Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Android ATC
Exam Format
90 min
45
70%
Associate
Registration
$150 USD
Pearson VUE, Android ATC Authorized Training Centers (130+ worldwide), Online Proctored, or online proctoring
English, Spanish
Validity
No expiration (lifetime validity)
Not required - certificates have no expiry date
AND-402 Exam Topics and Domains
AND-402 is organized into 4 weighted domains. Expect to work with Package Manager, Permission Framework, Activity Manager, Application Framework, and more.
1
Permissions
25%
Android Platform and Security Architecture
Android Platform ArchitectureAndroid Security Architecture
- Understand Android's layered architecture
- Identify security mechanisms at each layer
- Recognize how architecture supports security model
Application Signing and Installation
Application SigningInstalling Applications
- Understand APK signing requirements
- Recognize certificate validation process
- Identify installation security mechanisms
Permission Levels and Protection
Why Permissions?Enforcing PermissionsLevels of Permissions Protection
- Distinguish between four permission protection levels
- Identify when each protection level applies
- Understand permission granting mechanisms
Application-Level Permissions
Requesting Application PermissionsSystem-Defined Permissions
- Request permissions correctly in manifest
- Identify common system permissions
- Understand permission groups
Component-Level Permissions
Activity PermissionsService PermissionsContent Provider PermissionsBroadcast Receiver Permissions
- Apply permissions to Activities, Services, Content Providers, Broadcast Receivers
- Understand component-specific permission mechanisms
- Implement fine-grained access control
Extending Android Permissions
Creating Custom PermissionsAccessing App PermissionsConfiguring Permissions Among Different Apps
- Create and define custom permissions
- Implement runtime permission handling
- Configure cross-app permission sharing
2
Managing the Policy File (AndroidManifest.xml)
20%
The Manifest File Structure
Manifest Tag AttributesApplication Tag Attributes
- Understand manifest file structure
- Identify security-critical manifest attributes
- Configure application-level settings
Modifying Application Policy
Applications Running with the Same Linux ID (sharedUserId)Setting Application Permissions
- Configure sharedUserId correctly
- Understand shared UID security implications
- Declare application permissions properly
External Storage and Permissions
External Storage PermissionsPermissions for External Applications
- Configure external storage permissions
- Understand scoped storage model
- Control component export and access
Debugging and Backup Configuration
Debugging ModeAndroid Backup Service
- Configure debugging flags appropriately
- Implement secure backup strategies
- Understand backup security risks
3
Users' Data Privacy and Protection
25%
Data Security Principles (CIA Triad)
ConfidentialityIntegrityAvailability
- Understand CIA triad principles
- Apply confidentiality, integrity, availability to Android apps
- Identify security principle violations
The Mobile Environment
Mobile Environment Components
- Understand mobile environment complexity
- Identify stakeholders in mobile security
- Recognize multi-party security responsibilities
Data States and Vulnerabilities
Data StatesVulnerabilities and Attacks Against Stored Data
- Identify three data states
- Recognize vulnerabilities for each state
- Implement state-appropriate security
Protection Principles and Best Practices
Protection PrinciplesTips for Android Coding VulnerabilitiesEnsuring Data Confidentiality - Hacking ApplicationsProtecting Application Data with Permissions
- Apply protection principles
- Avoid common coding vulnerabilities
- Implement defense-in-depth strategies
- Use permissions for data protection
4
Securing Storage
30%
Data Storage Decisions
Privacy ConsiderationsData Storage Period
- Make appropriate storage decisions
- Consider privacy in storage choices
- Implement data retention policies
SharedPreferences
SharedPreferences APISharedPreferences Security
- Use SharedPreferences correctly
- Apply MODE_PRIVATE for security
- Encrypt sensitive preferences
File Storage (Internal and External)
Internal File StorageExternal File StorageFile Operations on External Storage
- Distinguish internal vs external storage
- Use getExternalFilesDir() correctly
- Implement secure file storage
- Understand storage permissions
Cache Storage
Cache DirectoryCache Management
- Use cache storage appropriately
- Understand cache persistence limitations
- Implement cache management
SQLite Database Storage
SQLite Database BasicsDatabase SecurityContent Providers for Secure Data Sharing
- Implement SQLite databases securely
- Prevent SQL injection
- Use Content Providers for data sharing
- Apply database encryption
Storage Mechanism Selection
Decision Factors
- Select appropriate storage mechanisms
- Match storage to security requirements
- Optimize storage choices
How do I earn this certification?
Passing AND-402 earns the Android Security Essentials Certified certification. It sits in the Android Application Engineering track.
Current Level Exams
- AND-801 - Android Application Development Covers Android app development fundamentals
- AND-803 - Android Applications UI/UX Design and Monetization Techniques Covers Android UI/UX design and app monetization strategies
Next Level Options
AND-400 - Android Certified Trainer Become authorized to teach Android ATC courses
Alternative Paths
AFD-200 - Flutter Certified Application Developer Complementary cross-platform mobile development skills
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
Use the official PlanetCert Practice Test alongside the study plan below to prepare efficiently for AND-402.
What's changed on this exam?
Current Status
- ACTIVE
- Last content update: 2018-01-01
Updates
- Android Permissions Model Android 8.x (Oreo) in exam Core permission concepts remain the same, but runtime permissions have evolved
- Data Storage Android 8.x storage model Fundamental storage security principles unchanged; scoped storage adds restrictions
- Application Security Architecture Android 8.x architecture Core security architecture concepts are timeless
Who should take this exam?
This exam is typically taken by Android application developers and Mobile security professionals.
- Basic Android application development knowledge
- 6-12 months of Android development experience
- Completion of Android Application Development course (recommended)