AndroidHire

Android Security Interview Questions

Secure storage, auth, and hardening.

50 questions in this topic · 8 sample questions below

Practice Security in the quiz engine

Sample questions

  1. What does EncryptedSharedPreferences from Jetpack Security primarily provide over plain SharedPreferences?

    • Encryption of both keys and values at rest using a Keystore-backed master key — correct
    • Automatic syncing of preferences to the cloud
    • Faster read and write performance for large datasets
    • Protection against SQL injection in preference queries

    Why: EncryptedSharedPreferences encrypts keys and values on disk using AES with a master key held in the Android Keystore. It is not a performance or sync feature, and SharedPreferences is a key-value store, so SQL injection is irrelevant.

  2. Why is storing an API key in BuildConfig or a Gradle field considered insecure?

    • BuildConfig is encrypted but the key is shipped alongside it
    • BuildConfig values are stored in plaintext and can be recovered by decompiling the APK — correct
    • BuildConfig fields are only readable on rooted devices
    • BuildConfig values are stored in the Android Keystore and leak via attestation

    Why: BuildConfig constants are compiled into the DEX as plaintext string literals and trivially extracted by decompiling or running strings on the APK. They are not encrypted, and any attacker with the APK can read them without root.

  3. What is the correct characterization of ProGuard/R8 in an Android security context?

    • It encrypts your bytecode so it cannot be read
    • It signs the APK with a hardware-backed key
    • It obfuscates and shrinks code, raising the effort to reverse engineer but not preventing it — correct
    • It removes all string constants including embedded secrets automatically

    Why: R8 renames symbols and strips unused code, which raises reverse-engineering effort but leaves the logic and string literals recoverable. It is not encryption and does not remove embedded secrets, which remain in the DEX as plaintext.

  4. What does setUserAuthenticationRequired(true) on a KeyGenParameterSpec enforce for a Keystore key?

    • The key material is copied into app memory only after a fingerprint match
    • The key is exported to the app once the user unlocks the device
    • The key is automatically rotated after each authentication
    • The key can only be used after the user authenticates, with the crypto operation gated by hardware — correct

    Why: The flag binds key use to a recent user authentication, enforced by the secure hardware which authorizes the crypto operation rather than releasing the key. Keystore keys are non-exportable, so no option that copies or exports key material is correct.

  5. What distinguishes a StrongBox-backed Keystore key from a standard hardware-backed one?

    • StrongBox keys reside in a dedicated tamper-resistant secure element separate from the main SoC — correct
    • StrongBox keys are stored in the app private directory instead of TEE
    • StrongBox disables key attestation for privacy
    • StrongBox keys are software-emulated when no secure element exists

    Why: StrongBox keys live in a dedicated tamper-resistant hardware security module, giving stronger isolation than a TEE that shares the main processor. If StrongBox is unavailable the request fails rather than silently falling back to software.

  6. What does Android Keystore key attestation let a backend server verify?

    • That the user has a valid Play Store subscription
    • That the private key was generated in and is protected by the device secure hardware — correct
    • That the app has not been decompiled
    • That the device screen lock uses a strong password

    Why: Attestation produces a certificate chain, rooted in a Google CA, proving the key lives in hardware and describing its properties. It does not verify subscriptions, decompilation status, or the specific lock screen credential strength.

  7. When using BiometricPrompt with a CryptoObject, what does binding a cipher to the prompt achieve beyond a simple biometric check?

    • It uploads the biometric template to your server for verification
    • It stores the fingerprint image in EncryptedSharedPreferences
    • It cryptographically ties the successful authentication to a Keystore operation, preventing UI-only bypass — correct
    • It disables the device lock screen after success

    Why: A CryptoObject makes the unlocked Keystore cipher usable only after a genuine biometric match, so an attacker cannot spoof the callback result without the actual crypto authorization. Biometric templates never leave the secure hardware and are not uploaded or stored by the app.

  8. What is the main limitation of client-side root or tamper detection?

    • It cannot run on Android 13 or higher
    • It requires the INTERNET permission to function
    • It only works when the device has a secure lock screen set
    • It runs in the same environment an attacker controls, so a determined attacker can bypass or patch it — correct

    Why: Root detection executes inside the app process on a device the attacker fully controls, so its checks can be hooked, patched, or spoofed. It is a speed bump, not a boundary, and does not depend on the OS version or lock screen.

Practice all 50 Security questions

These 8 are a sample. The full Security bank is scored, tracks your progress, and explains every answer.

Open the quiz

More Android interview topics