Addressing Jailbreaking Vulnerabilities in Mobile Devices

Question #1: A company is adding a clause to its AUP that states employees are not allowed to modify the operating system on mobile devices. Which of the following vulnerabilities is the organization addressing? A.Cross-site scripting B.Buffer overflow C.Jailbreaking (answer) D.Side loading Question #2: Which of the following vulnerabilities is associated with installing software outside of a manufacturer's approved software repository? A.Jailbreaking B.Memory injection C.Resource reuse D.Side loading (answer) Question #3: A bank insists all of its vendors must prevent data loss on stolen laptops. Which of the following strategies is the bank requiring? A.Encryption at rest (answer) B.Masking C.Data classification D.Permission restrictions Question #4: Which of the following is a primary security concern for a company setting up a BYOD program? A.End of life B.Buffer overflow C.VM escape D.Jailbreaking (answer) Question #5: A security administrator would like to protect data on employees' laptops. Which of the following encryption techniques should the security administrator use? A.Partition B.Asymmetric C.Full disk (answer) D.Database Question #6: A security engineer is implementing FDE for all laptops in an organization. Which of the following are the most important for the engineer to consider as part of the planning process? (Select two). A.Key escrow (answer) B.TPM presence (answer) C.Digital signatures D.Data tokenization E.Public key management F.Certificate authority linking Question #7: A company implemented an MDM policy to mitigate risks after repeated instances of employees losing company-provided mobile phones. In several cases, the lost phones were used maliciously to perform social engineering attacks against other employees. Which of the following MDM features should be configured to best address this issue? (Select two). A. Screen locks (answer) B. Remote wipe (answer) C. Full device encryption D. Push notifications E. Application management F. Geolocation Question #8: A user would like to install software and features that are not available with a smartphone's default software. Which of the following would allow the user to install unauthorized software and enable new features? A.SQLI B.Cross-site scripting C.Jailbreaking (answer) D.Side loading Question #9: Which of the following is a type of vulnerability that refers to the unauthorized installation of applications on a device through means other than the official application store? A.Cross-site scripting B.Buffer overflow C.Jailbreaking (answer) D.Side loading Chapter 11 Question #1: A security team is reviewing the findings in a report that was delivered after a third party performed a penetration test. One of the findings indicated that a web application form field is vulnerable to cross-site scripting. Which of the following application security techniques should the security analyst recommend the developer implement to prevent this vulnerability? A.Secure cookies B.Version control C.Input validation (answer) D.Code signing Question #2: A security analyst is investigating an application server and discovers that software on the server is behaving abnormally. The software normally runs batch jobs locally and does not generate traffic, but the process is now generating outbound traffic over random high ports. Which of the following vulnerabilities has likely been exploited in this software? A.Memory injection (answer) B.Race condition C.Side loading D.SQL injection Question #3: A healthcare organization wants to provide a web application that allows individuals to digitally report health emergencies. Which of the following is the most important consideration during development? A.Scalability B.Availability (answer) C.Cost D.Ease of deployment Question #4: A company's web filter is configured to scan the URL for strings and deny access when matches are found. Which of the following search strings should an analyst employ to prohibit access to unencrypted websites? A.encryption=off\ B.http:// (answer) C.www.*.com D.:443 Question #5: Which of the following enables the use of an input field to run commands that can view or manipulate data? A.Cross-site scripting B.Side loading C.Buffer overflow D.SQL injection (answer) Question #6: An organization recently updated its security policy to include the following statement: Regular expressions are included in source code to remove special characters such as $, |, ;. &, `, and ? from variables set by forms in a web application. Which of the following best explains the security technique the organization adopted by making this addition to the policy? A.Identify embedded keys B.Code debugging C.Input validation (answer) D.Static code analysis Question #7: Which of the following involves an attempt to take advantage of database misconfigurations? A. Buffer overflow B. SQL injection (answer) C. VM escape D. Memory injection Question #8: An organization's internet-facing website was compromised when an attacker exploited a buffer overflow. Which of the following should the organization deploy to best protect against similar attacks in the future? A.NGFW B.WAF (answer) C.TLS D.SD-WAN Question #9: Which of the following risks can be mitigated by HTTP headers? A. SQLi B. XSS (answer) C. DoS D. SSL