Which of the following are indicators of sensitive information leakage during reconnaissance? (Choose two)

Question

Options

• AHardcoded credentials in source code
• BDebug messages in HTTP responses
• CCorrect user credentials
• DSecure cookie settings

• A
  73% (19)
• C
  8% (2)
• D
  19% (5)

Explanation

Hardcoded credentials in source code (A) and debug messages in HTTP responses (B) both represent unintentional information disclosures that attackers exploit during reconnaissance - source code may expose API keys, passwords, or tokens, while verbose HTTP debug output can reveal internal stack traces, server versions, framework details, and internal paths. Option C is a distractor because valid user credentials are the goal of an attack, not a leakage indicator during recon. Option D is also wrong because secure cookie settings (HttpOnly, Secure flags) are a defensive control that prevents leakage, not a symptom of it.

Memory tip: Think "leak = unintentional exposure to attackers." If an item helps the attacker learn something they shouldn't know (source code secrets, debug verbosity), it's a leakage indicator. If it's a defensive measure or an attack outcome, it's not.

No community discussion yet for this question.