lets developers customize SSL/TLS behavior, including certificate pinning and blocking cleartext HTTP, without code changes.

  5. What risk does an implicit BroadcastReceiver registered in the manifest for a custom action expose?

    Answer: Other apps can send intents matching that action, potentially triggering unintended behavior

    An unprotected implicit BroadcastReceiver allows any app to send matching broadcasts and trigger the receiver's logic, which may expose sensitive operations.

  6. Why is it risky to pass sensitive data (e.g., passwords) as Intent extras between Android components?

    Answer: Intents can be intercepted by other apps that register for the same action or by system logging

    Intent data can be read by other apps via broadcast snooping or logged in system logs, making it unsuitable for transmitting sensitive information.

  7. Which Google Play policy compliance risk arises when an Android app requests permissions not justified by its core functionality?

    Answer: Google may reject or remove the app for violating minimum necessary permissions policy

    Google Play's policy requires apps to request only permissions necessary for their declared functionality; excessive permissions can trigger removal or rejection.