All Practice Exams

100+ Free PMPA Practice Questions

Prepare for the TCM Practical Mobile Pentest Associate (PMPA) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
100+ Questions
100% Free

Loading practice questions...

2026 Statistics

Key Facts: PMPA Exam

Practical

Exam Format

TCM Security

2 days

Assessment Period

TCM Security

Android

Exam Focus Platform

TCM Security

No Flags

Exam Style

TCM Security

Report Required

Deliverable

TCM Security

Associate

Certification Level

TCM Security

The PMPA from TCM Security is an Android-focused practical mobile application penetration testing certification. Candidates have 2 days to assess a mobile app environment and additional days to submit a professional report — no flags, no MCQs. The exam tests real-world skills: APK decompilation, AndroidManifest.xml analysis, MobSF scanning, Frida/Objection SSL pinning bypass, Burp Suite proxy interception, insecure storage enumeration, and exported component exploitation. Preparation is through TCM Security's Mobile Application Penetration Testing (MAPT) course. This practice test covers the theoretical knowledge — the real exam requires hands-on assessment.

Sample PMPA Practice Questions

Try these sample questions to test your PMPA exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1What is the file extension of an Android application package that you download and install on a device?
A..ipa
B..aab
C..apk
D..dex
Explanation: An APK (Android Package Kit) is the file format used to distribute and install Android applications. It is a ZIP archive containing the app's compiled code, resources, and manifest. IPA is the iOS equivalent, AAB is Android App Bundle (for Google Play distribution), and DEX is the compiled Dalvik bytecode inside an APK.
2Which file inside an APK declares the app's components, permissions, and minimum SDK version?
A.classes.dex
B.resources.arsc
C.AndroidManifest.xml
D.META-INF/MANIFEST.MF
Explanation: AndroidManifest.xml is the blueprint of every Android application. It declares all components (activities, services, broadcast receivers, content providers), the permissions the app requests, the minimum and target SDK versions, and intent filters. It is the first file a mobile pentester analyzes for attack surface.
3When decompiling an APK with apktool, which command correctly decodes the APK named 'target.apk' into a folder called 'output'?
A.apktool d target.apk -o output
B.apktool b target.apk -o output
C.apktool decode target.apk --output output
D.apktool extract target.apk output
Explanation: The apktool 'd' (decode) subcommand decompiles an APK: `apktool d target.apk -o output`. This extracts AndroidManifest.xml, smali bytecode, and resource files into the specified output directory. The 'b' (build) subcommand re-assembles a decoded APK — it is the reverse operation.
4Which tool decompiles Android APKs into readable Java source code and provides a GUI for browsing classes, methods, and strings?
A.apktool
B.dex2jar
C.jadx-gui
D.Ghidra
Explanation: jadx-gui (JADX Graphical User Interface) decompiles DEX bytecode directly into readable Java source code and provides a graphical browser for navigating classes, methods, fields, and strings. This makes it the preferred static analysis tool in the TCM mobile pentest course. apktool produces smali (assembly-like) code rather than Java.
5In AndroidManifest.xml, which attribute on a component makes it accessible to other apps and the system outside the declaring application?
A.android:exported="true"
B.android:permission
C.android:enabled="true"
D.android:allowBackup="true"
Explanation: Setting `android:exported="true"` on a component (Activity, Service, BroadcastReceiver, or ContentProvider) makes it accessible by other applications and the Android system via Intents. Exported components are a major attack surface: any app can interact with them without declared permissions unless `android:permission` is also set.
6A pentester runs `adb shell am start -n com.example.app/.AdminActivity` successfully without authentication. What vulnerability does this demonstrate?
A.SQL injection via content provider
B.Insecure direct object reference
C.Exported activity without access control
D.Tapjacking
Explanation: When an Activity is exported (android:exported="true") without a protecting permission, any app or ADB command can launch it directly with `am start`. This allows bypassing login screens and accessing administrative or privileged Activities without credentials — a classic exported Activity vulnerability found in the OWASP Mobile Top 10.
7MobSF (Mobile Security Framework) is used in mobile pentesting primarily for which purpose?
A.Automated static and dynamic analysis of mobile applications
B.Rooting Android devices over USB
C.Injecting Frida scripts into running processes
D.Generating malicious APKs for phishing
Explanation: MobSF (Mobile Security Framework) is an open-source, all-in-one automated framework for static and dynamic security analysis of Android, iOS, and Windows Mobile applications. It decompiles APKs, analyzes the manifest, scans for hardcoded secrets, checks for insecure API usage, and provides a detailed security report — making it a core tool in the TCM PMPA curriculum.
8When pulling an APK from a running Android emulator via ADB, which command saves the installed APK of the package 'com.example.app' to the local machine?
A.adb install com.example.app
B.adb dump com.example.app > app.apk
C.adb get-apk com.example.app
D.adb pull $(adb shell pm path com.example.app | cut -d: -f2)
Explanation: The two-step method is: first use `adb shell pm path com.example.app` to get the on-device APK path (e.g. `/data/app/com.example.app-.../base.apk`), then `adb pull <path>` to copy it to your local machine. The one-liner combines both steps using shell command substitution.
9Hardcoded strings in an Android app's resources can be found in which file?
A.res/layout/activity_main.xml
B.assets/config.yaml
C.res/values/strings.xml
D.lib/arm64-v8a/libnative.so
Explanation: The `res/values/strings.xml` file is the standard Android location for string resources, including API keys, URLs, and other string values. Developers sometimes hardcode sensitive values (Firebase URLs, API keys, backend endpoints) here instead of in server-side configuration, making it a key target during static analysis.
10During static analysis, you discover a Firebase URL in strings.xml: `https://myapp-default-rtdb.firebaseio.com`. What is the simplest method to check if the database is publicly readable?
A.Append /.json to the URL and send a GET request in a browser
B.Run sqlmap against the Firebase URL
C.Use Frida to hook the Firebase SDK at runtime
D.Decompile the Firebase SDK with jadx to find the auth token
Explanation: Firebase Realtime Database exposes a REST API. Appending `/.json` to the database URL (e.g., `https://myapp-default-rtdb.firebaseio.com/.json`) and making a GET request will return all data if the database rules allow public read access. A response with JSON data confirms misconfigured security rules — a critical finding documented in the TCM mobile pentest course.

About the PMPA Exam

The PMPA (Practical Mobile Pentest Associate) is TCM Security's associate-level Android-focused mobile application penetration testing certification. Unlike multiple-choice exams, the PMPA requires candidates to conduct a real-world mobile app security assessment over 2 days, then write a professional pentest report. This practice bank tests the theoretical knowledge underlying the practical exam: Android architecture, static analysis tools (apktool, jadx, MobSF), dynamic analysis techniques (Frida, Objection, Burp Suite), SSL pinning bypass, insecure data storage, and exported component vulnerabilities.

Assessment

Performance-based assessment

Time Limit

2 days assessment + additional days for report writing

Passing Score

Not publicly specified

Exam Fee

Exam voucher — see certifications.tcm-sec.com/pmpa/ for current pricing (TCM Security)

PMPA Exam Content Outline

15%

Mobile Pentest Methodology & Lab Setup

Penetration testing process, rules of engagement, Android emulator (AVD) configuration, ADB command fundamentals, Burp Suite proxy setup, APK acquisition, and Frida server deployment

10%

Android Architecture & APK Structure

APK file format and contents, AndroidManifest.xml components (Activity, Service, Receiver, Provider), Dalvik/ART runtime, smali bytecode, Android security model and sandbox, IPC and Intent system

25%

Static Analysis

APK decompilation with apktool and jadx-gui, manifest attack surface (exported components, dangerous permissions, allowBackup, debuggable), hardcoded secrets (API keys, Firebase URLs, AWS credentials), and MobSF automated scanning

30%

Dynamic Analysis & Traffic Interception

Burp Suite Android proxy configuration, SSL pinning bypass with Objection (android sslpinning disable) and Frida Codeshare scripts, runtime method hooking with Frida Java.use(), logcat analysis, Drozer component testing, and API traffic testing for IDOR and authentication flaws

10%

Insecure Data Storage & Sensitive Data Exposure

SharedPreferences file analysis, SQLite database extraction, external storage review, Firebase database misconfiguration (/.json endpoint testing), AWS S3 bucket enumeration, insecure logging via logcat

10%

Reporting & Remediation

Professional mobile pentest report structure and sections, CVSS-informed risk rating, vulnerability evidence documentation, remediation recommendations, and executive summary writing

How to Pass the PMPA Exam

What You Need to Know

  • Passing score: Not publicly specified
  • Assessment: Performance-based assessment
  • Time limit: 2 days assessment + additional days for report writing
  • Exam fee: Exam voucher — see certifications.tcm-sec.com/pmpa/ for current pricing

Keys to Passing

  • Work through all 100 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

PMPA Study Tips from Top Performers

1Build your Android pentest lab first: Android Studio AVD (no Play Store image for easy root), Burp Suite, Frida server, and Objection installed and tested before attempting exam prep
2Master the three-step Frida workflow: push server, chmod 755, run in background — then practice attaching with `objection -g <package> explore`
3Always start static analysis with AndroidManifest.xml: check exported components, allowBackup, debuggable, permissions, and network security config
4Practice jadx-gui navigation: search for strings like 'password', 'api_key', 'firebase', 'aws', 'secret' as your first step in any APK analysis
5Learn the Objection SSL pinning bypass command cold: `android sslpinning disable` — it should be automatic once you have a session
6Test Firebase misconfigurations by appending /.json to the database URL — a 200 response with data is a critical finding
7Run MobSF on every target APK: pay attention to BROWSABLE activities (deep link entry points), binary analysis results, and hardcoded secrets findings
8Practice writing pentest reports during preparation — the PMPA evaluation includes your report quality, not just technical findings
9Know ADB commands by heart: adb pull, adb push, adb shell run-as, adb shell am start, adb logcat, adb shell dumpsys package

Frequently Asked Questions

What is the PMPA exam format?

The PMPA (Practical Mobile Pentest Associate) is a fully practical exam with no multiple-choice questions and no flags to capture. Candidates are given 2 full days to perform an Android mobile application penetration test against provided targets. After the assessment period, candidates have additional days to write and submit a professional pentest report. The evaluation is based on the quality of findings identified and the professionalism of the report.

What topics does the PMPA cover?

The PMPA covers the complete mobile app pentest workflow focused on Android: (1) Lab setup — Android emulator, ADB, Burp proxy configuration; (2) Static analysis — APK decompilation with apktool/jadx, AndroidManifest.xml review, MobSF scanning, hardcoded secrets; (3) Dynamic analysis — Frida/Objection SSL pinning bypass, runtime instrumentation, logcat analysis; (4) Insecure storage — SharedPreferences, SQLite, Firebase, AWS S3; (5) Exported component testing — Activities, Services, Receivers, ContentProviders; and (6) Professional report writing.

What tools do I need to know for the PMPA?

Core tools for PMPA preparation: ADB (Android Debug Bridge) for device communication and file operations; apktool for APK decompilation to smali and manifest; jadx-gui for decompilation to readable Java source; MobSF (Mobile Security Framework) for automated static and dynamic analysis; Frida for dynamic instrumentation and Java method hooking; Objection for Frida-powered SSL pinning bypass, root detection bypass, and file enumeration; Burp Suite for HTTP/HTTPS traffic interception and API testing; and Drozer for exported component enumeration and testing.

How do I prepare for the PMPA?

Complete TCM Security's Mobile Application Penetration Testing (MAPT) course. Set up an Android Studio AVD (x86_64, no Google Play Store for easy root), practice with InjuredAndroid as a vulnerable target, configure Burp Suite proxy on the emulator, deploy Frida server and practice Objection SSL pinning bypass, analyze APKs with jadx for hardcoded secrets, and test Firebase/AWS misconfigurations. Review OWASP Mobile Top 10 and MASVS for vulnerability taxonomy and write mock pentest reports.

Is the PMPA suitable for beginners?

The PMPA is an associate-level certification designed for candidates with some penetration testing background. TCM Security states prior mobile app hacking experience is not required, but recommends familiarity with network penetration and computer systems. Candidates who have completed TCM's Practical Ethical Hacking (PEH) course or similar foundational material will be well-positioned to tackle the PMPA content.

Is this practice test like the real PMPA?

No — this is a multiple-choice knowledge-preparation bank. The real PMPA is a fully practical hands-on exam where you must actually conduct an Android mobile app penetration test. These questions test the conceptual and technical knowledge underlying practical skills: how tools work, why vulnerabilities exist, what commands achieve specific results, and what mitigations apply. Use this bank to solidify theoretical knowledge, then practice hands-on exploitation with InjuredAndroid, DIVA, and other vulnerable apps.