CSE 335 EXAM 3 QUESTIONS WITH
ANSWERS AND EXPLANATIONS
1. A code review focuses on this situation: A flashlight-style feature does not need access to
contacts. Which
design decision best addresses it?
A. Collect every available identifier in case it is useful later
B. Request every permission at first launch
C. Keep all telemetry forever by default
D. Collect only data necessary for the feature
Correct Answer: D. Collect only data necessary for the feature
Explanation: Data minimization reduces privacy risk and aligns collection with a defined purpose.
2. During implementation, this requirement arises: Battery drain is unexpectedly high during
location use. What
should the developer use?
A. Add arbitrary delays to make profiling easier
B. Disable optimization and assume the result is representative
C. Guess performance only from source-code length
D. Use Instruments / profiling tools
Correct Answer: D. Use Instruments / profiling tools
Explanation: Profiling tools measure CPU, memory, energy, and allocation behavior to locate real
bottlenecks.
3. During implementation, this requirement arises: Crash diagnostics currently include a user's
access token. What
should the developer use?
A. Write authentication headers to analytics events
B. Print full tokens to production logs
C. Do not log sensitive credentials or personal data
D. Include passwords in crash breadcrumbs
Correct Answer: C. Do not log sensitive credentials or personal data
Explanation: Logs can be exported or retained; sensitive values should be redacted or omitted.
4. A background fleet-tracking feature has a documented continuous-location requirement.
Which choice is most
appropriate?
A. Request always-on/background location only when the feature genuinely requires it
B. Request it even when the app never runs location work in the background
C. Use it to avoid implementing foreground updates
D. Always request it during first launch
Correct Answer: A. Request always-on/background location only when the feature genuinely
requires it
Explanation: Background location has greater privacy/battery impact and should be justified by
real background behavior.
5. An app is being revised because of this need: A photo picker feature does not require access to
contacts. Which
change is the best fit?
A. Keep permissions after the feature is removed
B. Use least privilege for permissions and capabilities
C. Request unrelated device permissions for future ideas
D. Enable every entitlement by default
Correct Answer: B. Use least privilege for permissions and capabilities
Explanation: Least privilege reduces attack surface and privacy exposure by granting only what
the application actually needs.
,6. A code review focuses on this situation: A regression test should confirm a user can add and
delete a list item
through the interface. Which design decision best addresses it?
A. A UI test
B. A static code comment
C. A compiler warning
D. A database migration
Correct Answer: A. A UI test
Explanation: UI tests exercise user-visible flows through the application interface.
7. During implementation, this requirement arises: A login request sends credentials to a
backend. What should the
developer use?
A. Use HTTPS and respect App Transport Security
B. Send credentials over plain HTTP
C. Disable transport security globally for convenience
D. Ignore certificate/transport failures
Correct Answer: A. Use HTTPS and respect App Transport Security
Explanation: Encrypted authenticated transport protects data in transit and ATS encourages
secure connections.
8. A store finder needs neighborhood-level accuracy rather than centimeter precision. Which
choice is most
appropriate?
A. Always request maximum accuracy regardless of need
B. Ignore energy cost when selecting location settings
C. Choose an accuracy level appropriate to the feature
D. Use GPS-quality accuracy for a country-level feature
Correct Answer: C. Choose an accuracy level appropriate to the feature
Explanation: Location accuracy settings should balance feature requirements against energy use
and privacy.
9. During implementation, this requirement arises: A crash-reporting dependency starts
transmitting diagnostic
metadata and the team must verify the disclosure impact. What should the developer use?
A. Copy a generic privacy statement from an unrelated app
B. Review privacy disclosures and third-party SDK data practices before release
C. Add analytics libraries without inventorying transmitted data
D. Assume third-party SDKs collect nothing unless users complain
Correct Answer: B. Review privacy disclosures and third-party SDK data practices before release
Explanation: Release privacy information should reflect the app and its dependencies, including
data categories, purposes, retention,
and third-party transmission.
10. Memory pressure occurs only after repeated navigation. Which choice is most appropriate?
A. Optimize random code before profiling
B. Disable tests to improve build speed
C. Replace all data types with smaller ones regardless of evidence
D. Measure and optimize the actual bottleneck
Correct Answer: D. Measure and optimize the actual bottleneck
Explanation: Performance work should be guided by measurement so effort targets the real
limiting resource.
, 11. An app is being revised because of this need: An offline health record cache contains
sensitive user
information that must remain protected on the device. Which change is the best fit?
A. Write private records to a public shared folder
B. Protect sensitive local data with platform-provided protected storage and appropriate data
protection
C. Disable platform file protection for easier debugging
D. Store confidential values in plaintext preference files
Correct Answer: B. Protect sensitive local data with platform-provided protected storage and
appropriate data protection
Explanation: Sensitive local data should remain inside protected app storage and use platform
security mechanisms appropriate to its
sensitivity and lifecycle.
12. A code review focuses on this situation: A travel app should notify the user when they enter a
saved destination
zone. Which design decision best addresses it?
A. Geofencing / region monitoring
B. A UI animation timer
C. Continuous maximum-rate GPS polling
D. A local array sort
Correct Answer: A. Geofencing / region monitoring
Explanation: Region monitoring is designed to notify the app about entering or leaving
geographic regions with lower
continuous-processing cost than constant GPS polling.
13. An app is being revised because of this need: A unit-converter app is considering collecting
precise location
with no feature use. Which change is the best fit?
A. Keep all telemetry forever by default
B. Collect every available identifier in case it is useful later
C. Request every permission at first launch
D. Collect only data necessary for the feature
Correct Answer: D. Collect only data necessary for the feature
Explanation: Data minimization reduces privacy risk and aligns collection with a defined purpose.
14. During implementation, this requirement arises: A delivery app needs an event when a driver
exits a depot area.
What should the developer use?
A. A UI animation timer
B. A local array sort
C. Continuous maximum-rate GPS polling
D. Geofencing / region monitoring
Correct Answer: D. Geofencing / region monitoring
Explanation: Region monitoring is designed to notify the app about entering or leaving
geographic regions with lower
continuous-processing cost than constant GPS polling.
15. A release test should automate a complete checkout flow using accessibility identifiers.
Which choice is most
appropriate?
A. A database migration
B. A static code comment
C. A compiler warning
D. A UI test
Correct Answer: D. A UI test
Explanation: UI tests exercise user-visible flows through the application interface.
ANSWERS AND EXPLANATIONS
1. A code review focuses on this situation: A flashlight-style feature does not need access to
contacts. Which
design decision best addresses it?
A. Collect every available identifier in case it is useful later
B. Request every permission at first launch
C. Keep all telemetry forever by default
D. Collect only data necessary for the feature
Correct Answer: D. Collect only data necessary for the feature
Explanation: Data minimization reduces privacy risk and aligns collection with a defined purpose.
2. During implementation, this requirement arises: Battery drain is unexpectedly high during
location use. What
should the developer use?
A. Add arbitrary delays to make profiling easier
B. Disable optimization and assume the result is representative
C. Guess performance only from source-code length
D. Use Instruments / profiling tools
Correct Answer: D. Use Instruments / profiling tools
Explanation: Profiling tools measure CPU, memory, energy, and allocation behavior to locate real
bottlenecks.
3. During implementation, this requirement arises: Crash diagnostics currently include a user's
access token. What
should the developer use?
A. Write authentication headers to analytics events
B. Print full tokens to production logs
C. Do not log sensitive credentials or personal data
D. Include passwords in crash breadcrumbs
Correct Answer: C. Do not log sensitive credentials or personal data
Explanation: Logs can be exported or retained; sensitive values should be redacted or omitted.
4. A background fleet-tracking feature has a documented continuous-location requirement.
Which choice is most
appropriate?
A. Request always-on/background location only when the feature genuinely requires it
B. Request it even when the app never runs location work in the background
C. Use it to avoid implementing foreground updates
D. Always request it during first launch
Correct Answer: A. Request always-on/background location only when the feature genuinely
requires it
Explanation: Background location has greater privacy/battery impact and should be justified by
real background behavior.
5. An app is being revised because of this need: A photo picker feature does not require access to
contacts. Which
change is the best fit?
A. Keep permissions after the feature is removed
B. Use least privilege for permissions and capabilities
C. Request unrelated device permissions for future ideas
D. Enable every entitlement by default
Correct Answer: B. Use least privilege for permissions and capabilities
Explanation: Least privilege reduces attack surface and privacy exposure by granting only what
the application actually needs.
,6. A code review focuses on this situation: A regression test should confirm a user can add and
delete a list item
through the interface. Which design decision best addresses it?
A. A UI test
B. A static code comment
C. A compiler warning
D. A database migration
Correct Answer: A. A UI test
Explanation: UI tests exercise user-visible flows through the application interface.
7. During implementation, this requirement arises: A login request sends credentials to a
backend. What should the
developer use?
A. Use HTTPS and respect App Transport Security
B. Send credentials over plain HTTP
C. Disable transport security globally for convenience
D. Ignore certificate/transport failures
Correct Answer: A. Use HTTPS and respect App Transport Security
Explanation: Encrypted authenticated transport protects data in transit and ATS encourages
secure connections.
8. A store finder needs neighborhood-level accuracy rather than centimeter precision. Which
choice is most
appropriate?
A. Always request maximum accuracy regardless of need
B. Ignore energy cost when selecting location settings
C. Choose an accuracy level appropriate to the feature
D. Use GPS-quality accuracy for a country-level feature
Correct Answer: C. Choose an accuracy level appropriate to the feature
Explanation: Location accuracy settings should balance feature requirements against energy use
and privacy.
9. During implementation, this requirement arises: A crash-reporting dependency starts
transmitting diagnostic
metadata and the team must verify the disclosure impact. What should the developer use?
A. Copy a generic privacy statement from an unrelated app
B. Review privacy disclosures and third-party SDK data practices before release
C. Add analytics libraries without inventorying transmitted data
D. Assume third-party SDKs collect nothing unless users complain
Correct Answer: B. Review privacy disclosures and third-party SDK data practices before release
Explanation: Release privacy information should reflect the app and its dependencies, including
data categories, purposes, retention,
and third-party transmission.
10. Memory pressure occurs only after repeated navigation. Which choice is most appropriate?
A. Optimize random code before profiling
B. Disable tests to improve build speed
C. Replace all data types with smaller ones regardless of evidence
D. Measure and optimize the actual bottleneck
Correct Answer: D. Measure and optimize the actual bottleneck
Explanation: Performance work should be guided by measurement so effort targets the real
limiting resource.
, 11. An app is being revised because of this need: An offline health record cache contains
sensitive user
information that must remain protected on the device. Which change is the best fit?
A. Write private records to a public shared folder
B. Protect sensitive local data with platform-provided protected storage and appropriate data
protection
C. Disable platform file protection for easier debugging
D. Store confidential values in plaintext preference files
Correct Answer: B. Protect sensitive local data with platform-provided protected storage and
appropriate data protection
Explanation: Sensitive local data should remain inside protected app storage and use platform
security mechanisms appropriate to its
sensitivity and lifecycle.
12. A code review focuses on this situation: A travel app should notify the user when they enter a
saved destination
zone. Which design decision best addresses it?
A. Geofencing / region monitoring
B. A UI animation timer
C. Continuous maximum-rate GPS polling
D. A local array sort
Correct Answer: A. Geofencing / region monitoring
Explanation: Region monitoring is designed to notify the app about entering or leaving
geographic regions with lower
continuous-processing cost than constant GPS polling.
13. An app is being revised because of this need: A unit-converter app is considering collecting
precise location
with no feature use. Which change is the best fit?
A. Keep all telemetry forever by default
B. Collect every available identifier in case it is useful later
C. Request every permission at first launch
D. Collect only data necessary for the feature
Correct Answer: D. Collect only data necessary for the feature
Explanation: Data minimization reduces privacy risk and aligns collection with a defined purpose.
14. During implementation, this requirement arises: A delivery app needs an event when a driver
exits a depot area.
What should the developer use?
A. A UI animation timer
B. A local array sort
C. Continuous maximum-rate GPS polling
D. Geofencing / region monitoring
Correct Answer: D. Geofencing / region monitoring
Explanation: Region monitoring is designed to notify the app about entering or leaving
geographic regions with lower
continuous-processing cost than constant GPS polling.
15. A release test should automate a complete checkout flow using accessibility identifiers.
Which choice is most
appropriate?
A. A database migration
B. A static code comment
C. A compiler warning
D. A UI test
Correct Answer: D. A UI test
Explanation: UI tests exercise user-visible flows through the application interface.
