vmartinez

You have been in conversations with a U.S Federal agency around Android device security. The agency’s security team has just started to refer to a document called the STIG. What document are they referring to?

 

(A) Security Technical Implementation Guide that provides guidance on how to deploy a mobile device.

(B) Simple Technical Instruction Guide that provides guidance on how to deploy devices.

(C) Standard Template of Information Guidance for agencies to use for deploying only Android devices.

(D) It’s the Sample Template Instruction Guide used to deploy Android and iOS devices for government agencies.

 

You have just completed a security presentation with Games Inc. The CIO appreciates your time but is asking for 3rd party validations that Android is, in fact, as secure as you are promoting it to be. What are some 3rd party validations and initiatives you can share with the Games Inc team to further boost their confidence around Android security? (Select 3) Select All Correct Responses

 

(A) Share the Gartner Device Security Report that compare security features between Android and other mobile platforms.

(B) Instruct the customer to read the 2020 Omdia survey on how Android comes out on top for mobile security.

(C) Share information about the vulnerability rewards programs and the metrics. Google has the confidence to offer payments that surpass other platforms alluding to the fact they are hard to find.

(D) Have the customer search the internet for Android Malware to see there are not many articles on the topic.

 

Android devices used in the US Federal Gov’t and many other Gov’ts around the world must go through the NIAP validation process. What security assurances does this provide? (Select 2) Select All Correct Responses

 

(A) There is a publicly available document issued by NIAP as proof of passing a strict testing process by a lab.

(B) NIAP supplies assurances for only special purpose devices that are not available commercially off the shelf.

(C) The NIAP process does not provide assurances, it only assumes that OEM’s have used the best practices set forth by standards.

(D) Instructions are provided on how to configure the device so that it is consistent with the evaluated configuration as a reference.

 

Gomer has found a vulnerability in an application and has written an exploit to attack the app. What Android platform hardening technology helps prevent Gomers attack from working?

 

(A) Address Space Layout Randomization (ASLR).

(B) Android Enterprise copy/paste prevention APIs.

(C) Once the exploit gets onto the phone, Gomer would be able to execute his attack with ease.

(D) Fortify Source.

 

A malicious application developer has decided to target Android users by creating a small puzzle app filled with malware. The goal is to get it on as many Android devices as possible using the Google Play Store. What are some of the reasons this developer will not be successful? (Select 2) Select All Correct Responses

 

(A) All apps uploaded to Google Play are scanned for malware.

(B) Google Play Protect would scan the app and detect the malware.

(C) All apps are reviewed by a Google security analyst.

(D) The attacker will use known spyware to infect the devices.

 

You deployed an app that transmits sensitive data and you require the app to use the VPN. In testing, you see that the app tries to connect without the VPN. How could you fix this?

 

(A) Educate the users to not use the app if they do not see the VPN is running.

(B) Do not allow the user to connect to public WiFi.

(C) Ask the developer to hard code a clear text token connection string in the app to use for authentication.

(D) You must configure the VPN policy to deny app access to the network if the VPN is unavailable.