Question

A security analyst is reviewing telemetry from an enterprise mobile device management (MDM) console after users reported unexpected battery drain on company-issued phones. The logs show that a recently sideloaded internal utility app requests and actively uses the following runtime permissions: READ_SMS, ACCESS_FINE_LOCATION, RECORD_AUDIO, and READ_CONTACTS. The app's stated purpose is to display the corporate cafeteria menu. Which conclusion is MOST supported by this application-layer indicator?

Accepted Answer

The permission requests are disproportionate to the app's stated function, indicating a likely malicious or trojanized application

Answer

The battery drain is caused solely by the ACCESS_FINE_LOCATION permission and is expected behavior for any location-aware app

Answer

The app is safe because it was distributed internally rather than through a public app store

Answer

The behavior indicates a certificate pinning failure that should be resolved by reissuing the app-signing certificate