CyberCertPrepMobile Security FundamentalsApp Distribution (Play Store / App Store)EASYFree question
Scenario
A fintech startup sets minSdkVersion=29 (Android 10) in their banking app. They receive complaints that the app is unavailable on Android 8 devices. The development lead argues this was done intentionally for security reasons.
A Google Play app fails to be visible to users running Android 8 (API 26) devices. The developer investigates and finds their minSdkVersion is set to 29. What security implication did setting minSdkVersion=29 have, and was it a good decision for a banking app?
- A.D) minSdkVersion=29 is a Google Play requirement for banking apps; the developer had no choice.
- B.B) Setting a high minSdkVersion reduces the app's security because newer Android versions have more attack surface.
- C.C) The developer should lower minSdkVersion to 21 (Android 5) to maximize market reach; security can be maintained through runtime version checks.
- D.A) Setting minSdkVersion=29 means the app only installs on Android 10+ devices; this is a reasonable security decision for a banking app because Android 10+ has scoped storage, per-network MAC randomization, improved biometric APIs (BiometricPrompt with CryptoObject), and stronger background restrictions, all of which are security controls the banking app can rely on without legacy fallbacks.