CyberCertPrepMobile Security FundamentalsMobile Data StorageEASYFree question
Scenario
A security researcher audits a social Android app and captures network traffic during photo uploads. They observe that JPEG images contain GPS latitude/longitude EXIF tags with precise coordinates matching the user's home address. The server logs show these coordinates are stored in the backend database alongside the photo record.
A photo-sharing feature in a social Android app lets users upload photos taken with the device camera. A security researcher reports that when users share photos from their gallery to the app, GPS coordinates embedded in EXIF metadata can be read by the server. What is the recommended mitigation at the app layer?
- A.Request the ACCESS_FINE_LOCATION permission at runtime then strip the GPS EXIF tags with the platform location manager before upload
- B.Set the allowBackup attribute to false in the manifest to stop EXIF location tags from leaving the device through Google Auto Backup uploads to the owner's Drive account
- C.Convert the image to WebP format during upload to drop the EXIF block entirely
- D.