CY-702-C Mobile Security and Forensics - Jun 2025 Question Paper

Under each question, How to answer lists the points an answer should cover, outlined by CampusPrep from the syllabus. Check the details against your textbook.

1. 14 Marks
   Define mobile forensics and discuss the main challenges encountered in this field.
   How to answer

   • Define mobile forensics as branch of digital forensics dealing with mobile devices
   • List sources of evidence: calls, SMS, apps, location, storage
   • Discuss challenges: device diversity, OS updates, encryption, anti-forensics
   • Discuss challenges: data volatility, cloud storage, legal and privacy issues
2. 14 Marks
   Explain the document and presentation phases in mobile forensics. Why is proper documentation crucial in forensics?
   How to answer

   • Define documentation and presentation phases in forensic process model
   • Explain contents of documentation: chain of custody, tools, hashes, timestamps
   • Explain presentation: expert report and court testimony
   • Justify importance for integrity, admissibility and reproducibility
3. 14 Marks
   Describe the Android forensic setup process and pre-data extraction techniques.
   How to answer

   • Outline Android forensic workstation setup: Faraday bag, write blockers, drivers, SDK/ADB
   • Describe isolation, USB debugging, bootloader and root considerations
   • Explain pre-extraction steps: identification, preservation, SIM/SD handling
   • List logical vs physical vs file-system extraction preparation
4. 14 Marks
   What is the purpose of reverse engineering in Android app analysis? How is an APK file extracted from an Android device?
   How to answer

   • Define reverse engineering and its goals: malware analysis, vulnerability discovery
   • Explain APK structure: manifest, dex, resources
   • Describe APK extraction via ADB pull, backup, file manager
   • Mention tools: apktool, jadx, dex2jar
5. 14 Marks
   Explain the iOS security model and the role of application signing in maintaining app security.
   How to answer

   • Outline iOS layered security: hardware, Secure Enclave, code signing, sandboxing
   • Explain app signing with Apple certificates and provisioning
   • Role in ensuring integrity, authenticity and preventing sideloading
   • Mention Data Protection, keychain and update security
6. 14 Marks
   Discuss the permission model in Android security. How does it contribute to application security?
   How to answer

   • Describe Android permission model: install-time vs runtime permissions
   • Explain permission groups, protection levels and manifest declaration
   • How user grants limit access to sensitive resources
   • Contribution to least privilege and sandbox enforcement
7. 14 Marks
   How is Android traffic interception performed? What are the differences between passive and active traffic analysis?
   How to answer

   • Outline interception setup: proxy, VPN, Wi-Fi MITM, CA installation
   • Define passive analysis: sniffing without altering traffic
   • Define active analysis: injecting, modifying, replaying requests
   • Compare on interaction, detectability, use cases and risks
8. 14 Marks
   Describe the tools used for HTTPS proxy interception in Android traffic analysis.
   How to answer

   • Explain need for HTTPS proxy due to TLS encryption
   • Describe tools: Burp Suite, OWASP ZAP, mitmproxy, Charles Proxy
   • Steps: proxy config, CA cert install, SSL pinning bypass
   • Limitations and forensic considerations