Which of these statements is not true of Certificate services on Android Enterprise devices? Select the correct answer, then submit.

The statement "Apps cannot choose to trust CAs" is incorrect. Android applications can, and often do, include their own trusted Certificate Authorities (CAs) within their app bundles. This allows developers to implement custom trust anchors for specific services or to ensure secure communication even if the device's system CAs are compromised or don't include a necessary CA. The other statements are true: Android 9.0+ prevents unencrypted connections by default, devices primarily trust system CAs, and as of Android 7.0, the CA store is standardized and updated via OTA.