Ethical Hacking Essentials Practice Test

Identify the type of mobile risk when a password is unintentionally included in application comments.

1. Data leakage

2. Extraneous functionality

3. Insecure storage

4. Insufficient authentication

The correct answer is: Extraneous functionality

The correct answer is data leakage. This type of mobile risk occurs when sensitive information, such as passwords, is unintentionally revealed in areas that are not secured, like application comments. Including a password in comments compromises the confidentiality of that data and can lead to unauthorized access if anyone can view the source code of the application. Extraneous functionality, while a significant concern, refers to features or capabilities that are included in the software but are not necessary for its core functionality. This can create vulnerabilities, but it does not directly address the issue of sensitive data being inadvertently exposed. Insecure storage deals with how data is stored on devices or servers and whether it is adequately protected from unauthorized access, and insufficient authentication pertains to failures in verifying user identities or providing appropriate access controls. Each of these options highlights different risks, but only data leakage directly addresses the specific situation of password exposure in application comments.