▸case-04 I need to implement an OAuth 2.0 authorization code flow in a native mobile application. To protect against authorization code interception attacks, what specific extension or parameter must I include in the flow? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-11 We are hiring an external firm to pentest our mobile app. Please write the penetration testing planning document and scope of work, including the rules of engagement. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-06 I am implementing Face ID authentication for an iOS app to unlock a local database. If the user fails biometric authentication multiple times, what specific mechanism should be implemented as a secondary access method? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-03 We are building an Android app that communicates with our highly sensitive financial API. We already enforce HTTPS. What specific technique must we implement at the network layer to prevent Man-in-the-Middle attacks from compromised Certificate Authorities? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-13 We are implementing custom URL schemes (e.g., myapp://) to open specific screens in our iOS app from marketing emails. What is the most critical security validation step we must perform on the incoming URL before routing the user? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-18 On Android 7.0 and above, we want to restrict our app to only trust a specific set of custom Certificate Authorities and disable trust for user-added CAs. Which specific XML file must we define in the res/xml directory to enforce this? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-02 I am implementing a basic informational WebView in my iOS app that just displays a static 'Terms of Service' HTML string. Should I enable JavaScript, and what specific CSP directive should I use to prevent inline script execution? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-20 We are using a WebView in our Android app to display remote web content. To prevent the remote content from reading sensitive files on the device's local filesystem, which specific WebSettings configuration must be explicitly disabled? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-14 We are preparing our Android app for release and want to make reverse engineering more difficult. What standard build tool should we configure in our build.gradle to obfuscate the Java/Kotlin bytecode? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-15 In our React Native application, we are passing sensitive authentication tokens from the JavaScript realm to native iOS modules. What specific architectural component must be secured and validated during this data transfer? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-07 We are storing offline user messages in a local SQLite database on Android. The data is sensitive. What specific modification should we make to the standard SQLite implementation to secure this data at rest? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-12 Our Android app displays sensitive medical records. Users sometimes accidentally leave the app in the background. What specific OS-level flag or setting must we apply to the Activity to prevent the OS from capturing sensitive data in the recent apps switcher? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-01 I am building an Android app that loads a third-party payment portal in a WebView. Write the Kotlin code to instantiate and configure this WebView securely. Your response should include the exact code block and a short bulleted list explaining the configuration choices you made to prevent common web-based attacks. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-09 I need to create a comprehensive threat model using the STRIDE methodology for our new mobile banking architecture before we start development. Can you outline the threat modeling document for the system? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-17 Our mobile app communicates with a backend that supports both HTTP and HTTPS. To ensure the app never accidentally falls back to unencrypted HTTP due to a network interception, what specific security header or policy should the backend enforce and the app respect? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-16 Our weather app needs the user's location to provide local forecasts. To comply with data minimization and privacy best practices on modern mobile OSs, what specific type of location accuracy should we request by default instead of exact GPS coordinates? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-08 I am building a custom PIN entry keypad view in Swift for an iOS app. Aside from validating the numeric length of the PIN, what specific type of mobile-specific input validation should I implement to prevent tapjacking or overlay attacks? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-05 Our enterprise mobile app needs to verify if the user's device is rooted or compromised. We currently use the SafetyNet Attestation API to verify device integrity, but it is deprecated. What specific modern Android API must we migrate to for hardware-backed device integrity checks? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-10 Design a complete DevSecOps CI/CD pipeline for our mobile engineering team, including which SAST and DAST tools to integrate into GitHub Actions and how to enforce compliance gates. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-19 We need to store a highly sensitive API key in an iOS app. We want to ensure the key can only be accessed when the device is unlocked and the user explicitly authenticates with Face ID. Which specific iOS storage mechanism and access control flag should we use? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-21 In our native iOS app, we temporarily hold a decrypted cryptographic key in memory to perform an operation. Once the operation is complete, what specific action must we take regarding that memory allocation to prevent it from being extracted in a memory dump? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-22 Our messaging app receives push notifications containing sensitive chat messages via APNs and FCM. Since push notification channels are not entirely secure, what must we do to the message content before sending it through the push provider? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-23 We want our mobile app to actively monitor its own execution environment in production and detect if it is being run in an emulator or attached to a debugger. What specific category of security technology should we integrate? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |