Mobile App Development Architecture and Quality Flashcards

24 sample cards from the Architecture and Quality deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. Define 'jank' and how it relates to the frame budget.

   Jank is a visible stutter caused when a frame takes longer than the frame budget (e.g., $>16.67\ \text{ms}$ at 60 fps) to build and render, so the frame is dropped/late and animation appears to skip.

2. Give the formula relating frame rate to frame time.

   $$\text{FPS} = \frac{1}{\text{frame time (s)}} = \frac{1000\ \text{ms}}{\text{frame time (ms)}}$$ Frame rate is the reciprocal of the time to produce one frame.

3. What are the two GPU/CPU-side phases that must both fit in the frame budget for smooth rendering?

   The UI/CPU phase (building and laying out the frame, e.g., widget build + layout + paint recording) and the GPU/raster phase (rasterizing and compositing). Both must complete within the frame budget.

4. Distinguish cold, warm, and hot app startup.

   Cold start: process is not running and must be created from scratch (slowest). Warm start: process exists but the activity/UI must be recreated. Hot start: the app is fully in memory and only brought to foreground (fastest).

5. Name two common techniques to reduce cold-start time.

   Defer/lazy-initialize non-critical work off the startup path (lazy loading, background threads), and minimize main-thread work before first frame (e.g., avoid heavy synchronous I/O, use a lightweight splash and app-startup libraries).

6. List three major contributors to mobile battery drain from an app.

   Frequent network/radio wakeups (especially cellular), excessive CPU/GPU work (animations, polling), and wake locks / GPS and sensor usage that keep components powered. Background work and bright screen usage also contribute.

7. What batching strategy reduces radio-related battery drain?

   Batch and defer network requests so the radio wakes up less often (coalescing transfers, using scheduled/deferred jobs like WorkManager), amortizing the radio's high-power tail state across many requests.

8. Name three techniques for optimizing network usage in a mobile app.

   Caching responses to avoid repeat requests, compressing payloads (gzip) and using efficient formats (Protobuf/JSON minimization), and batching/paginating requests plus using HTTP conditional requests (ETag/If-Modified-Since).

9. List four common image optimization techniques for mobile apps.

   Downsampling/resizing to the display size, using efficient formats (WebP/AVIF), memory + disk caching, and lazy loading with placeholders. Serving appropriately sized images from the server also reduces bandwidth and memory.

10. Why is decoding an image to its display resolution important for memory?

    An uncompressed bitmap uses roughly $width \times height \times 4$ bytes (ARGB_8888). Decoding a large image at full resolution wastes memory and risks OOM, so downsampling to the target view size drastically cuts memory usage.

11. What is the recommended approach for storing small sensitive values like tokens on mobile?

    Use the platform secure storage backed by hardware: iOS Keychain and Android Keystore/EncryptedSharedPreferences. Never store secrets in plain SharedPreferences/UserDefaults, plaintext files, or hard-coded in code.

12. Contrast symmetric and asymmetric encryption for secure data storage.

    Symmetric encryption uses one shared secret key for both encrypt and decrypt (fast, e.g., AES); asymmetric uses a public/private key pair (slower, e.g., RSA/ECC). Local data-at-rest is typically encrypted with symmetric AES keys protected by the Keystore/Keychain.

13. What role does the hardware-backed keystore (Secure Enclave/TEE) play in secure storage?

    It generates and stores cryptographic keys in isolated secure hardware so key material never leaves the secure element. Apps request crypto operations without extracting the key, protecting secrets even if the OS/app process is compromised.

14. What is SSL/TLS certificate pinning and what attack does it defend against?

    Pinning hard-codes the expected server certificate or public-key hash in the app and rejects any other, even if signed by a trusted CA. It defends against man-in-the-middle attacks using fraudulent or CA-compromised certificates.

15. Differentiate certificate pinning from public-key pinning.

    Certificate pinning pins the whole certificate, so rotating/renewing the cert breaks the app until updated. Public-key pinning pins only the public key (SPKI hash), which survives certificate renewal as long as the key pair is reused, giving more flexibility.

16. What are code obfuscation and its main purpose?

    Transforming compiled code (renaming classes/methods to meaningless identifiers, removing debug info, control-flow scrambling) so it is hard to reverse-engineer, while preserving behavior. Purpose: raise the cost of understanding and tampering with the app.

17. What is tamper detection / anti-tampering and name one technique?

    Mechanisms that detect if an app binary or runtime has been modified (repackaged, hooked, or run on a rooted/jailbroken device). Techniques: signature/checksum verification of the app package, root/jailbreak detection, and runtime integrity/attestation checks.

18. According to OWASP, roughly what does the Mobile Top 10 represent?

    A prioritized list of the ten most critical mobile application security risks, published by OWASP to guide developers on the most common and impactful mobile vulnerabilities to mitigate.

19. Name the OWASP Mobile Top 10 (2024) risk that replaced 'M1: Improper Platform Usage' at the top of the list.

    M1: Improper Credential Usage (the 2024 list leads with improper credential usage and M2: Inadequate Supply Chain Security), reflecting a shift toward credential and supply-chain risks.

20. List four representative categories from the OWASP Mobile Top 10.

    Improper Credential Usage, Insecure Data Storage, Insecure Communication, and Insufficient Cryptography. Others include Inadequate Supply Chain Security, Insecure Authentication/Authorization, and Insufficient Binary Protections.

21. Which OWASP Mobile risk covers hard-coded secrets and misuse of API keys, and how is it mitigated?

    Improper Credential Usage / Insufficient Cryptography. Mitigation: never hard-code credentials in the binary, store secrets in secure hardware-backed storage, use short-lived tokens, and fetch/rotate keys via a secure backend.

22. What OWASP category does 'Insecure Communication' address and its core mitigation?

    It addresses transmitting data over unencrypted or weakly protected channels. Core mitigation: enforce TLS for all traffic, validate certificates, apply certificate/public-key pinning, and never accept invalid or self-signed certs in production.

23. How does 'Insufficient Binary Protections' in OWASP relate to obfuscation and anti-tampering?

    It flags apps that lack defenses against reverse engineering and code modification. Mitigations are exactly obfuscation, anti-debugging, integrity/checksum verification, and root/jailbreak detection to protect the binary.

24. Why is testable architecture (MVP/MVVM/Clean) a prerequisite for effective unit testing?

    By separating business logic from UI/framework code and depending on abstractions (injected dependencies), these architectures let logic be exercised in isolation with test doubles, avoiding slow, brittle device-dependent tests.

What this deck covers

Architecture and Quality flashcards FAQ