CyberCertPrepMobile Security FundamentalsMobile Data StorageEASYFree question
Scenario
A mobile penetration tester extracts an Android app's APK, decompiles it with jadx, and finds the string 'AIzaSy...' hardcoded in a BuildConfig field. The key is a Google Maps API key.
What specific risk does a hardcoded API key in APK BuildConfig present, and what is the proper server-side mitigation for Google Maps Android API keys?
- A.The API key should be stored in the network_security_config.xml file which is parsed only at runtime and not visible in static decompilation analysis
- B.The API key should be moved to the Android Keystore so it is protected by hardware and cannot be extracted during decompilation
- C.The API key is trivially extractable from the decompiled APK; any person who downloads the app can extract and abuse the key for quota exhaustion or unauthorized usage. The correct mitigation is to restrict the API key in Google Cloud Console to only accept requests from the app's package name and signing certificate SHA-1, so the key is useless outside the signed app binary