Mobile App VAPT Interview Questions and Answers for Android and iOS

Key takeaways

• A mobile test has four parts: static analysis, dynamic analysis, network and API testing, and reporting.
• Know where each platform stores data: SharedPreferences, SQLite and files on Android; Keychain and plists on iOS.
• Be able to explain certificate pinning and why it is a hurdle, not a complete defence.
• The backend API is often where the serious bugs are, so mobile testing includes API testing.
• All testing needs written authorisation; practise on your own apps or training apps such as DIVA or OWASP's MASTG apps.

How to answer mobile VAPT questions

Interviewers want method, not tool names. A good answer says what you would check, why it is a risk, how you would confirm it safely and how the developer fixes it. Always mention scope and written permission. These are common topics, not a record of questions from a specific company.

Fundamentals

What does a mobile app security test cover?

The app package and code (static), the running app (dynamic), data stored on the device, communication with servers, interaction with the operating system and other apps, and the backend APIs. The reference standards are the OWASP Mobile Application Security Verification Standard (MASVS) and the Mobile Application Security Testing Guide (MASTG). Start from OWASP.

What is the OWASP Mobile Top 10?

A list of common mobile risks. The 2024 edition includes improper credential usage, inadequate supply chain security, insecure authentication and authorisation, insufficient input and output validation, insecure communication, inadequate privacy controls, insufficient binary protections, security misconfiguration, insecure data storage and insufficient cryptography. Check OWASP for the current version.

Static versus dynamic analysis?

Static analysis inspects the app without running it: decompiling, reading the manifest, looking for hard-coded secrets and weak configuration. Dynamic analysis runs the app and observes behaviour, traffic and storage, often with instrumentation.

Android questions

What is inside an APK?

An APK is a ZIP archive containing AndroidManifest.xml, compiled code (classes.dex), resources, native libraries and certificates. Tools such as apktool and jadx unpack and decompile it.

What do you check in the manifest?

Exported activities, services, receivers and content providers, requested permissions, android:debuggable, allowBackup, cleartext traffic settings and deep link handlers. An exported component without proper permission can be called by other apps.

Where does an Android app store data?

SharedPreferences, SQLite databases, internal files, external storage, caches and logs. Sensitive data in plain text in these places, or in logcat output, is a finding. The recommended fix is the Android Keystore with encrypted storage.

What is a risky WebView configuration?

JavaScript enabled with untrusted content, file access enabled, exposed JavaScript interfaces, or loading content over HTTP. Fix by limiting content to trusted origins and disabling unneeded features.

How would you test deep links and intents?

Review the manifest for handlers, then check whether parameters are validated and whether an unauthorised app or web page can trigger sensitive actions. Report missing validation and recommend verified app links.

iOS questions

Where does an iOS app store data?

The Keychain (the right place for secrets), property lists, NSUserDefaults, Core Data or SQLite, caches and files. Secrets in UserDefaults or plain files are findings. Data protection classes control when files are accessible.

What is App Transport Security (ATS)?

An iOS setting that enforces secure HTTPS connections. Exceptions in the app's Info.plist that disable it are worth noting in a report.

What is jailbreak or root detection and can it be bypassed?

Apps check for signs of a modified device. These checks raise the effort but can be bypassed on a device the attacker controls, so they are one layer. Do not treat them as the main protection for sensitive data.

Network and API

How do you inspect an app's traffic?

Route the test device through an intercepting proxy such as Burp Suite and install the proxy certificate on a device you own. Look for clear-text traffic, weak TLS, sensitive data in URLs and missing authorisation on requests. See PortSwigger for proxy guidance.

What is certificate pinning and how does it affect testing?

Pinning makes an app trust only a specific certificate or key, so a proxy certificate is rejected. For testers it means extra setup on a test build or device. For developers it limits interception by attackers but is not a full defence, because a user-controlled device can be modified. Defence in depth means server-side controls matter more.

Why test the API too?

Mobile apps are front ends. Broken object level authorisation, missing rate limits and weak session handling live on the server. Use the OWASP API Security Top 10 as a checklist.

Tools

Most are on GitHub with documentation. Use an emulator or a spare test phone, never a device with personal data.

Reporting and scenario questions

• "You find a hard-coded API key." Report where it is, what it can do, how to revoke and rotate it, and move secrets to the server side.
• "Sensitive data appears in logs." Show the line, assess who can read logs, and recommend removing logging in release builds.
• "The app works without authentication on one API call." Rate it by what data it exposes and recommend server-side authorisation checks.

For related reading, see our posts on IoT VAPT interview questions, mobile app pentesting tools and the mobile pentesting methodology.

Common mistakes in interviews

• Naming tools without the reason for the test.
• Forgetting the backend API.
• Claiming pinning or root detection "stops hackers".
• Describing testing on real apps without permission.

Next steps

Next steps: to practise mobile and application testing in a lab, see our VAPT course, and read the mobile pentesting methodology guide.