ISC2 CISSP Practice Question

The correct answer is To prevent man-in-the-middle attacks. Certificate pinning in mobile applications is primarily implemented to prevent man-in-the-middle attacks by ensuring the app only connects to servers presenting specific, pre-defined certificates. This prevents attackers from intercepting communications even if they manage to install a trusted certificate on the device or compromise a certificate authority. By "pinning" to specific certificates or public keys, the app can detect and reject unexpected certificates that might indicate an interception attempt.

To increase application performance is incorrect because certificate pinning typically has a negligible or slightly negative impact on performance due to the additional validation checks required. Performance optimization is not a reason to implement certificate pinning.

To comply with app store requirements is incorrect because while some app stores do recommend security best practices, certificate pinning is not typically a mandatory requirement for app store submission. It's a security best practice rather than a compliance requirement.

To enable offline functionality is incorrect because certificate pinning has no relationship to enabling offline functionality. In fact, certificate pinning is only relevant when making network connections, which by definition require online connectivity.