Skip to content
AI Security

Interview question · Mobile Application Security

In an authorised mobile pentest, how do you assess certificate pinning and TLS validation, and how do you report what you find?

Two different questions hide here: does the app validate TLS at all, and does it pin? Testers who merge them either miss the critical bug or report a non-issue as one.

mediumNewPreparation tags: Google, Apple, MetaUpdated Nov 2026

Two different questions hide here: does the app validate TLS at all, and does it pin? Testers who merge them either miss the critical bug or report a non-issue as one.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

During an authorised mobile pentest, you find the app pins certificates for its API, and you must report on its TLS security.

  1. What is the first test?
  2. What is the second test?
  3. What is the third test?
  4. How should findings be rated?
  5. What else should the report cover?
  6. How would you structure the report?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackHow do apps detect rooted or jailbroken devices, why can it always be bypassed, and what should the detection actually be used for?Next in this trackWhat do Play Integrity and App Attest actually prove, and how do you build a backend that uses them correctly?Next in this trackA mobile app needs to call your API. How do you handle authentication and secrets when the app cannot keep a secret?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.