CyberCertPrepMobile Security FundamentalsApp ComponentsEASYFree question
A developer wants to expose a background music playback Service to a companion smartwatch app. Both apps share the same signing certificate. What is the most secure access control approach?
- A.A. Declare a custom permission with android:protectionLevel='signature' and require it on the Service's manifest declaration; only apps signed with the same certificate can hold the permission
- B.B. Export the Service and validate the caller's package name inside onBind() using getCallingUid()
- C.C. Use android:exported='false' and rely on the fact that the companion app shares the same UID
- D.D. Require the BIND_NOTIFICATION_LISTENER_SERVICE permission to restrict binding to system apps only
Why A is correct
The signature protection level grants a permission only to apps signed with the same certificate, providing cryptographic assurance of the caller's origin without needing runtime checks. Package-name validation (B) is spoofable. android:exported='false' (C) blocks all external apps including the companion app unless they share the same UID via sharedUserId (deprecated). BIND_NOTIFICATION_LISTENER_SERVICE (D) is unrelated to custom audio services.
Know someone studying for Mobile Security Fundamentals? Send them this one.