A developer stores a symmetric encryption key in Android SharedPreferences using MODE_PRIVATE and encodes it as a Base64 string. They argue it is safe because MODE_PRIVATE prevents other apps from reading the file. What are the two scenarios that invalidate this argument?

• A.A) Scenario 1 - another app with the same package name can read it; Scenario 2 - the key can be guessed by brute force if it is less than 128 bits
• B.B) Scenario 1 - a rooted device (root process bypasses DAC); Scenario 2 - an ADB backup or physical extraction on Android versions before full backup removal can read the SharedPreferences XML file containing the Base64 key
• C.C) Scenario 1 - the file is world-readable on Android 6+; Scenario 2 - Google Play scanning reads SharedPreferences files during app review
• D.D) Scenario 1 - the Zygote process forks give system processes access to all SharedPreferences; Scenario 2 - the key expires after 30 days due to Android Keystore rotation policy