Mobile App Development Architecture and Quality Syllabus

What distinguishes UI tests from integration tests?

Integration tests verify that multiple modules/components work correctly together (e.g., repository + database). UI tests drive the actual user interface, simulating taps/gestures and asserting on-screen results, often end-to-end.

Where do UI (end-to-end) tests sit on the test pyramid and why are they used sparingly?

At the top (few tests). They are slow, brittle and expensive to maintain because they exercise the full stack and real UI, so only critical user journeys are covered while most logic is tested by unit tests at the base.

Describe the classic test pyramid proportions.

A broad base of many fast unit tests, a middle layer of fewer integration tests, and a small top of end-to-end/UI tests. Roughly guided as many unit, some integration, few E2E.

What is widget (component) testing in a UI framework like Flutter?

Testing a single widget/component in isolation by building it in a test environment, pumping frames, interacting with it, and asserting its rendered output and behavior without launching the full app or a real device.

How does widget/component testing differ from full integration testing in scope and speed?

Widget tests run a single component in a test harness (fast, no real device/backend), while integration tests run the assembled app on a device/emulator exercising real interactions across components (slower, more realistic).

State the three phases of the Test-Driven Development cycle.

Red (write a failing test for desired behavior), Green (write the minimal code to make it pass), Refactor (clean up the code while keeping tests green). Repeat this short cycle.

What is the core principle of TDD regarding when tests are written?

Tests are written before the production code. You only write production code to make a failing test pass, ensuring every line is driven by a requirement expressed as a test.

Name two benefits and one risk of practicing TDD.

Benefits: comprehensive regression safety net and better, more testable/decoupled design. Risk: can be slow or lead to over-testing/brittle tests if tests are coupled to implementation details rather than behavior.

What is profiling in the context of app performance?

Measuring an app's runtime resource usage (CPU, memory, GPU, network, frame timing) to identify bottlenecks and hotspots, using tools/profilers, so optimization effort targets the actual costly code paths.

What is a memory leak and a common cause on mobile?

A memory leak is memory that is allocated but never released because references are unintentionally retained. Common causes: static/global references to Activities/Contexts, unremoved listeners, or lingering closures/observers.

Differentiate the stack and the heap in memory management.

The stack stores local variables and call frames with fast, automatic LIFO allocation/deallocation; the heap stores dynamically allocated objects with longer lifetimes, managed by the allocator or garbage collector.

What is garbage collection and one performance concern it introduces?

Automatic reclamation of heap memory no longer referenced. Concern: GC pauses (stop-the-world) can cause jank/dropped frames, so minimizing allocations in hot paths reduces GC pressure.

What frame rate targets correspond to 60 fps and 120 fps, expressed as per-frame budgets?

For 60 fps the budget is $\frac{1000\ \text{ms}}{60} \approx 16.67\ \text{ms}$ per frame; for 120 fps it is $\frac{1000}{120} \approx 8.33\ \text{ms}$ per frame.

Define 'jank' and how it relates to the frame budget.

Jank is a visible stutter caused when a frame takes longer than the frame budget (e.g., $>16.67\ \text{ms}$ at 60 fps) to build and render, so the frame is dropped/late and animation appears to skip.

Give the formula relating frame rate to frame time.

$$\text{FPS} = \frac{1}{\text{frame time (s)}} = \frac{1000\ \text{ms}}{\text{frame time (ms)}}$$ Frame rate is the reciprocal of the time to produce one frame.

What are the two GPU/CPU-side phases that must both fit in the frame budget for smooth rendering?

The UI/CPU phase (building and laying out the frame, e.g., widget build + layout + paint recording) and the GPU/raster phase (rasterizing and compositing). Both must complete within the frame budget.

Distinguish cold, warm, and hot app startup.

Cold start: process is not running and must be created from scratch (slowest). Warm start: process exists but the activity/UI must be recreated. Hot start: the app is fully in memory and only brought to foreground (fastest).

Name two common techniques to reduce cold-start time.

Defer/lazy-initialize non-critical work off the startup path (lazy loading, background threads), and minimize main-thread work before first frame (e.g., avoid heavy synchronous I/O, use a lightweight splash and app-startup libraries).

List three major contributors to mobile battery drain from an app.

Frequent network/radio wakeups (especially cellular), excessive CPU/GPU work (animations, polling), and wake locks / GPS and sensor usage that keep components powered. Background work and bright screen usage also contribute.

What batching strategy reduces radio-related battery drain?

Batch and defer network requests so the radio wakes up less often (coalescing transfers, using scheduled/deferred jobs like WorkManager), amortizing the radio's high-power tail state across many requests.

Name three techniques for optimizing network usage in a mobile app.

Caching responses to avoid repeat requests, compressing payloads (gzip) and using efficient formats (Protobuf/JSON minimization), and batching/paginating requests plus using HTTP conditional requests (ETag/If-Modified-Since).

List four common image optimization techniques for mobile apps.

Downsampling/resizing to the display size, using efficient formats (WebP/AVIF), memory + disk caching, and lazy loading with placeholders. Serving appropriately sized images from the server also reduces bandwidth and memory.

Why is decoding an image to its display resolution important for memory?

An uncompressed bitmap uses roughly $width \times height \times 4$ bytes (ARGB_8888). Decoding a large image at full resolution wastes memory and risks OOM, so downsampling to the target view size drastically cuts memory usage.

What is the recommended approach for storing small sensitive values like tokens on mobile?

Use the platform secure storage backed by hardware: iOS Keychain and Android Keystore/EncryptedSharedPreferences. Never store secrets in plain SharedPreferences/UserDefaults, plaintext files, or hard-coded in code.

Contrast symmetric and asymmetric encryption for secure data storage.

Symmetric encryption uses one shared secret key for both encrypt and decrypt (fast, e.g., AES); asymmetric uses a public/private key pair (slower, e.g., RSA/ECC). Local data-at-rest is typically encrypted with symmetric AES keys protected by the Keystore/Keychain.

What role does the hardware-backed keystore (Secure Enclave/TEE) play in secure storage?

It generates and stores cryptographic keys in isolated secure hardware so key material never leaves the secure element. Apps request crypto operations without extracting the key, protecting secrets even if the OS/app process is compromised.

What is SSL/TLS certificate pinning and what attack does it defend against?

Pinning hard-codes the expected server certificate or public-key hash in the app and rejects any other, even if signed by a trusted CA. It defends against man-in-the-middle attacks using fraudulent or CA-compromised certificates.

Differentiate certificate pinning from public-key pinning.

Certificate pinning pins the whole certificate, so rotating/renewing the cert breaks the app until updated. Public-key pinning pins only the public key (SPKI hash), which survives certificate renewal as long as the key pair is reused, giving more flexibility.

What are code obfuscation and its main purpose?

Transforming compiled code (renaming classes/methods to meaningless identifiers, removing debug info, control-flow scrambling) so it is hard to reverse-engineer, while preserving behavior. Purpose: raise the cost of understanding and tampering with the app.

What is tamper detection / anti-tampering and name one technique?

Mechanisms that detect if an app binary or runtime has been modified (repackaged, hooked, or run on a rooted/jailbroken device). Techniques: signature/checksum verification of the app package, root/jailbreak detection, and runtime integrity/attestation checks.

According to OWASP, roughly what does the Mobile Top 10 represent?

A prioritized list of the ten most critical mobile application security risks, published by OWASP to guide developers on the most common and impactful mobile vulnerabilities to mitigate.

Name the OWASP Mobile Top 10 (2024) risk that replaced 'M1: Improper Platform Usage' at the top of the list.

M1: Improper Credential Usage (the 2024 list leads with improper credential usage and M2: Inadequate Supply Chain Security), reflecting a shift toward credential and supply-chain risks.

List four representative categories from the OWASP Mobile Top 10.

Improper Credential Usage, Insecure Data Storage, Insecure Communication, and Insufficient Cryptography. Others include Inadequate Supply Chain Security, Insecure Authentication/Authorization, and Insufficient Binary Protections.

Which OWASP Mobile risk covers hard-coded secrets and misuse of API keys, and how is it mitigated?

Improper Credential Usage / Insufficient Cryptography. Mitigation: never hard-code credentials in the binary, store secrets in secure hardware-backed storage, use short-lived tokens, and fetch/rotate keys via a secure backend.

What OWASP category does 'Insecure Communication' address and its core mitigation?

It addresses transmitting data over unencrypted or weakly protected channels. Core mitigation: enforce TLS for all traffic, validate certificates, apply certificate/public-key pinning, and never accept invalid or self-signed certs in production.

How does 'Insufficient Binary Protections' in OWASP relate to obfuscation and anti-tampering?

It flags apps that lack defenses against reverse engineering and code modification. Mitigations are exactly obfuscation, anti-debugging, integrity/checksum verification, and root/jailbreak detection to protect the binary.

Why is testable architecture (MVP/MVVM/Clean) a prerequisite for effective unit testing?

By separating business logic from UI/framework code and depending on abstractions (injected dependencies), these architectures let logic be exercised in isolation with test doubles, avoiding slow, brittle device-dependent tests.