Which of the following identifies the security risk of storing a mTLS client certificate's private key in an Android app's assets/ folder packaged inside the APK, even if the file is named with a misleading extension like 'config.bin'?

• A.The assets/ folder sits behind the Android Keystore encryption layer, and the platform decrypts each asset at read time inside the app process; an extracted APK yields ciphertext, leaving the misleading extension a secondary defense
• B.There is no exposure here: the Android build system compiles assets into the native library section, and the PEM bytes end up inside the packaged native library rather than any readable file
• C.APK files are ZIP archives; anyone can extract assets/ by unzipping the APK, and file extension renaming provides no protection - the private key can be recovered and used to impersonate the app