What is the purpose of using App Transport Security (ATS) in iOS development?
*
To block all network communications
To enhance app performance
To enforce secure network connections
To bypass network security checks
What should you do to guard against SQL injection vulnerabilities in mobile app development?
*
Use raw SQL queries for database operations
Sanitize user inputs and use parameterized queries
Avoid database operations altogether
Rely on Core Data for database security
To prevent unauthorized components from launching your app activities, what attribute can you use in the AndroidManifest.xml file?
*
android:exported
android:enabled
android:visible
android:accessible
Which security feature in the AndroidManifest.xml file allows you to declare a network security configuration for your app?
*
NetworkProvider
InternetAccessControl
NetworkSecurityConfig
SecureConnection
What does the "Runtime Permissions" model in Android help with?
*
Securing network communications
Managing UI components
Ensuring proper permissions for app resources
Debugging the app
Which security mechanism helps protect against man-in-the-middle attacks in mobile applications?
*
Certificate Pinning
Clear text communication
HTTPS (SSL/TLS)
NFC
How does the Keychain protect sensitive data stored within it?
*
By encrypting data using a user's iCloud account
By using hardware-based encryption and access controls
By requiring developers to obfuscate data
By regularly purging data to minimize the risk of data breaches
What type of information can be securely stored in the Keychain?
*
Only user credentials like usernames and passwords
Only encryption keys for app data
A wide range of sensitive information, including passwords, tokens, certificates, and more
App source code and assets
What are keychain access groups used for?
*
Sharing keychain items across different apps
Organizing keychain items within the same app
Enabling public access to the keychain
Encrypting data within the keychain
What is the main difference between the Android Keystore and the iOS Keychain?
*
The Android Keystore is more secure
The iOS Keychain is more secure
The iOS Keychain allows the developer to store arbitrary data while the Android Keystore does not
The Android Keystore allows the developer to store arbitrary data while the iOS Keychain does not
If mobile applications work in a sandbox environment and devices implements Full Disk Encryption, why we need to use additional encryption to protect data inside Preferences, Databases or File?
*
How can the use of the Data Protection API  benefit organizations and developers in ensuring the security and privacy of sensitive data in their applications? Please provide examples and discuss potential use cases for this API.
*
How does the Keychain, as a secure data storage mechanism in iOS, play a critical role in protecting user privacy and sensitive information within applications? Could you provide examples of real-world scenarios where the Keychain's use is essential, and discuss best practices for developers to maximize its security benefits?
*
Describe the secure flow to be implemented in order to have a secure biometric authentication in Android applications.
*
Describe the secure flow to be implemented in order to have a secure biometric authentication in iOS applications.
*
How can the implementation of custom permissions in your application enhance security and user privacy? Please describe the process of defining and utilizing custom permissions, and discuss the potential advantages of using them in different types of applications.
*
Describe at least  different Security Design Principle and provide some example of using them in mobile app development.
*
During the training we discussed about the protection against Data Leakage by exploiting Screenshot and Recent Apps image. Describe the countermeasures that can be applied both in Android and iOS applications.
*
You are reviewing the AndroidManifest.xml of an application and find this configuration:
...
        <activity android:label="@string/apic_label" android:name="com.mindedsecurity.insecureandroid.APICredsActivity">
            <intent-filter>
                <action android:name="com.mindedsecurity.insecureandroid.action.VIEW_CREDS"/>
                <category android:name="android.intent.category.DEFAULT"/>
            </intent-filter>
        </activity>
        <activity android:name="com.mindedsecurity.insecureandroid.InsecureCommunicationActivity"/>
...

Can you identify the security issue? What countermeasures can be applied in order to fix or mitigate the vulnerability?
*
Why secrets such as encryption keys, password and o on should not be hardcoded in the source code of mobile applications?
*
During the training we talked about the need to implement different security mechanisms in order to protect applications (defense in depth).
Considering for example the Certificate Pinning and the Resiliency why they should be both implemented in a mobile application?
*