Skip to content
AI Security

Interview question · Mobile Application Security

Should a mobile app pin certificates? If so, what do you pin, and how do you rotate keys without breaking the fleet?

Pinning narrows trust, and every outage story about it is a rotation story. The scored answer decides whether to pin at all, pins public keys with backups, and plans for the release that can never update.

hardEssentialNewPreparation tags: Apple, Google, JPMorgan ChaseUpdated Nov 2026

Pinning narrows trust, and every outage story about it is a rotation story. The scored answer decides whether to pin at all, pins public keys with backups, and plans for the release that can never update.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A banking app talks to api.bank.example, and the security team asks whether to pin certificates and what to pin.

  1. What does pinning defend against?
  2. What should you pin?
  3. How do you configure it?
  4. What happens if pins are wrong?
  5. What does pinning not protect?
  6. What would you recommend?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackIn an authorised mobile pentest, how do you assess certificate pinning and TLS validation, and how do you report what you find?Next in this trackHow do apps detect rooted or jailbroken devices, why can it always be bypassed, and what should the detection actually be used for?Next in this trackWhat do Play Integrity and App Attest actually prove, and how do you build a backend that uses them correctly?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.