ECCouncil 312-50v13 Certified Ethical Hacker Exam (CEHv13) Exam Practice Test

The correct answer is C. Overwriting Data/Metadata.

The key clue is that the file contents could not be reconstructed because the physical sectors no longer contained recognizable fragments of the original material. Simple deletion removes file references from directory structures, but the underlying data may still remain recoverable until overwritten. Here, the original sector contents were replaced, which indicates overwriting.

Option A. Data Hiding in File System Structures is incorrect because the data was not hidden in alternate file system locations or metadata structures.

Option B. Data/File Deletion is incorrect because ordinary deletion would usually leave recoverable data remnants.

Option D. Artifact Wiping is broader and often refers to removing traces such as logs, history, temporary files, or forensic artifacts. The scenario specifically describes replacement of file-sector contents.

Therefore, the best answer is C. Overwriting Data/Metadata.

The CEH Network Scanning module explains that ICMP Echo Requests are often filtered or blocked by firewalls, routers, or host-based security controls as a defensive measure to reduce reconnaissance exposure.

When systems fail to respond to ICMP Echo Requests but continue to function normally for other services, CEH indicates that this behavior typically means ICMP traffic is being blocked, not that the host is offline or compromised.

Option B is correct.

Option A would affect all services.

Option C lacks supporting indicators.

Option D is speculative and unreliable.

CEH emphasizes that ICMP filtering is common in hardened networks.

CEH v13 explains that WPA3 introduces SAE (Simultaneous Authentication of Equals), which resists traditional offline dictionary and brute-force attacks by removing crackable handshake material. Because WPA3 prevents attackers from capturing a reusable handshake, the most practical offensive method is to force a downgrade attack, tricking clients into associating using WPA2 instead of WPA3. Once the victim reconnects under WPA2-PSK, the attacker captures the standard 4-way handshake, which can then be cracked offline using dictionary or GPU-accelerated brute-force methods. CEH discusses downgrade attacks as a significant real-world threat when mixed-mode configurations are enabled or when access points fail to enforce strict WPA3-only operation. Options B and C are ineffective because WPA3 handshake materials cannot be brute-forced offline. Option D is unrelated to Wi-Fi encryption. Downgrading to WPA2 is the most effective and widely documented attack path.

The correct answer is A. Insecure Design.

The issue is not just a single input validation bug. The scenario describes recurring weaknesses across multiple applications, inconsistent controls between teams, and the need to standardize security requirements across future development efforts. That points to a design-level problem, not just a patching or configuration issue.

CEH-aligned secure development material emphasizes that threat modeling identifies and reviews threats, trust boundaries, data flows, vulnerabilities, and weaknesses in application security design . Web application mitigation guidance also identifies server-side validation, whitelisting or blacklisting of input characters, sanitization, output validation, encoding, prepared statements, parameterized queries, and bind variables as mitigations for input validation flaws .

Option B. Broken Access Control is incorrect because the scenario focuses on inconsistent input-handling and validation design, not unauthorized access to functions or objects.

Option C. Security Misconfiguration is incorrect because the root problem is not an incorrectly configured server or framework setting.

Option D. Cryptographic Failures / Sensitive Data Exposure is incorrect because the issue is not about weak encryption or exposure of protected data through cryptographic failure.

Therefore, the best answer is A. Insecure Design.

String concatenation is the best match because the technique described is breaking a recognizable SQL keyword or payload into separate pieces so a signature-based WAF rule does not see the full malicious token in one continuous pattern. In CEH-aligned web application testing, many WAF detections rely on matching known strings such as UNION SELECT, OR 1=1, and other classic patterns. If an attacker can cause the database parser to interpret the same meaning while the input appears different at the inspection layer, the WAF may fail to match its rule and the payload can reach the backend.

The prompt explicitly says you “split the query into multiple parts” to avoid detection as “a single signature.” That is the core idea of concatenation-based evasion: represent the same instruction through separated fragments that are recombined or tolerated by the SQL parser, depending on the database and application behavior. This differs from in-line comments, which would typically insert comment markers inside keywords to break signatures while preserving parsing, and differs from hex encoding, which replaces characters or strings with hexadecimal representations. A null byte technique is usually associated with string-termination tricks in older contexts and does not align with splitting SQL keywords for WAF bypass.

Defensively, CEH guidance emphasizes that relying on WAF signatures alone is insufficient. Strong prevention requires parameterized queries, strict server-side input validation, least-privilege database accounts, and monitoring for anomalous query patterns and error behaviors even when obvious signatures are not present.

CEH’s Malware Analysis module outlines a structured approach:

Identify suspicious indicators (e.g., JavaScript, OpenAction)

Extract and analyze embedded objects

Determine behavior and exploit logic

PDFStreamDumper allows analysts to extract JavaScript code and embedded objects for detailed inspection.

Option B is correct.

Option A is useful but insufficient for deep analysis.

Option C only aids identification, not behavior understanding.

The attack described is website defacement, which occurs when an attacker gains the ability to modify the content of a website—often the homepage—to display unauthorized messages, propaganda, or vandalism. The scenario explicitly says Mia “alter[s] visible content on the homepage, replacing it with unauthorized messages,” and emphasizes the reputational harm even without data theft. That reputational impact is a hallmark of defacement: it undermines customer trust, signals weak security, and can create regulatory/brand consequences even if no confidential information is exfiltrated.

The stated entry point—“exploiting an unpatched vulnerability in the web server”—is also consistent with defacement. Attackers frequently leverage web server or web application weaknesses (misconfigurations, known CVEs, weak credentials, vulnerable plugins, or insecure file permissions) to gain write access to web content or templates. Once write access is achieved, the attacker can replace HTML pages, alter templates, inject malicious scripts, or modify assets so that visitors see the attacker’s message.

Why the other options are less appropriate:

DNS hijacking (A) redirects users by changing DNS resolution so that the domain points to an attacker-controlled server. That can lead to a fake site, but it’s not the same as modifying the real server’s homepage content.

Frontjacking (B) typically involves UI deception—overlaying or framing content to trick users—rather than server-side modification of the homepage.

File upload exploits (C) are a method that can be used to gain code execution or place malicious files on a server, but the question asks for the type of web server attack being demonstrated. The visible outcome described—unauthorized homepage changes—is best categorized as defacement.

Therefore, Mia is most likely demonstrating D. Website Defacement.

In CEH-aligned cloud security discussions, protecting data across its lifecycle is a primary requirement, and a major risk area is how data moves between clients, applications, and cloud services. The scenario states the exposure occurred because there was no encryption during transmission between user devices and cloud storage. That maps directly to the Service and Data Integration risk area because it focuses on the security controls applied when cloud services exchange data with users and with other services, including secure communication channels, API protection, and proper cryptographic enforcement for data in transit.

When data is transmitted without TLS or with weak or misconfigured TLS, it becomes vulnerable to interception and manipulation through man in the middle attacks, traffic sniffing, SSL stripping, or downgrade attacks. In regulated environments such as healthcare, HIPAA expectations strongly align with implementing strong encryption in transit and ensuring secure session establishment, certificate validation, and modern cipher suites. This is not primarily a multi tenancy or physical security issue, which relates to isolation between tenants and the provider’s datacenter controls. It is also not primarily an incident analysis and forensic support issue, which concerns detection, logging, evidence collection, and investigative capability after events occur. Infrastructure security is broader and can include network protections, but the question is specifically about preventing exposure during transmission, which is most precisely addressed by service and data integration controls.

Correct remediation typically includes enforcing HTTPS with modern TLS, enabling HSTS, disabling legacy protocols and weak ciphers, ensuring correct certificate management, using mutual TLS where appropriate, and securing cloud storage access through authenticated, encrypted endpoints and properly secured APIs.

CEH training outlines the standard methodology for attacking WPA2-PSK networks: capture the 4-way handshake and then attempt offline cracking of the pre-shared key. The most reliable way to force handshake generation is to perform a de-authentication attack using tools like Aireplay-ng. This attack momentarily disconnects a wireless client, forcing it to reauthenticate with the access point. During this reauthentication, the AP and client exchange the 4-way handshake packets necessary for offline cracking. CEH emphasizes that WPA2 encryption itself cannot be brute-forced directly; attackers must obtain the handshake and then apply dictionary or brute-force attacks offline. Attempting XSS or router spoofing does not capture the handshake and is unrelated to WPA2 key extraction. The deauth attack is also a classic wireless attack vector described extensively in CEH because it is effective, does not require interaction with the encryption algorithm, and works regardless of the strength of the AP’s passphrase. Once the handshake is captured, tools such as Hashcat are used to attempt key recovery.

The correct answer is C because DEP, or Data Execution Prevention, is a memory-protection control that prevents code from executing from memory regions intended only for data storage, such as stack or heap/data memory. In CEH system exploitation and buffer overflow concepts, attackers may try to inject malicious shellcode into a buffer and then redirect program execution to that injected code. The CEH-aligned material explains that buffer overflow attacks can overwrite adjacent memory and allow different executable code to run; it also notes that ASLR and DEP are common defenses against these memory-management attacks. EC-Council material also states that buffer overflow exploitation depends on a machine being able to execute code in the data/stack segment, and lists disabling stack execution as a defense. Therefore, DEP does not block encryption, logging, or scanning. It specifically blocks execution from data memory areas.

Google Hacking, also known as Google Dorking, is a passive reconnaissance technique covered in CEH v13 Reconnaissance Techniques. It involves using advanced search operators to uncover sensitive information that has been inadvertently indexed by search engines.

CEH v13 explains that Google Hacking can reveal exposed files, directories, configuration files, backups, login portals, error messages, and sensitive documents. This information often resides on the Deep Web, meaning it is not easily accessible through normal browsing but is still indexed by search engines.

Option D correctly reflects this capability. Google Hacking does not analyze source code directly (Option A), map internal networks (Option C), or primarily detect phishing sites (Option B), although it may indirectly assist with those tasks.

Because Google Hacking relies solely on publicly available data and does not interact directly with target systems, it fits perfectly within passive footprinting, making it legally and ethically appropriate when authorized.

CEH v13 emphasizes Google Hacking as a powerful method to identify unintended data exposure. Therefore, Option D is the correct justification.

The correct answer is A. Service Version Discovery because the objective is to identify the software release/version running on internet-facing services by analyzing network responses and application output—without authenticating or establishing full sessions. In CEH-aligned reconnaissance methodology, service/version discovery (often called version detection or banner grabbing) focuses on determining what service is running (e.g., HTTP server, SSH daemon, SMTP server) and which version/build it is (e.g., Apache/Nginx version, OpenSSH version, application framework release). This information directly supports “prioritizing patch baselines” because patch urgency depends heavily on exact product versions: knowing the version helps map exposure to known vulnerabilities and identify outdated builds.

The prompt’s wording “analyze network-level responses and capture application output” is consistent with techniques such as banner grabbing, protocol negotiation, and response fingerprinting. Many services disclose identifying strings in headers, greetings, error pages, TLS certificates, or protocol handshakes. Even when banners are minimized, subtle differences in responses can still indicate versions or at least narrow the product family. This is typically done externally and does not require credentials, matching the constraint “without logging in or establishing full sessions.”

Why the other options are less accurate: Port scanning identifies which ports are open and which services may be present, but it does not necessarily determine precise software releases. OS discovery (OS fingerprinting) aims to infer the operating system and sometimes kernel family from packet characteristics; it is helpful but the task emphasizes “software release” and “application output,” which aligns more with service version detection than OS detection. Vulnerability scanning goes further by testing for known weaknesses and misconfigurations; while it may include version detection, the question asks for the technique that best fits the stated objective—determining the underlying service/software release from network/application responses—making service version discovery the most direct match.

Therefore, the technique is Service Version Discovery.

The correct answer is D. Corporate Espionage.

The scenario describes a competitor collecting information about ApexDynamics’ future products, pricing strategy, and roadmap, then using that information to release similar products. This aligns with corporate espionage, where business-sensitive information is gathered and used to gain competitive advantage.

CEH reconnaissance and footprinting material explains that competitive intelligence involves gathering information about competitors’ products, customers, and marketing, and that much of this information may be readily available through public sources . It also notes that organizations may unintentionally disclose current and future plans, directory information, and technical details through public-facing sources such as websites and business information repositories .

Option A. Social Engineering is incorrect because the scenario does not describe manipulating people into revealing information.

Option B. Information Leakage is related, but it is broader and refers to unintended exposure of sensitive information. The scenario’s key impact is a competitor using gathered information to mirror business strategy and product direction.

Option C. Business Loss is an outcome that may result from the activity, but it is not the specific footprinting-related threat described.

Option D. Corporate Espionage is correct because the competitor used collected business intelligence to copy or anticipate ApexDynamics’ market strategy.

Therefore, the best answer is D. Corporate Espionage.

The correct answer is C. Rogue DHCP Server Attack because the observed impact is that client machines on the LAN begin receiving incorrect network configuration parameters—specifically altered default gateways and DNS server addresses—shortly after Priya connects her laptop. In CEH-aligned LAN attack concepts, a rogue DHCP attack occurs when an attacker introduces an unauthorized DHCP service that responds to DHCP discovery requests faster than the legitimate DHCP server. As a result, endpoints accept the attacker-provided lease options, which can redirect traffic through attacker-controlled infrastructure.

The redirection to “fake login portals hosted on Priya’s machine” is consistent with malicious DHCP option abuse. By supplying a rogue DNS server (or altering DNS-related options), the attacker can resolve internal hostnames (like intranet URLs) to the attacker’s IP, enabling credential harvesting via spoofed portals. By supplying a rogue default gateway, the attacker can position themselves as the network path for victim traffic, enabling man-in-the-middle style interception, traffic manipulation, and session hijacking. The mention of “temporary IP conflicts” further supports rogue DHCP behavior, because an attacker DHCP server can hand out addresses that overlap with the legitimate scope or cause duplicate assignments, producing conflicts and instability.

Why the other options are less accurate: DHCP starvation involves exhausting the legitimate DHCP pool by flooding requests with spoofed MAC addresses, often as a precursor to then standing up a rogue DHCP server. The scenario emphasizes that clients are actively receiving malicious settings (gateway/DNS), which is the hallmark of the rogue server stage rather than starvation alone. DNS cache poisoning targets DNS resolvers/caches and does not by itself cause clients to suddenly obtain new gateway/DNS configurations. Packet sniffing is passive and does not explain clients being reconfigured or redirected.

Therefore, Priya most likely performed a rogue DHCP server attack to reconfigure endpoints and redirect users to phishing portals.

CEH defines passive reconnaissance as collecting information without directly engaging the target.

Option A is incorrect for passive reconnaissance because Nmap scanning actively probes systems, generating detectable traffic.

Options B, C, and D rely on publicly available information and are standard passive techniques.

CEH classifies Nmap scanning as active footprinting.

According to CEH v13 Cloud Computing, backup integrity and resilience are critical components of cloud security. The 3-2-1 backup model is a widely recommended best practice to mitigate unauthorized access, data corruption, and ransomware-related incidents.

The 3-2-1 rule dictates that organizations should maintain:

3 copies of critical data

Stored on 2 different media types

With 1 copy stored offsite or offline

This approach ensures that even if one backup is compromised, altered, or deleted—as described in the scenario—clean and trusted versions of the data remain available for restoration. CEH v13 emphasizes that offline or immutable backups significantly reduce the impact of malicious modification.

Option A focuses on physical security, which does not protect cloud backups. Option B addresses availability, not integrity. Option C is relevant to web application security, not backup protection.

CEH v13 explicitly highlights backup segregation and redundancy as key countermeasures against cloud data compromise. Therefore, Option D is the most direct and effective mitigation strategy.

When partial root access exists, preventing further privilege abuse is the immediate priority. CEH v13 explains that Mobile Application Management (MAM) enforces granular access control, application isolation, and permission enforcement—even on compromised devices.

Secure coding (Option A) and testing (Option C) are preventative measures but do not contain an active compromise. Certificate pinning (Option B) protects communications, not application control.

MAM solutions allow administrators to revoke access, enforce policies, and isolate apps, limiting attacker capabilities post-compromise. Therefore, Option D is correct.

In CEH v13 Information Security and Ethical Hacking Overview, a penetration tester is defined as a trusted, authorized security professional hired to simulate real-world attacks in order to identify and exploit vulnerabilities with explicit permission.

The primary objectives of a penetration tester are:

Identify weaknesses in systems, networks, and applications

Demonstrate real-world impact of vulnerabilities

Help organizations improve their security posture

Unlike malicious hackers (Option A) or malware authors (Options B and D), penetration testers operate under strict legal and ethical guidelines, following scopes of engagement and reporting findings responsibly.

CEH v13 emphasizes that penetration testing is proactive defense, not crime. Therefore, Option C accurately defines the role.

Packet fragmentation is a well-documented IDS evasion technique in CEH v13 Network and Perimeter Hacking. Attackers fragment packets to evade detection by overwhelming or confusing intrusion detection systems, especially those that rely on simple pattern matching.

CEH v13 explains that anomaly-based IDS systems are particularly effective against evasion techniques like packet fragmentation because they analyze deviations from normal network behavior, rather than relying on static signatures. Fragmented packets often create unusual traffic patterns, abnormal packet sizes, or irregular reassembly behavior, which anomaly-based systems are designed to detect.

Signature-based IDS solutions struggle against fragmentation because attackers can split malicious payloads across multiple packets in ways that bypass predefined signatures. Rejecting all fragmented packets (Option C) is impractical and could disrupt legitimate network communication, as fragmentation is a normal part of TCP/IP networking.

Recognizing regular intervals (Option A) is unreliable, as attackers can randomize packet timing. CEH v13 clearly recommends anomaly-based detection to counter advanced evasion techniques.

Thus, Option B is the most effective and CEH-aligned IDS configuration.

The central failure in the scenario is that a lost smartphone remained capable of accessing sensitive data, which means the organization lacked an effective lost device response control. In CEH-aligned mobile security guidance, one of the most important protections for lost or stolen devices is the ability to remotely secure the endpoint by locking it and wiping corporate data. This is typically implemented through Mobile Device Management tools and enterprise mobility controls. Registering devices with a remote locate and wipe facility ensures the security team can immediately take action once a device is reported missing, reducing the window in which an attacker can use stored sessions, cached credentials, saved tokens, or application access to reach protected resources such as patient records.

Option C is the best answer because it addresses both key needs implied by the incident: location capability to aid recovery and remote wipe to eliminate data exposure if recovery is uncertain. In healthcare environments, where protected health information is highly sensitive, CEH documentation emphasizes compensating controls that protect confidentiality when physical control of the device is lost. Remote wipe supports incident containment by preventing further access and limiting data disclosure.

Option B only provides tracking and does not guarantee data protection if the device cannot be recovered quickly. Option A helps protect data in transit on untrusted networks, but it does not solve the risk of a stolen device already authenticated to internal systems. Option D can help overall hygiene, but antivirus and DLP do not reliably stop misuse of a legitimately authenticated, lost device. Remote locate and wipe is the most direct mitigation for this exact gap.

The scenario describes the reuse of stolen Kerberos tickets to authenticate to other domain systems without cracking anything and without needing the user’s plaintext password. That behavior aligns directly with a Pass-the-Ticket (PtT) attack. In Kerberos-based environments (such as Active Directory domains), authentication relies on tickets (for example, Ticket Granting Tickets and service tickets). If an attacker can obtain valid ticket material from a compromised host—commonly from memory, credential caches, or ticket stores—they can present (“pass”) the ticket to access services as that user, as long as the ticket is still valid and accepted by the target service.

The key clues are: (1) Devon “intercepts Kerberos authentication material,” (2) “instead of cracking the data, he reuses the stolen tickets,” and (3) he authenticates “directly to other systems within the domain” to access resources. This is the essential advantage of PtT: it bypasses password guessing or hash cracking by leveraging the fact that possession of a valid ticket can be enough to authenticate to services (file shares, application servers, and other Kerberos-protected resources).

The question also rules out common alternatives:

Kerberoasting (C) involves requesting service tickets for SPNs and then offline cracking the encrypted portion to recover service account passwords. Devon is explicitly not cracking anything.

Pass-the-Hash (D) is an NTLM-based technique that reuses NTLM hashes to authenticate. The scenario explicitly states “No NTLM hashes.”

LLMNR/NBT-NS Poisoning (A) is a name-resolution poisoning technique used to capture/relay credentials on a local network. The scenario states no broadcast poisoning was involved and focuses instead on Kerberos ticket reuse.

Therefore, Devon most likely performed B. Pass-the-Ticket Attack.

CSRF occurs when a vulnerable application processes unauthorized state-changing requests because it does not verify whether the request was intentionally initiated by the authenticated user. CEH v13 explains that exploitation involves tricking a logged-in user into unknowingly executing a crafted HTTP request—usually via a malicious webpage, hidden form submission, embedded image tag, or JavaScript trigger. When the victim visits the attacker-controlled page, the browser automatically includes the user’s active session cookies, allowing the server to treat the forged request as legitimate. This technique is central to CSRF attacks and is highlighted in the CEH curriculum as the correct exploitation path. Directory traversal, SQL injection, and brute-force attacks target different vulnerabilities and do not exploit missing request authenticity validation. The key requirement for CSRF exploitation is user interaction via a malicious external resource, making option B the correct CEH-aligned method.

The behavior described matches Boolean-based blind SQL injection, which is represented here as Boolean Exploitation. In this technique, the tester injects conditions that evaluate to TRUE or FALSE and then infers the backend query behavior by observing differences in the application’s response—such as returning normal content versus returning an empty page—without relying on explicit database error messages or time delays.

The scenario’s key indicators are:

The injected payloads include conditional logic like AND 1=2, which is a classic always-false test.

When a true condition is used, the portal returns the expected claim details; when a false condition is used, it returns “no results.”

The tester repeats these true/false tests specifically “without error messages or delays,” which rules out error-based and time-based approaches and confirms the “blind” inference method.

Why the other options don’t fit:

UNION SQL Injection (A) relies on combining a malicious UNION SELECT with the original query to extract additional rows/columns directly into the response. The scenario is not extracting unioned data; it is observing response differences from boolean conditions.

Error-based SQL Injection (B) depends on triggering database errors and reading error output. The scenario explicitly notes no error messages are involved.

Time-based Blind SQL Injection (C) infers truth values by forcing delays (e.g., SLEEP()), which is explicitly not occurring here.

Therefore, the technique is best identified as D. Boolean Exploitation (Boolean-based blind SQL injection).

The Certified Ethical Hacker (CEH) Malware Threats module explains that attackers often abuse legitimate system services to blend malicious traffic with normal system behavior. Background Intelligent Transfer Service (BITS) is a Windows service designed to transfer files in the background using idle network bandwidth.

Attackers leverage BITS because its traffic closely resembles legitimate Windows Update traffic, which is commonly allowed through firewalls and proxy servers. CEH documentation states that BITS-based malware can download payloads, upload stolen data, and maintain persistence without triggering security alerts.

Option A is correct because BITS traffic appears legitimate and trusted, making it difficult for security devices to distinguish malicious usage.

Option B is incorrect because BITS does not operate exclusively through HTTP tunneling; it primarily uses HTTP/HTTPS in a legitimate manner.

Option C is incorrect because IP fragmentation is not a core feature of BITS.

Option D is incorrect because BITS does not rely on encrypted DNS traffic.

CEH emphasizes that living-off-the-land (LotL) techniques—using native tools like BITS—are increasingly favored by attackers due to their stealth and reliability.

The Certified Ethical Hacker (CEH) Cryptography module explains that one of the primary challenges in encryption is secure key distribution. Asymmetric encryption, also known as public-key cryptography, was specifically designed to address this issue.

In asymmetric encryption, each entity possesses a public key and a private key. The public key can be shared openly, allowing anyone to encrypt data securely, while only the corresponding private key can decrypt it. CEH documentation highlights that this model eliminates the need to transmit secret keys over insecure channels.

Option D is correct because asymmetric encryption enables secure key exchange without prior trust.

Option B (symmetric encryption) requires a shared secret key and suffers from key distribution challenges.

Option A refers to data-at-rest protection, not key exchange.

Option C provides integrity verification, not encryption.

CEH emphasizes that asymmetric encryption underpins secure protocols such as TLS and digital certificates.

The correct answer is A. Golden SAML Attack.

A Golden SAML Attack occurs when an attacker obtains the private signing material used by an identity provider and then forges valid SAML authentication assertions. Because the forged assertions are signed with trusted material, cloud service providers may treat them as legitimate authentication responses.

The scenario clearly states that the consultant extracted signing material used in trust relationships between the internal identity provider and cloud services, then generated authentication responses that granted cloud application access without passwords or MFA. This is the defining behavior of a Golden SAML attack.

CEH-aligned cloud security material identifies cloud account hijacking and insecure cloud authentication paths as major concerns, especially where cloud services depend on authentication, authorization, and API trust relationships . The Golden SAML technique specifically abuses federated authentication trust rather than stealing a normal user password.

Option B. Living off the Cloud (LotC) Attack is incorrect because LotC involves abusing legitimate cloud-native services and tools to perform attacker operations while blending into normal cloud activity. It does not specifically describe forging SAML authentication assertions.

Option C. Cloud Hopper Attack is incorrect because Cloud Hopper refers to attacks that target managed service providers or cloud service providers to reach downstream customers.

Option D. Man-in-the-Cloud (MITC) Attack is incorrect because MITC typically abuses synchronization tokens or cloud sync mechanisms, not identity-provider signing keys.

Therefore, the best answer is A. Golden SAML Attack.

The correct answer is D because Windows null sessions are tied to SMB/CIFS and NetBIOS-based access to the IPC$ administrative share. CEH enumeration content describes null sessions as unauthenticated connections to Windows NT/2000/XP systems using a null username and password, allowing attackers to enumerate users, groups, shares, machines, and SIDs. The same CEH material states that null sessions require access to TCP 139 and/or TCP 445 ports. TCP 139 is NetBIOS Session Service, traditionally used for SMB over NetBIOS, while TCP 445 is direct-hosted SMB over TCP. CEH enumeration tables also list TCP 139 as NetBIOS Session Service and TCP 445 as SMB over TCP/direct host communication. Port 443 is HTTPS and unrelated to null sessions. Port 137 supports NetBIOS Name Service but is not the main null-session connection port. Therefore, the best answer is 139 and 445.

The correct answer is D. aireplay-ng.

The scenario describes transmitting crafted wireless frames to interrupt active client connections so that the clients reconnect and generate fresh authentication handshakes. In the Aircrack-ng suite, aireplay-ng is the component used for packet injection and deauthentication-style attacks.

The referenced wireless testing material shows aireplay-ng being used to force client deauthentication during a handshake capture workflow, while airodump-ng is used to capture traffic, airmon-ng is used to enable monitor mode, and aircrack-ng is used later for cracking captured handshakes or keys .

Option A. airodump-ng is incorrect because it captures and monitors wireless traffic.

Option B. airmon-ng is incorrect because it places the wireless adapter into monitor mode.

Option C. aircrack-ng is incorrect because it performs the cracking phase after useful capture material has been collected.

Option D. aireplay-ng is correct because it injects frames, including deauthentication frames, to stimulate handshake capture.

Therefore, the best answer is D. aireplay-ng.

The correct answer is B. Predictive analysis because the client’s primary objective is to anticipate future attack patterns before they occur, and the described AI-enabled platform is explicitly being used to forecast potential attack vectors based on historical breaches and anomaly data. In CEH-aligned coverage of modern security capabilities, AI-driven approaches add value by learning from large datasets (logs, alerts, incidents, threat intelligence, and observed attacker behaviors) to identify trends, detect weak signals, and predict the most likely next steps an adversary may take. This directly supports proactive defense planning rather than purely reactive response.

In this scenario, the platform ingests “previous breaches and anomaly data” and produces forward-looking insights. That is the essence of predictive analysis: applying machine learning/analytics to estimate where attacks may emerge (for example, which assets are most at risk, which tactics are trending, what misconfigurations correlate with compromise, or which sequences of events often precede an intrusion). This helps defenders prioritize controls, patching, monitoring, and hardening to disrupt the projected attack paths ahead of time. It also aligns with the retail client’s desire to know whether their defenses can “anticipate” attacks, not merely document them after the fact.

Why the other options are less correct: Scalability is a benefit of AI (automating large-scale analysis), but it does not specifically address forecasting future attack vectors. Enhanced reporting improves how findings are communicated, but it is not the key capability described. Simulation and testing refers to running scenarios or automated testing in environments to measure resilience; that can be AI-assisted, but the prompt focuses on analyzing historical and anomaly data to predict likely attacks, which maps most directly to predictive analysis.

Therefore, the most critical benefit of AI-driven ethical hacking in this case is predictive analysis.

The correct answer is A. HTTP Response Splitting Attack because the scenario describes a flaw where one crafted request is interpreted in a way that causes the server (or an intermediary) to treat it as two separate HTTP messages, enabling the attacker to inject malicious data into the HTTP response stream. This is a classic input validation and header injection issue, typically involving the insertion of carriage return and line feed (CRLF) characters (\r\n) into user-controlled input that is later placed into HTTP headers (for example, in redirects, cookies, or custom headers). By injecting CRLF sequences, an attacker can “split” the server’s response: the first part completes a legitimate response header section, and the injected content begins a second, attacker-controlled response.

This aligns with the prompt’s emphasis that “a single crafted request is processed as two separate ones,” which is the fundamental mechanic of response splitting—turning one transaction into multiple interpreted HTTP entities. Once response splitting is possible, attackers may set or manipulate headers (such as Set-Cookie), inject arbitrary content, perform cross-user defacement, facilitate cache poisoning, or enable more effective delivery of client-side attacks by making browsers or proxies store and serve malicious content.

The question also frames it alongside XSS, CSRF, and SQL injection as “input validation flaws.” That matches response splitting’s root cause: insufficient sanitization/validation of untrusted input before including it in HTTP headers or responses.

Why the other options are incorrect: Password cracking is unrelated to HTTP parsing and input validation. Directory traversal abuses path handling to access files (e.g., ../) and does not involve splitting HTTP messages. Web cache poisoning can be a consequence of response splitting, but the described behavior—splitting a single request/response into two—most directly identifies HTTP response splitting as the demonstrated attack.

CEH v13 explains that the Deep Web contains content not indexed by search engines, including exposed databases, misconfigured portals, leaked credentials, and internal documents.

This makes it a critical area to assess unintended data exposure. The Deep Web is not primarily for attacker profiling or insider detection.

Thus, Option D is correct.

CEH v13 emphasizes that IoT devices must implement secure firmware update mechanisms that enforce authenticity, integrity, and version control. A critical lapse occurs when devices allow rollback to older firmware versions or accept updates without cryptographic validation. This opens the door to “firmware downgrade attacks,” where attackers intentionally install outdated but vulnerable firmware to reintroduce exploitable weaknesses. CEH identifies this as part of insecure update design, one of the most dangerous IoT vulnerabilities because firmware governs device behavior, network communication, and trust boundaries. Without signature verification, integrity checking, and anti-rollback enforcement, attackers can load malicious or deprecated firmware to escalate privileges or pivot deeper into a network. Options B and C represent different categories of IoT weaknesses, and D refers to supply-chain issues, none of which match the described rollback exploitation. Therefore, the vulnerability demonstrated is the absence of secure update mechanisms.

This scenario most closely matches spam and phishing delivered through social networking platforms, a technique emphasized in CEH social engineering coverage as social media phishing or spear phishing via professional networks. Nadia impersonates a trusted internal authority figure, a senior HR manager, and uses believable branding elements such as a stolen logo and accurate employee details to establish credibility. She then initiates contact through connection requests and funnels targets into a controlled space, a private group, where she requests sensitive information. Collecting a work email address and department role may appear harmless, but CEH guidance notes that attackers often start with small, plausible requests to build trust and assemble data for deeper compromise. Work emails and roles enable targeted spear phishing, business email compromise preparation, password reset targeting, and crafting convincing pretexts aligned to the victim’s function.

The core mechanics align with phishing: deception, impersonation, and a call to action designed to extract information. The “exclusive project updates” hook is a classic lure used to increase compliance. While the exercise could lead to involuntary data leakage as a downstream effect, the primary simulated threat is the phishing process itself, using social media as the delivery channel. Loss of productivity is not the intent here, and network vulnerability exploitation refers to technical system flaws rather than manipulating human trust. Therefore, the most accurate classification of Nadia’s drill is spam and phishing conducted through a social media pretext.

The correct answer is B. Transforming Query Structure to Evade Pattern-Based Inspection.

The scenario describes a pattern-based security control blocking conventional injection payloads. The tester then changes the request’s format and composition while preserving the intended database action. This is a classic SQL injection/WAF evasion concept: changing how the query looks so that the security control no longer matches the malicious pattern, while the backend database still interprets the request successfully.

CEH-aligned SQL injection material explains that signature-based detection compares input strings against known signatures and that attackers may evade these signatures through techniques such as inline comments, character encoding, string concatenation, obfuscated code, manipulating white spaces, hex encoding, and sophisticated matches .

Option A is incorrect because HTTP Parameter Fragmentation specifically splits payload components across parameters; the scenario does not describe fragmentation.

Option C is incorrect because no combined or integrated multi-method evasion is described.

Option D is incorrect because HTTP Parameter Pollution involves duplicate or conflicting parameters; the scenario does not describe overriding query parameters.

Therefore, the best answer is B. Transforming Query Structure to Evade Pattern-Based Inspection.

The correct answer is B. Worm because the defining behavior described is self-replication and autonomous propagation across multiple systems without requiring additional user interaction after the initial infection. In CEH-aligned malware classifications, a worm is a standalone malicious program that can spread automatically over networks by copying itself to other hosts. Worms commonly leverage shared resources (such as shared folders), weak configurations, and credential weaknesses (such as weak administrative passwords or credential reuse) to move laterally and infect additional machines at scale.

The scenario includes multiple classic worm characteristics: (1) only one workstation is initially targeted, (2) the malware then “automatically copies itself into shared folders,” and (3) it spreads using “weak admin credentials,” resulting in rapid infection of “dozens of computers.” That pattern fits worm propagation mechanisms such as exploiting administrative shares, remote execution through obtained credentials, and leveraging network-accessible paths to drop copies of itself. The key discriminator is automation: after initial placement, the malware does the rest, scanning for reachable systems or shares and replicating to them without needing a user to click attachments or run the payload again.

Why the other options are not correct: a logic bomb is typically dormant code that triggers a malicious action when a specific condition or time is met; it is not defined by self-propagation. A backdoor provides unauthorized access for later control, but it does not inherently replicate across the network on its own. Fileless malware emphasizes execution primarily in memory using legitimate tools (e.g., PowerShell/WMI) and minimal disk artifacts; while fileless techniques can be used for lateral movement, the scenario’s emphasis is on the malware copying itself into shared folders and spreading widely, which is the hallmark of a worm.

Therefore, Sophia is most likely demonstrating a worm.

This phase is Information Gathering, the first and most foundational step in an IoT penetration test methodology described in CEH-aligned material. The goal here is to build an accurate inventory of the IoT environment and understand how devices communicate, what hardware and software versions are present, and which protocols and interfaces are in use. Jordan is collecting device models, manufacturer names, firmware versions, and supported protocols such as Zigbee and BLE. That activity maps directly to enumeration and profiling of the target IoT ecosystem, which is performed before any intrusive testing. In CEH methodology terms, this step helps identify the attack surface, including wireless interfaces, management ports, cloud backends, mobile apps, and gateways that bridge IoT networks to enterprise networks.

Information gathering is crucial because IoT risk is highly dependent on specific device types and firmware builds. Knowing a firmware version can reveal whether known CVEs apply, whether default credentials are likely, or whether insecure services are commonly enabled. Identifying Zigbee and BLE indicates potential avenues for wireless assessment, such as insecure pairing, weak encryption or key handling, misconfigured access control, and protocol-specific weaknesses.

The other options occur later. Vulnerability scanning is the step where the tester actively checks the identified devices and services for weaknesses using scanners, enumeration probes, or targeted validation. Launch attacks and gain remote access are exploitation steps that follow planning and discovery. Since Jordan is only documenting and understanding the ecosystem, the correct step is Information gathering.

The correct answer is D, Network traversal. In CEH system hacking and post-exploitation concepts, lateral movement refers to an attacker moving across a compromised environment from one host, account, or resource to another. After gaining initial access, the attacker may enumerate systems, harvest credentials, abuse trust relationships, access shared resources, or use remote administration protocols to reach additional machines. The uploaded hacking methodology material describes the “takeover” phase as expanding control from a single host to other hosts in the network, which directly aligns with lateral movement. Pivoting is closely related, but it is more accurately a technique used to route traffic through a compromised system to reach otherwise inaccessible networks. Privilege escalation means increasing permissions on a system, and data exfiltration means stealing or transferring data out of the environment. Since the question asks what lateral movement is, the most precise answer is network traversal.

The Certified Ethical Hacker (CEH) Malware Threats module explains that modern malware increasingly uses fileless techniques and living-off-the-land strategies, communicating over legitimate protocols like HTTP and DNS to evade detection.

Because this traffic blends with normal activity, port-based blocking and signature-based antivirus are often ineffective. CEH highlights behavioral analytics and network traffic analysis as the most reliable detection mechanisms for identifying anomalies such as:

Unusual outbound DNS queries

Abnormal HTTP beaconing patterns

Suspicious process behavior

Option C is correct because it focuses on detecting behavioral anomalies, which CEH identifies as essential for combating advanced malware and command-and-control (C2) channels.

Option D may disrupt business operations and does not address DNS-based C2.

Option A is outdated.

Option B cannot detect unknown or fileless malware.

CEH strongly recommends anomaly detection and behavioral monitoring for advanced threats.

The correct answer is B. Dynamic Testing.

The analyst is interacting with the running application, sending structured test inputs, and observing live response differences. That is dynamic testing. The payloads are not random; they are deliberate SQL injection probes designed to determine whether user-controlled input influences backend SQL logic.

CEH-aligned SQL injection material explains that testers can identify SQL injection by submitting inputs such as a single quote and observing whether errors or behavioral differences appear. It also references testing inputs such as ' OR 1=1-- to determine whether the application is vulnerable . CEH material further explains that SQL injection vulnerability detection includes injecting code into input fields and observing responses, error messages, GET/POST values, cookies, and string values .

Option A. Static Testing is incorrect because static testing reviews source code or configuration without executing the application.

Option C. Function Testing is incorrect because the purpose is not ordinary feature validation; it is security testing of query behavior.

Option D. Fuzz Testing is incorrect because fuzzing usually involves sending large volumes of random or unexpected input. The scenario uses targeted SQL logic tests.

Therefore, the best answer is B. Dynamic Testing.

The correct answer is B. Cryptographically binding authentication tokens to the TLS connection context.

The scenario describes a defense against session token replay. The attacker/tester has a valid authentication identifier, but the application rejects it when it is reused from a different machine and a different encrypted channel. This indicates that the token is not accepted by itself; it is tied to the original TLS-secured session context.

CEH-aligned session hijacking material explains that session replay occurs when an attacker captures an authentication token and replays the request to obtain unauthorized access. It also describes session hijacking as taking over an authenticated session after authentication has already completed . TLS material explains that TLS provides secure communication, peer authentication, shared-secret generation, and secure session establishment between endpoints . Binding the token to the TLS context prevents a captured token from being reused over a different TLS connection.

Option A. Encrypting DNS resolution traffic using DNS over HTTPS is incorrect because DNS over HTTPS protects DNS lookups, not application session tokens.

Option C. Applying IPsec protection at the network layer is incorrect because IPsec protects traffic at the network layer. The question specifically describes an application-issued authentication identifier being validated against the original secure exchange.

Option D. Enforcing HTTP Strict Transport Security is incorrect because HSTS forces browsers to use HTTPS, but it does not cryptographically bind a token to a specific TLS channel.

Therefore, the best answer is B. Cryptographically binding authentication tokens to the TLS connection context.

TCP NULL scanning is a stealth scanning technique covered in CEH v13 Reconnaissance and Network Scanning. In a NULL scan, all TCP flags are set to zero. According to RFC 793 and CEH documentation, closed ports must respond with a TCP RST (Reset) packet.

If the port is open, the target typically does not respond, making this technique useful for firewall evasion. Therefore:

RST response = Closed port

No response = Open or filtered port

Other options do not apply to NULL scans:

SYN/ACK is associated with SYN scans.

ICMP errors may indicate filtering, not port state.

Outdated server software often contains memory corruption flaws. CEH notes that buffer overflow exploits are a primary method for compromising vulnerable server binaries, allowing remote code execution. This approach targets the underlying service rather than application-layer input validation issues.

The correct answer is A. Measured service because the scenario describes a core cloud characteristic where resource usage is metered, monitored, controlled, and reported, enabling pay-as-you-go billing and supporting accountability and auditability. In CEH cloud computing coverage (aligned with standard cloud definitions), measured service refers to the cloud provider’s ability to automatically track and quantify consumption of resources such as CPU/compute time, storage capacity, memory, and network bandwidth. This metering is fundamental to cloud economics: customers pay based on actual usage rather than fixed, up-front infrastructure costs.

In the Black Friday context, demand is bursty and unpredictable. Measured service allows the organization to scale resources up during peak shopping hours and scale down afterward, while billing remains tied to what was truly consumed. This is especially important for cost control in e-commerce environments where overprovisioning for peak loads on-premises would be expensive and inefficient. Additionally, because the provider records usage in detail, the organization can perform chargeback/showback internally, validate invoices, and maintain evidence for audits and compliance reviews—all of which depend on accurate, granular measurement.

Why the other options are not the best fit: Broad network access describes availability over networks and access via standard mechanisms (not usage tracking). On-demand self-service refers to users provisioning resources automatically without human interaction from the provider (not billing metering). Resource pooling refers to multi-tenant pooling of provider resources dynamically assigned and reassigned according to demand (again, not the billing/audit measurement function).

Therefore, the feature of detailed tracking of compute hours, storage usage, and bandwidth consumption that supports pay-per-use and auditing is best explained by measured service.

The correct answer is D. Signature Recognition.

The monitoring system is detecting traffic because it matches known attack patterns stored in a threat database. When the payload sequence is slightly changed, the alert no longer triggers. This is the classic behavior of signature-based detection.

CEH-aligned IDS material explains that signature recognition means that, for every known hacker technique, engineers code a detection pattern into the system. It describes this as simple pattern matching, such as examining packets for a known malicious pattern .

Option A. Protocol Anomaly Detection is incorrect because protocol anomaly detection identifies deviations from expected protocol behavior, not just known exploit strings.

Option B. Anomaly Detection is incorrect because anomaly detection compares behavior against a baseline of normal activity. The scenario describes matching known attack payloads.

Option C. Stateful Protocol Analysis is incorrect because stateful protocol analysis evaluates protocol state and expected protocol behavior across sessions.

Option D. Signature Recognition is correct because detection depends on matching known patterns, and small changes to the exploit sequence can evade detection.

Therefore, the best answer is D. Signature Recognition.

The correct answer is C. DNS Rebinding Attack.

The key behavior is that an external website causes the victim’s browser to send requests to an internal, locally hosted IoT management interface. This is characteristic of DNS rebinding, where the attacker abuses browser trust and DNS resolution behavior so that a malicious web page can interact with private-network resources.

CEH-aligned IoT material identifies Insecure Web Interface and Insufficient Authentication/Authorization as important IoT weaknesses, especially because many device interfaces are intended to be exposed only on internal networks but can still be threatened from internal users or browser-based interaction paths . DNS rebinding specifically abuses this condition by using the victim’s browser as a bridge into the private network.

Option A. Forged Malicious Device Attack is incorrect because no rogue IoT device is being introduced.

Option B. SDR-Based Attack is incorrect because software-defined radio attacks target wireless/radio communications, not browser-based access to local web interfaces.

Option D. Distributed Denial-of-Service (DDoS) Attack is incorrect because the scenario is not about flooding or service exhaustion.

Therefore, the best answer is C. DNS Rebinding Attack.

This question focuses on API Security, Webhooks abuse, and Webshell mitigation, all of which are addressed in the CEH v13 Web Application Hacking and Security Operations modules. The most appropriate corrective action is Option D, as it directly addresses the root causes and persistence mechanisms of the compromise.

According to CEH v13, attackers frequently exploit improper input validation in APIs and insecure webhook implementations to inject malicious payloads or gain remote command execution. Webhooks, when not properly validated, can accept malicious requests that trigger backend processes, making them a common vector for API abuse.

Input validation on all API endpoints is critical to prevent injection attacks, including command injection and SQL injection. CEH v13 explicitly emphasizes validating request parameters, headers, and payload structures to prevent malicious manipulation.

Reviewing webhook payloads ensures that only trusted sources can trigger automated actions, preventing attackers from abusing webhook functionality. This includes validating signatures, enforcing authentication, and restricting allowed payload formats.

Finally, regular scanning for webshells is essential because webshells provide persistent backdoor access. CEH v13 identifies webshell detection as a key defensive measure during incident response and post-exploitation containment.

Other options are incomplete:

A WAF alone cannot detect all webshells.

IP blocking is ineffective against spoofed or cloud-based attacks.

MFA and server hardening are valuable but do not directly address webhook abuse or existing webshells.

Therefore, Option D provides the most comprehensive, CEH v13–aligned mitigation strategy.

The correct answer is B. Global Catalog Service (TCP/UDP 3268).

The key indicators are directory-related information across multiple domains, organization-wide object searches, and the dedicated port 3268. The CEH enumeration reference lists LDAP on TCP/UDP 389 and Global Catalog Service on TCP/UDP 3268 as separate services used during enumeration .

The Global Catalog is used in Active Directory environments to search directory objects across the forest, not merely within a single domain. This fits the scenario better than standard LDAP on port 389.

Option A is incorrect because Microsoft RPC Endpoint Mapper on port 135 maps RPC services, not forest-wide directory objects.

Option C is incorrect because LDAP on port 389 is directory access, but the scenario specifically describes cross-domain/global directory searches.

Option D is incorrect because SIP is used for voice/video signaling, not Active Directory enumeration.

Therefore, the best answer is B. Global Catalog Service (TCP/UDP 3268).

The correct answer is B, Buffer overflow. In CEH vulnerability and exploitation concepts, a buffer overflow occurs when a program writes more data into a fixed-size memory buffer than it was designed to hold. The excess data can overwrite adjacent memory, corrupt control data, crash the application, or allow attacker-controlled code execution. CEH-related material describes buffer overflow as writing too much data into an application’s allocated buffer, potentially overwriting adjacent memory, executing code, or crashing the system. It also explains that buffer overflow attacks rely on lack of boundary testing and, in stack-based cases, may overwrite a return pointer so execution flow switches to malicious code. XSS injects malicious scripts into web pages, CSRF tricks an authenticated user into performing unwanted actions, and SQL injection manipulates database queries. These do not primarily exploit memory corruption. Therefore, the vulnerability associated with memory corruption is buffer overflow.

The behavior described is most consistent with an unauthenticated scan. In CEH-aligned vulnerability assessment methodology, unauthenticated scanning evaluates systems from the perspective of an external or non-privileged entity. The scanner can typically identify network-reachable services, open ports, service banners, protocol fingerprints, and sometimes known vulnerabilities inferred from versions or exposed configurations. However, it cannot reliably inspect host-internal posture such as registry settings, local security policies, installed patch levels, missing hotfixes, detailed configuration baselines, or user and group policy settings because those require authenticated access to query the operating system and installed software inventory directly.

The prompt explicitly states that the results were limited to “open service ports and version banners” and that “deeper registry settings, user policies, and missing patches remain unreported.” That limitation is a hallmark of unauthenticated scanning. The additional clue that “system login prompts were never triggered” and “no credential failures were logged in the SIEM” further confirms that the scanner never attempted to authenticate to endpoints using accounts, SSH/WinRM/WMI, SMB, or agent-based credential checks. If the scan were authenticated or credentialed, you would expect authentication attempts, potential login prompts on some services, and often audit logs or SIEM events reflecting successful or failed logons.

Option C, internal scan, only describes where the scan originates, not whether credentials were used. Options B and D imply authentication and host-level interrogation, which contradicts the observed lack of credential activity and missing patch/policy visibility. Therefore, unauthenticated scanning best explains the outcome.

The correct answer is A. Passive attack because the activity described involves monitoring and capturing information without altering data, system resources, or communications. In CEH-aligned information security concepts, passive attacks are defined by the attacker’s goal of eavesdropping— observing traffic to collect intelligence such as usernames/passwords, session identifiers, network patterns, or sensitive content—while making minimal changes that would trigger detection. The scenario explicitly states that the actor is “silently capturing clear-text credentials” and “analyzing unencrypted traffic,” and that “no modifications have been made to the data.” These are signature indicators of passive attacks such as packet sniffing and traffic analysis.

On an internal Wi-Fi network, passive attacks are particularly effective when encryption is weak or absent, or when users access services that transmit credentials in clear text. An attacker can capture packets and reconstruct sensitive information, especially where legacy protocols or misconfigurations exist. Because passive attackers do not need to inject or modify packets, they often avoid generating anomalies such as retransmissions, spoofed responses, or unexpected routing changes—helping them remain undetected, consistent with the prompt.

Why the other options do not fit: Distribution attack is not the standard classification for this behavior and does not specifically describe silent observation of traffic. Close-in attack refers to attacks that depend on physical proximity (e.g., shoulder surfing, physical tapping, local interception near the target). While Wi-Fi sniffing can require proximity, the defining characteristic in the question is the non-invasive observation with no data modification—i.e., passive attack. Insider attack relates to the attacker’s identity/role (a trusted internal person), which is not established here; the scenario only describes behavior, not who the actor is.

Therefore, the described credential capture and traffic analysis without modification most clearly indicates a passive attack.

The correct answer is D. Anomaly-Based Detection because the scenario explicitly states that the system “monitors traffic for deviations from established baselines” and flags behavior that does not match normal network activity. In CEH-aligned IDS/IPS concepts, anomaly-based detection (also called behavior-based detection) works by building a profile of what “normal” looks like—such as typical packet rates, protocol usage, session patterns, timing, connection distributions, and expected traffic flows—and then identifying events that deviate significantly from those norms. This makes it particularly useful against evasion techniques and previously unseen patterns, because it is not limited to matching known signatures.

Sophia’s tactic—packet fragmentation—is a classic evasion approach intended to bypass simplistic inspection systems by splitting malicious payloads or attack patterns across multiple fragments so they are harder to reconstruct or match. A baseline-driven anomaly system can still detect the attack because fragmentation itself (or the resulting traffic characteristics) may appear abnormal: unusual fragment counts, unexpected fragment sizes, atypical reassembly behavior, irregular session characteristics, or protocol violations compared to normal traffic profiles. Because the detection is based on behavior rather than a fixed pattern, it can trigger alerts even if the exact malicious payload is not recognized.

Why the other options are less correct: Signature-based detection relies on known patterns and may be evaded when attackers modify payloads or fragment traffic to avoid matches. Stateful packet inspection tracks connection state and can help with session validation, but it is not inherently a baseline deviation detector. Deep packet inspection inspects packet contents and can sometimes reassemble fragments depending on implementation, but the question’s key clue is “deviations from established baselines,” which directly points to anomaly-based detection.

Therefore, the IT team is most likely using anomaly-based detection.

The correct answer is A, Long dwell time. In CEH security operations and threat-detection concepts, an Advanced Persistent Threat, or APT, is characterized by advanced techniques, persistence, stealth, and a long-term objective. CEH-related material describes an APT as a continuous process of stealing information, often focused on private organizations or political motives, and explains that “persistent” involves continuous monitoring and data fetching from a target. It also lists APT criteria such as timeliness, meaning time spent probing and accessing the target, and risk tolerance, meaning the ability to remain undetected. Long dwell time means the attacker remains inside the environment for an extended period before detection, often performing internal reconnaissance, privilege escalation, lateral movement, credential theft, persistence, and quiet data exfiltration. Malware spam is usually broad and noisy, a one-time exploit lacks persistence, and brute force is only a technique. Therefore, long dwell time best indicates APT behavior.

WPA2-Enterprise networks authenticate clients through 802.1X using a RADIUS server. A common attack method described in CEH training is to create an evil-twin access point broadcasting the same SSID as the legitimate one. Combined with de-authentication frames, clients are forced off the real AP and automatically reconnect to the stronger rogue AP. This allows the attacker to capture authentication exchanges for later misuse, including credential harvesting or EAP-based downgrade attacks.

The correct answer is A. IMDS Attack.

The scenario describes an attacker executing code from inside a cloud instance and retrieving temporary credentials associated with the instance role. This is characteristic of an Instance Metadata Service (IMDS) attack. Cloud platforms expose metadata services to instances so applications can retrieve configuration and role credentials. If an attacker gains code execution on the instance, they may query IMDS and steal temporary credentials.

A cloud security reference explains that when an EC2 instance is associated with an instance profile, temporary security credentials are automatically provided to the instance through the Instance Metadata Service (IMDS) . In the scenario, the tester abuses this behavior after gaining code execution through the vulnerable web application.

Option B. CPDoS Attack is incorrect because Cache Poisoned Denial-of-Service targets caching behavior to cause service denial.

Option C. Cloud Snooper Attack is incorrect because Cloud Snooper refers to bypassing firewall controls and command-and-control through cloud infrastructure paths.

Option D. Wrapping Attack is incorrect because wrapping attacks commonly target SOAP/XML signatures or request manipulation, not cloud instance metadata credentials.

Therefore, the best answer is A. IMDS Attack.

The observed behavior most closely matches the Digital Signature Algorithm (DSA). The strongest indicators are: (1) a fresh random value is generated for each signature operation, and (2) the math operates in a subgroup defined by public domain parameters using modular arithmetic, and (3) signatures are verified using a public verification key, not by “decrypting” the message.

DSA is a signature-only asymmetric algorithm derived from discrete logarithm principles. It uses public domain parameters commonly represented as (p, q, g), where p is a large prime, q is a prime divisor of p−1, and g is a generator of a subgroup of order q. For each signature, DSA requires a unique per-message secret random number k. This ephemeral k is crucial: reusing it (or generating it predictably) can expose the private key. The scenario’s emphasis on “fresh random value for each signature operation” aligns directly with this core DSA requirement.

By contrast, RSA signatures can be implemented in different ways (often involving modular exponentiation with padding) and do not inherently require a fresh random per-signature secret like DSA’s k (although some padding schemes may involve randomness). Diffie-Hellman is primarily a key exchange algorithm, not a signing algorithm. ElGamal can be used for signatures and also uses randomness, but the mention of “subgroup defined by public domain parameters” and the classic per-signature random value requirement most strongly aligns with the standard description of DSA used in many security curricula and assessments.

Therefore, based on the signature process characteristics described, the best match is A. DSA.

The correct answer is C. Encrypt stored data with quantum-resistant algorithms.

The question asks for a mitigation that directly addresses cryptographic resilience for stored data. If future quantum computers can break currently deployed public-key schemes, then the appropriate defense is to migrate protected data and key-establishment designs toward post-quantum or quantum-resistant cryptographic algorithms.

CEH cryptography material explains that cryptographic attacks attempt to recover encryption keys and that weak encryption algorithms may not be resistant enough against cryptographic attacks . In this scenario, the risk is not network exposure or poor coding practice; it is the future strength of the cryptographic algorithm itself.

Option A. Use quantum-specific firewalls is incorrect because firewalls do not protect already encrypted archives from cryptanalytic key recovery.

Option B. Break data into fragments and distribute it across multiple locations may reduce concentration risk, but it does not solve the weakness of an encryption algorithm vulnerable to quantum cryptanalysis.

Option D. Include quantum-resistance checks in SDLC and code review processes is useful as a governance practice, but it does not directly protect the stored archives unless the cryptography is actually changed.

Option C. Encrypt stored data with quantum-resistant algorithms is correct because it directly mitigates the future decryption risk.

Therefore, the best answer is C. Encrypt stored data with quantum-resistant algorithms.

The correct answer is B. Second-Order SQL Injection.

A second-order SQL injection occurs when malicious input is first stored by the application and then later used unsafely in a database query. The attack does not necessarily execute at the moment the input is submitted. Instead, it triggers later when another function, background job, report generator, or business process retrieves the stored value and incorporates it into a dynamic SQL statement.

The scenario precisely describes this pattern: the template value is accepted and stored, no immediate disruption occurs, and only days later a scheduled reporting process uses that stored value to dynamically construct a query. The resulting dataset includes records beyond the expected scope, indicating SQL injection during later query execution.

CEH web application material explains that SQL injection relies on inserting malicious code or script into existing SQL queries to reveal or manipulate database data . It also classifies SQL injection attacks and explains that in-band, error-based, inferential, and out-of-band SQL injection depend on how the injection is executed and how results are observed . In this case, the defining feature is not an error message or appended immediate query; it is the delayed execution of stored input, which identifies it as second-order SQL injection.

Option A. Stored Procedure Injection is incorrect because stored procedure injection targets database stored procedures or abuses procedure execution. The scenario describes stored user input later used in dynamic reporting queries, not direct stored procedure abuse.

Option C. Error-Based SQL Injection is incorrect because error-based SQL injection depends on database error messages revealing information. No database error messages are described.

Option D. Piggybacked Query Injection is incorrect because piggybacking means appending an additional malicious query to a legitimate query in the same immediate execution context. The scenario emphasizes delayed execution from stored input.

Therefore, the best answer is B. Second-Order SQL Injection.

The correct answer is D. IPsec (Internet Protocol Security). The question specifically asks for a Layer 3 protocol that can provide end-to-end encryption for FTP traffic. IPsec operates at the Network Layer (Layer 3) of the OSI model and secures IP communications by providing confidentiality, integrity, authentication, and anti-replay protection.

Since standard FTP transmits usernames, passwords, and data in plaintext, it is vulnerable to packet sniffing and man-in-the-middle attacks. By implementing IPsec, all IP packets exchanged between the client and server can be encrypted regardless of the application being used. This means FTP traffic can be protected without modifying the FTP application itself.

Option A (FTPS) uses SSL/TLS to secure FTP but operates at higher layers. Option B (SFTP) is a secure file transfer protocol that runs over SSH and is considered an application-layer solution rather than a Layer 3 protocol. Option C (SSL) provides transport/session-layer encryption and is not a Layer 3 protocol.

CEH Exam Tip:

IPsec = Layer 3 (Network Layer) Encryption

SSL/TLS = Higher-layer Encryption

SFTP = SSH-based Secure File Transfer

FTPS = FTP over SSL/TLS

Therefore, the best answer is D. IPsec.

This scenario demonstrates SMTP Enumeration, a classic enumeration technique described in CEH v13 Network Enumeration. SMTP servers may expose commands such as VRFY, EXPN, and RCPT TO, which can be abused to validate user accounts.

When these commands are enabled without restriction, attackers can enumerate valid usernames without authentication. The Nmap script used explicitly leverages these commands, confirming the misconfiguration.

Option B is incorrect because authentication is not bypassed. Option C concerns DNS routing, not user enumeration. Option D relates to encryption, not enumeration capability.

CEH v13 strongly recommends disabling or restricting SMTP user verification commands. Thus, Option A is correct.

CEH v13 distinguishes between vertical and horizontal privilege escalation. Vertical escalation occurs when an attacker moves upward in the hierarchy of privileges—such as from a regular user to an administrator or root—by exploiting vulnerabilities, misconfigurations, or insecure privilege boundaries. This allows the attacker to perform tasks that were previously restricted, such as modifying system settings, accessing sensitive data, installing malware, or controlling the entire environment. Horizontal escalation, on the other hand, involves accessing another user’s resources at the same privilege level, which the other options describe. Exploiting unquoted service paths or weak access controls may facilitate privilege abuse, but they do not inherently elevate the user to a higher privilege tier unless they specifically lead to administrative execution. The scenario that aligns perfectly with the CEH definition of vertical privilege escalation is the escalation from regular user to administrator.

Once the base DN is identified through LDAP namingContexts, CEH teaches that the next step in enumeration is to query the directory tree using this DN. This allows retrieval of users, groups, computers, and other AD objects. LDAP-based enumeration requires valid search filters rooted in the base DN.

In Certified Ethical Hacker cloud computing coverage, the essential characteristics of cloud services align with the widely adopted NIST cloud model. The requirement in this scenario is twofold: efficient sharing of resources across multiple users and the ability to scale to meet spikes in demand such as Black Friday traffic. The cloud characteristic that directly addresses efficient sharing is resource pooling. Resource pooling means the cloud provider aggregates compute, storage, memory, and network resources into a shared pool that serves multiple customers using a multi-tenant model. Resources are dynamically assigned and reassigned according to consumer demand, which enables rapid scaling without requiring the organization to purchase and install new physical infrastructure for each surge.

This matches the scenario’s emphasis on optimizing resource allocation and ensuring scalability. With resource pooling, the platform can draw from shared infrastructure capacity when demand rises and release it when demand drops, improving efficiency and cost effectiveness. In CEH terms, this also influences security considerations such as tenant isolation, hypervisor security, and access control, because multiple customers may rely on the same underlying physical hardware while remaining logically separated.

The other options are not the best match for “efficiently shared across multiple users.” Measured service focuses on metering and pay-as-you-go billing. Broad network access describes availability over networks and standard client platforms. On-demand self-service refers to a consumer’s ability to provision resources automatically without human interaction from the provider. Those are important cloud traits, but the one that specifically enables shared infrastructure and elastic allocation is resource pooling.

The scenario best matches Traffic IQ Professional because it describes a tool used to generate and replay diverse traffic patterns through a firewall to validate rule enforcement and detection under simulated attack conditions. The key functions here are traffic generation, replay, and the ability to model both legitimate and malicious flows to test whether the firewall correctly handles evasion attempts and policy enforcement. Traffic generation/replay platforms are used in security validation and firewall testing to emulate real-world network behaviors at scale and to assess how devices respond to crafted or replayed traffic profiles.

Why the other tools are less suitable:

Nmap (A) is primarily a scanner for host discovery, port scanning, and service enumeration, with some scripting capabilities. It is not chiefly a traffic generation/replay system for exercising a firewall with diverse controlled flows.

Colasoft Packet Builder (C) can craft packets and build custom traffic at the packet level, which is useful for creating specific test packets. However, the scenario emphasizes broader “diverse traffic patterns” and replay of flows in a way typically associated with traffic modeling/validation suites rather than single-packet construction.

Metasploit (D) is an exploitation framework used to develop and execute exploits and payloads. While it can generate certain traffic, its primary purpose is not comprehensive traffic generation and replay to validate firewall policies under many traffic types.

Traffic IQ Professional is the best fit because it aligns with a firewall test plan focused on simulating legitimate and malicious traffic profiles, including evasion-style patterns, and demonstrating how the perimeter device behaves under controlled conditions. This approach is often used to evaluate whether a firewall can consistently enforce security policies, detect anomalies, and resist evasion techniques without overblocking legitimate traffic.

Therefore, the most likely tool is B. Traffic IQ Professional.

The Certified Ethical Hacker (CEH) Incident Response lifecycle begins with Identification, followed by containment, eradication, recovery, and lessons learned. CEH documentation stresses that understanding the scope and nature of an incident is critical before taking disruptive action.

Option A is the correct initial response because it focuses on real-time monitoring and log analysis, which are essential during the identification phase. CEH materials emphasize analyzing logs, authentication failures, and traffic anomalies to confirm whether an incident has occurred and determine the attacker’s techniques, persistence level, and impact.

Option B, while valuable, is more appropriate after initial identification. Conducting deep outbound traffic audits without first understanding the attack vector can delay containment decisions.

Option C is premature. CEH warns that changing credentials too early may alert the attacker and cause them to escalate or destroy evidence.

Option D represents a containment strategy, not an initial response. CEH guidelines advise against immediately disconnecting systems unless there is confirmed active data exfiltration that cannot be otherwise controlled, as this may disrupt business operations and erase volatile forensic evidence.

Therefore, the CEH-approved approach is to monitor, analyze, and identify the incident before moving to containment and eradication.

The correct answer is D, Rules of engagement. In CEH pre-engagement concepts, the rules of engagement document defines the authorized boundaries of a penetration test before any testing begins. It specifies what testing techniques are permitted, which systems or networks may be tested, when testing may occur, what actions are prohibited, whom to contact during emergencies, and how incidents such as service disruption should be handled. It also helps protect the penetration tester by documenting client approval and limiting liability when the tester acts within the agreed boundaries. A project scope may list targets, IP ranges, applications, or business units included in testing, but it does not fully cover operational permissions and liability terms by itself. A nondisclosure agreement protects confidential information discovered during the engagement. A service-level agreement defines service expectations such as uptime, response time, or support obligations. Therefore, the document that best matches allowed testing, timing, and tester liability limits is the Rules of engagement.

The symptoms point directly to a Slowloris attack, which CEH materials classify as an application-layer denial-of-service technique that targets web servers by exhausting their available concurrent connection slots rather than saturating bandwidth. In a Slowloris attack, the attacker opens many HTTP or HTTPS connections to the server and then keeps them alive as long as possible by sending partial, incomplete HTTP requests or very slow header transmissions at timed intervals. Because the requests are never fully completed, the server keeps the connections open, waiting for the remainder of the request. Over time, the server’s maximum connection limit is consumed, and legitimate users cannot establish new sessions, even though overall network traffic may remain relatively low.

That exact pattern is described in the scenario: the server is “struggling to accept new connections,” the “maximum connection limit is nearly reached,” and there is “no significant spike in overall network traffic.” This is a classic indicator of low-and-slow DoS behavior, which can be harder to detect because it does not resemble a high-volume flood.

A SYN Flood attack can also exhaust connection resources, but it typically creates a large number of half-open TCP connections and is usually more apparent in network-level telemetry and SYN backlog behavior. A UDP Flood generally causes a noticeable traffic spike. “Peer-to-Peer Attack” describes a botnet architecture style, not the specific technique used here. Therefore, the attack being simulated is Slowloris.

CEH v13 highlights that multi-vector DDoS attacks require multi-layer DDoS mitigation services, often cloud-based, capable of analyzing, filtering, and scrubbing traffic across network, transport, and application layers. These providers maintain massive bandwidth capacity, global scrubbing centers, and behavioral analysis engines that distinguish legitimate sessions from malicious floods. SYN floods and HTTP GET floods require different mitigation techniques simultaneously, which typical firewalls or WAFs cannot handle without dropping legitimate traffic. Blocking SYN packets (Option A) would disrupt normal users. A WAF (Option C) handles only Layer 7 traffic and does not mitigate network-layer volumetric attacks. Increasing bandwidth (Option D) is ineffective against large botnet attacks. Therefore, deploying a multi-layer cloud DDoS protection service is the most effective solution for resilient, real-time mitigation.

The correct answer is C. Wi-Fi Keylogger.

The device is physically placed inline between the keyboard and the desktop, so it is hardware-based. However, the defining feature in the question is that it forwards captured keystrokes over the organization’s wireless environment. That makes the most precise answer Wi-Fi Keylogger.

CEH system hacking material explains that keylogging is the process of monitoring or recording user keyboard actions and that keyloggers may be hardware-based or software-based. It also lists wireless-capable hardware devices such as KeyGrabber Nano Wi-Fi and KeyGrabber Wi-Fi Premium among hardware keylogging devices .

Option A. Hardware Keylogger is broadly true, but less precise because the question emphasizes wireless forwarding.

Option B. Acoustic/CAM Keylogger is incorrect because the device is not inferring keystrokes from sound, camera capture, or electromagnetic observation.

Option D. Bluetooth Keylogger is incorrect because the scenario specifies forwarding through the company’s Wi-Fi environment, not Bluetooth.

Therefore, the best answer is C. Wi-Fi Keylogger.

Information Leakage is the most accurate threat category because the scenario centers on sensitive data becoming publicly accessible through unintended disclosure. In CEH coverage, information leakage refers to the exposure of confidential or internal details to unauthorized parties through oversharing, misconfiguration, poor operational security, or improper handling of information. Here, the data is already visible on public forums, meaning an attacker does not need to exploit a vulnerability in a system directly at first; they can simply collect and correlate exposed details such as employee names, email formats, internal hostnames, software versions, configuration snippets, IP ranges, or screenshots.

This aligns strongly with reconnaissance and OSINT techniques emphasized in CEH: adversaries routinely harvest publicly available information to build an attack plan, identify privileged targets, guess usernames, craft phishing lures, locate externally exposed services, or tailor further exploitation using revealed versions and settings. While social engineering can be a follow-on step, the core issue described is not persuading users to reveal information interactively. Instead, the organization’s risk stems from information already leaked due to careless online behavior.

Corporate espionage is a motive rather than a specific technique category, and system and network attacks describe active exploitation and intrusion attempts, which come after the intelligence-gathering stage. Therefore, to simulate the adversary’s method of gathering what has been exposed, Michael should focus on information leakage: identifying what is publicly disclosed, how it can be aggregated, and what attack paths it enables, then recommending containment and policy and awareness controls.

An HTTP flood is an application-layer (Layer 7) DoS/DDoS technique that targets web application resources by sending large volumes of seemingly valid HTTP GET/POST requests. Because the traffic can look “legitimate” at the protocol level, controls that primarily focus on network/transport characteristics (such as basic firewalls) are often insufficient. The tool described in the scenario is explicitly inspecting and filtering malicious HTTP traffic while allowing legitimate customer requests—that behavior aligns most directly with a Web Application Firewall (WAF).

A WAF is designed to protect web applications by analyzing HTTP/S requests and responses, applying security rules that detect and block abnormal or malicious patterns. In an HTTP flood scenario, a WAF can enforce rate limiting, detect request anomalies (e.g., repeated requests to resource-intensive endpoints like checkout), identify bot-like behavior, and apply signatures/behavioral policies to mitigate attacks while continuing to permit valid users. The key clue is the focus on HTTP-level inspection and filtering to maintain service continuity—a classic WAF use case during Layer 7 attacks.

Why the other options are less suitable:

A Load Balancer (A) improves availability by distributing traffic across servers, but it does not inherently inspect and filter malicious HTTP requests. It can help absorb load, yet it’s not primarily a security inspection/filtering control.

An Intrusion Prevention System (C) can block malicious activity, but many IPS deployments are stronger at network/transport-layer patterns and may not provide the same depth of application-aware HTTP policy enforcement as a WAF for targeted web endpoints.

A traditional Firewall (D) mainly filters by IP/port/protocol and cannot reliably distinguish malicious vs legitimate HTTP GET/POST floods when they use allowed ports (80/443).

Passive reconnaissance is emphasized throughout CEH as an essential method for gathering intelligence without alerting monitoring systems. When the tester cannot interact with the live site, they must rely entirely on third-party archives or cached content stored by search engines or internet archival services. Google’s cache function provides previously stored versions of web pages exactly for this purpose. CEH explains that attackers frequently use cached content to retrieve outdated login portals, administrative pages, exposed directories, or other sensitive elements that may no longer appear on the live web server. Unlike operators such as intext or intitle, which query live indexed metadata, the cache operator retrieves historical snapshots without accessing the target website. The link operator identifies backlinks but does not provide historical page content. Only the cache operator directly supports viewing previous versions of pages passively, aligning perfectly with the requirement to avoid detection while gathering intelligence on legacy web content.

The correct answer is D because the scenario describes Business Email Compromise, commonly called BEC. In BEC, attackers compromise or misuse a trusted business email account and send believable internal messages to employees, finance teams, executives, or partners. The key clues are “compromise a legitimate email account,” “convincing internal messages,” and “urgent actions.” CEH social engineering concepts explain that computer-based social engineering includes phishing and crafted emails that appear legitimate, while spear phishing targets an individual or small group within an organization. However, this question is more specific than ordinary phishing or spear phishing because the attacker is using a legitimate compromised account rather than only a fake or spoofed email. CEH email-hijacking content also describes compromised email accounts sending messages to people the victim knows and email messages containing requests such as money transfers. Therefore, spoofing, phishing, and spear phishing are related, but Business Email Compromise is the most precise answer.

Operational Technology and ICS environments often suffer from misconfigurations such as unchanged factory-default passwords. CEH identifies exploiting default credentials as a direct and effective method because ICS devices frequently lack strong authentication controls. Using these built-in credentials grants immediate unauthorized access to supervisory controls, enabling adversaries to manipulate configurations, disrupt processes, or escalate attacks across critical systems.

The correct answer is D. Reconnaissance.

The scenario describes an early-stage information-gathering activity. The team is not exploiting the application, maintaining access, or actively compromising accounts. Instead, they are mapping exposed endpoints, directories, parameters, scripts, backend behavior, response differences, and error-handling patterns to understand the application before later testing.

CEH methodology describes reconnaissance as the preparatory phase where an attacker or tester gathers as much information as possible about a target before launching subsequent phases . EC-Council material also describes footprinting as building a blueprint or profile of an organization or target in a methodological manner, including discovering systems, services, access points, and mapping the network .

Option A. Maintaining Access is incorrect because there is no persistence or continued unauthorized access.

Option B. Scanning is less accurate because although some observation and endpoint checking may occur, the broader activity is structural information gathering at the beginning of the engagement.

Option C. Gaining Access is incorrect because the team is not exploiting vulnerabilities or taking control of the application.

Option D. Reconnaissance is correct because the activity focuses on collecting and organizing information to support later testing phases.

Therefore, the best answer is D. Reconnaissance.

CEH methodology stresses prioritization based on risk, exploitability, and business impact. High-severity vulnerabilities—especially those related to outdated or unsupported server software—are frequently associated with known, publicly documented exploits. The proper next step after identifying such vulnerabilities is to confirm exploitability safely, typically by researching available exploit code, validating version-specific weaknesses, and determining whether the vulnerability can be successfully leveraged under the defined scope of engagement. CEH highlights that exploitation attempts must be evidence-driven, not arbitrary, and focusing on high-risk vulnerabilities allows testers to demonstrate meaningful security impacts. Brute-forcing (Option A) is unnecessary and high-noise. Ignoring or deprioritizing the high-risk finding (Options B and C) contradicts CEH risk-based assessment principles. Therefore, verifying exploitability of the high-risk vulnerability is the correct step.

The algorithm described most accurately matches RSA. CEH cryptography coverage explains that RSA is a widely used public-key cryptosystem that supports both encryption and digital signatures. In a typical RSA-based signature process, the sender generates a hash of the message and applies their private key using modular exponentiation to create a digital signature. The recipient then uses the sender’s public key to verify the signature, also through modular exponentiation operations involving large prime numbers and a modulus. The scenario specifically references modular exponentiation for generating digital signatures, which is a defining mathematical operation in RSA.

Diffie-Hellman is primarily a key exchange algorithm and does not provide digital signatures by itself. It enables two parties to establish a shared secret over an insecure channel but does not authenticate messages directly through signing. ElGamal does support encryption and can be adapted for signatures, but in standard CEH-oriented contexts, RSA is the most commonly referenced algorithm for public-key encryption and digital signatures in payment systems. DSA is strictly a digital signature algorithm and does not provide encryption functionality; the prompt describes a broader public-key cryptosystem used for authenticity of payment confirmations, which aligns more directly with RSA’s dual capability.

Additionally, RSA’s reliance on key pairs stored and retrieved from directories fits the description of public-key verification in enterprise payment infrastructures. Therefore, RSA is the correct identification.

CEH emphasizes that application-layer DoS attacks are often the most difficult to detect and mitigate because they can mimic legitimate user behavior while exhausting backend resources. A distributed SQL injection–driven DoS (Option B) can be especially challenging: attackers send requests that appear valid at the HTTP level, but the injected or crafted parameters force the application/database to execute expensive queries (heavy joins, sleep/delay functions, or costly operations). When distributed across many sources, the traffic can look like normal customer usage—successful TCP handshakes, valid HTTP requests, and realistic user-agent patterns—while still causing database connection pool exhaustion, CPU spikes, lock contention, and degraded response times.

Option A (Smurf) and Option D (UDP/DNS flooding) are more volumetric/network-layer patterns and are typically mitigated with upstream DDoS scrubbing, rate limiting, and filtering, and are more readily detectable via traffic anomalies. Option C (zero-day RCE) is severe, but it is not primarily a “DoS technique” in CEH classification; it’s an exploitation scenario that may lead to service outage, but the detection/mitigation path centers on exploit prevention, EDR, patching, and containment rather than DoS controls. In CEH terms, Option B aligns best with a sophisticated, scenario-like DoS that blends into normal app activity.

CEH mitigation approaches for application-layer DoS include WAF rules, input validation/parameterization (preventing SQLi), query cost controls, rate limiting by behavior, caching, database hardening, and anomaly detection at the application and database tiers.

Side jacking, as defined in CEH v13 Web Application Hacking, is a form of session hijacking where an attacker captures valid session identifiers—usually cookies—by sniffing network traffic. This attack is particularly effective when applications fail to encrypt session cookies using HTTPS.

In CEH v13, side jacking is commonly associated with attacks performed on unsecured wireless networks, where attackers passively monitor traffic using packet sniffers such as Wireshark. If session cookies are transmitted in plaintext, the attacker can replay them to impersonate the victim without needing login credentials.

Option B precisely matches this definition: capturing unencrypted session cookies and reusing them to gain unauthorized access.

Other options describe different attack types:

A is credential harvesting via social engineering.

C is network exploitation.

D is cross-site scripting (XSS).

CEH v13 emphasizes enforcing HTTPS, Secure and HttpOnly cookie flags, and session regeneration as defenses against side jacking.

The correct answer is A. DNS hijacking. In this attack, the user enters a legitimate domain name, but DNS resolution is manipulated so the browser is redirected to a fake or malicious website. The fake site may look like the real banking site but uses a different URL or lacks HTTPS security, prompting the victim to enter credentials again. ARP cache poisoning usually occurs inside a local network to redirect traffic through an attacker, DHCP spoofing gives victims malicious network settings, and DoS attacks make services unavailable. Here, the key clue is redirection from a legitimate URL to a suspicious banking page, which matches DNS hijacking.

CEH materials explain that modern web applications deploy multiple layers of security—HTTPS, secure cookies, HttpOnly flags, and strict session regeneration—to defend against standard hijacking methods such as token theft through XSS or fixation. When these protections are properly implemented, attackers must compromise the underlying trust relationship between the client and server to successfully intercept or manipulate session tokens. One of the most advanced techniques described in CEH is compromising a trusted certificate authority or injecting a forged certificate into the victim’s trust store. This enables the attacker to perform a transparent MITM attack despite HTTPS protections. Because the victim’s browser trusts the forged certificate, encrypted traffic—including session tokens—is exposed to the attacker without generating browser warnings or IDS alerts. Timing side-channel attacks are not considered session hijacking methods; XSS is mitigated by secure flags; and session fixation is ineffective when session regeneration occurs. Therefore, compromising a trusted certificate authority to enable an undetectable MITM attack is the most viable method.

Tautology-based SQL injection tests, such as using ' OR ' 1 ' = ' 1, are safe and effective methods to verify whether SQL queries are being manipulated by user input. CEH emphasizes avoiding destructive queries and using logical expressions that return all rows if injection is successful.

The correct answer is A, DoS. If a Python API allows unlimited file upload size, an attacker can upload extremely large files or repeatedly upload many files until server resources are exhausted. This can consume disk space, memory, CPU, application worker threads, temporary storage, or bandwidth, causing the API or hosting server to slow down, crash, or become unavailable to legitimate users. CEH web application security guidance emphasizes validating input and applying file-upload controls such as content-type checks and malware scanning. It also notes that system resources can be depleted, such as by filling disk space, leading to denial of service. In CEH DoS concepts, a denial-of-service attack restricts or blocks authorized users from accessing system resources; flooding servers or exhausting resources prevents genuine requests from being served. XSS involves script injection, SQLi targets database queries, and CSRF forces authenticated users to perform actions. The issue here is resource exhaustion, so DoS is the best answer.

The correct answer is D. Exposed Bearer Tokens in Logs.

The scenario states that authentication artifacts associated with Kubernetes service accounts are appearing in logs or system-generated output. If those values can be reused to access cluster resources, they are functioning as bearer credentials. A bearer token grants access to whoever possesses it, so exposing it in logs creates a serious privilege-reuse risk.

Option A. No Certificate Revocation is incorrect because the weakness does not involve inability to revoke TLS or client certificates.

Option B. Unauthenticated HTTPS Connections is incorrect because the issue is not that HTTPS connections lack authentication. The issue is that valid authentication tokens are being logged.

Option C. No Non-repudiation is incorrect because non-repudiation concerns proving who performed an action. The scenario concerns credential exposure.

Option D. Exposed Bearer Tokens in Logs is correct because service-account bearer tokens recorded in logs could be reused by anyone who can access those logs.

Therefore, the best answer is D. Exposed Bearer Tokens in Logs.

The correct answer is C, Severity scoring. CVSS stands for Common Vulnerability Scoring System. In CEH vulnerability analysis and vulnerability management topics, CVSS is used to measure and communicate how severe a vulnerability is. The CEH material explains that CVSS captures the principal characteristics of a vulnerability and produces a numerical score that reflects its severity. That score can then be translated into qualitative ratings such as low, medium, high, and critical, helping organizations assess and prioritize remediation activities. CVSS is not an encryption mechanism, because it does not protect data or perform cryptographic operations. It is also not exploitation, because it does not attack or take advantage of vulnerabilities. Auditing may use CVSS results as supporting evidence, but CVSS itself is specifically a scoring framework. Therefore, in this question, the best and most precise CEH-aligned answer is Severity scoring.

The correct answer is B. Use a scan tool like Nessus. In CEH vulnerability assessment and reconnaissance concepts, vulnerability scanners are used to discover security weaknesses on systems, applications, services, and network devices. Nessus is a widely known vulnerability assessment tool that can scan Windows-based systems for missing patches, weak configurations, open ports, insecure services, outdated software, and known vulnerabilities.

Option A is not the best answer because MITRE CVE provides vulnerability information, but it does not directly assess whether a specific Windows computer is vulnerable. Option C is related to system imaging or forensic preparation, not vulnerability discovery. Option D, Windows Update, helps install patches, but it does not perform a complete vulnerability assessment or detect misconfigurations and exposed services.

For a healthcare provider, vulnerability scanning is especially important because systems may process sensitive patient or business data. A scanner such as Nessus gives structured results that can be prioritized and remediated.

Therefore, the best approach is to use a scan tool like Nessus.

The core weakness described is that the IoT devices “lack any mechanism to verify the integrity or authenticity of software prior to execution,” which directly maps to the need for code signing. In CEH-aligned IoT security guidance, code signing ensures that firmware and software images are cryptographically signed by a trusted authority and verified on the device before they are installed or executed. This verification confirms two critical properties: integrity, meaning the code has not been altered or tampered with, and authenticity, meaning the code genuinely originated from an authorized publisher. If an attacker attempts to introduce modified binaries or malicious instructions, signature verification fails and the device can reject execution, preventing unauthorized code from running.

While secure boot is closely related, it is specifically a boot-time chain-of-trust mechanism that verifies the bootloader and early-stage firmware during startup. The question, however, emphasizes a general lack of verification “prior to execution,” which is broader than boot only and is most directly addressed by code signing as a secure development and release practice. Secure firmware or software updates is also important, but secure updates typically rely on code signing as the fundamental control that makes updates trustworthy. Secure communication protocols protect data in transit, but they do not stop tampered code already on the device from executing.

Therefore, the most appropriate secure development practice to ensure only authorized, validated code runs on the devices is to implement code signing with mandatory signature verification.

The correct answer is D because Telnet is insecure by default. Telnet is an older remote access protocol that provides command-line access to remote systems, but it does not encrypt communication. This means usernames, passwords, commands, and keystrokes can travel across the network in clear text and may be captured through sniffing or man-in-the-middle attacks. The CEH-aligned material specifically states that Telnet sends usernames, passwords, and keystrokes over the network as clear text, making it easy to sniff. HTTPS is secure HTTP over TLS/SSL, SFTP is file transfer protected through SSH, and SSH is a secure replacement for Telnet that uses encryption and commonly operates on TCP port 22. Therefore, compared with HTTPS, SFTP, and SSH, Telnet is the protocol that is insecure by default because confidentiality and secure authentication protection are not built into its normal operation.

The correct answer is D because the root cause of the breach was an unpatched, outdated Apache HTTP Server vulnerable to remote code execution. According to CEH principles under Security Operations and Incident Response, vulnerability management and risk assessment are critical components of defensive security strategy. An extensive risk assessment enables the organization to identify vulnerable assets, prioritize patching based on severity and business impact, and implement a structured remediation plan.

Risk assessment is part of the vulnerability management lifecycle, which includes asset identification, vulnerability scanning, risk evaluation, prioritization, patch management, and verification. By determining which systems are most exposed and critical, the organization can apply patches and security updates systematically, reducing the attack surface. Since the breach occurred due to a known vulnerability, proper patch management and regular security updates would have prevented exploitation.

Options A, B, and C represent hardening or segmentation techniques but do not directly address the core issue of outdated software vulnerabilities. Blocking ports and using dedicated machines are good security practices; however, they do not eliminate the risk of exploitation if the web server software itself remains unpatched. Therefore, implementing a comprehensive risk assessment process followed by prioritized patch management aligns directly with CEH-recommended best practices for preventing similar future incidents.

The correct answer is C. Spam and Phishing because the campaign is based on unsolicited deceptive messages sent in bulk with the intent to lure many recipients into clicking a link and submitting credentials on a fake site. In CEH-aligned social engineering concepts, phishing is a deception technique used to trick users into revealing sensitive information (such as corporate usernames and passwords) by impersonating a trusted entity or presenting a convincing pretext. When phishing is executed “at scale” using mass messaging—often through email, messaging platforms, or social media—it overlaps strongly with spam, which refers to unsolicited bulk communications distributed to large numbers of targets.

The scenario contains the classic phishing flow: a fraudulent invitation contains a link to a counterfeit “cloud collaboration” login page, and users are prompted to authenticate. Credential capture (“which Nadia captures”) confirms the objective is credential harvesting rather than mere awareness disruption. The detail that she used “compromised social media accounts” is consistent with modern phishing operations that abuse trusted accounts to increase credibility and bypass initial suspicion. This also helps attackers evade some basic filtering and encourages victims to trust the message because it appears to come from a legitimate profile.

Why the other options are less correct: Catfishing typically involves building a fake persona and maintaining a relationship over time (often one-to-one) to manipulate a victim; it is not mainly defined by bulk unsolicited messages. Angler phishing specifically refers to phishing conducted through social media channels, often by impersonating customer support or hijacking brand interactions. While the platform here is social media, the question’s strongest discriminator is “unsolicited deceptive messages delivered at scale,” which points to the combined threat category spam and phishing rather than the more specific “angler” support-impersonation pattern. Involuntary data leakage describes accidental exposure of information, not active deception.

Therefore, Nadia’s campaign most clearly simulates spam and phishing.

The correct answer is D, ciphertext-only attack, because the attackers possess only encrypted data and have neither the encryption key nor any confirmed samples of the original plaintext. In CEH-aligned cryptography concepts, cryptanalytic attacks are categorized by what information and capabilities the attacker has. A ciphertext-only attack is the most constrained model: the attacker attempts to infer the plaintext or key by analyzing ciphertext alone, often leveraging statistical properties, repetitions, formatting assumptions, and structural patterns that may leak information when encryption is misused.

The scenario highlights that the attacker “examines encrypted outputs in bulk” to detect “structural or statistical patterns.” That wording maps directly to ciphertext-only analysis: looking for patterns caused by weak modes of operation, poor IV/nonce handling, deterministic encryption, repeated blocks (common in ECB mode), predictable headers, or consistent record templates. With block ciphers, large datasets increase the chance that repeated plaintext blocks produce repeated ciphertext blocks if the system uses an unsafe mode or reuses IVs, allowing an attacker to correlate records, identify fields, or sometimes recover content when combined with protocol or file-format knowledge.

The other options require more attacker capability than the prompt provides. Known-plaintext attacks require some plaintext-ciphertext pairs. Chosen-plaintext attacks require the ability to encrypt attacker-chosen inputs. Chosen-ciphertext attacks require a decryption oracle or the ability to submit ciphertext for decryption. Since none of those are present here, Emma should evaluate ciphertext-only exposure and specifically validate the cipher mode, IV/nonce uniqueness, padding behavior, and whether encryption is semantically secure for stored patient records.

yes do please

The correct answer is C. Web Cache Poisoning Attack.

The key indicators are:

The altered content is served to other users.

The origin server still returns the legitimate response.

The issue disappears after cache expiration or replacement.

The crafted request uses headers and parameters that influence cached output.

CEH-aligned web server material explains that Web Cache Poisoning occurs when an attacker sends a crafted request into the cache and stores fake entries, causing users to be redirected or served malicious content . Another CEH-aligned reference explains that a web cache stores copies of responses to speed up future requests, and if an attacker forces malicious or manipulated content into the cache, later visitors can receive that poisoned response .

Option A. DNS Server Hijacking is incorrect because DNS records or DNS server settings are not being modified.

Option B. DNS Rebinding Attack is incorrect because the scenario concerns cached web content, not browser access to private-network resources through DNS rebinding.

Option D. SQL Injection Vulnerability is incorrect because the behavior is tied to delivery-layer caching, not database query manipulation.

Therefore, the best answer is C. Web Cache Poisoning Attack.

Man-in-the-Cloud (MITC) attacks target cloud synchronization services such as Dropbox, Google Drive, and OneDrive by manipulating authentication tokens instead of user passwords. CEH courseware explains that cloud storage clients rely heavily on sync tokens stored locally, which authorize access without user interaction. If an attacker replaces or injects a malicious token, they can hijack the victim’s cloud account or redirect synced data to attacker-controlled locations. In this scenario, the EC2 instance continues to operate normally, but its Dropbox client silently synchronizes data to an external account using the attacker’s token. This bypasses traditional defenses such as perimeter firewalls, credential monitoring, or user behavior analytics, because the synchronization process appears legitimate and authenticated. MITC attacks are uniquely stealthy, as they require no further compromise once the sync token is stolen or replaced. Other choices, such as Cloud Snooper or cryptojacking, do not match the described behavior. Therefore, this attack clearly aligns with a Man-in-the-Cloud attack.

CEH v13 describes Agent Smith–style attacks as malicious Android operations where an app silently replaces legitimate applications by exploiting weaknesses in the Android app update and installation processes. These attacks often begin when users download seemingly innocent apps from untrusted third-party marketplaces. Once installed, the malicious application injects harmful code into other apps, overwriting them while preserving their icons and interface, allowing the attacker to harvest credentials, display ads, or maintain persistence without detection. CEH explains that this technique takes advantage of Android’s APK structure, sideloading vulnerabilities, and lack of signature validation in compromised environments. Simjacker (Option A) targets SIM toolkit vulnerabilities and does not replace apps. Man-in-the-Disk (Option B) abuses external storage operations but does not overwrite applications. Camfecting (Option D) refers to hijacking smartphone cameras. The described malicious replacement of legitimate apps exactly matches the Agent Smith attack pattern.

According to CEH v13, black box testing refers to a testing approach where the ethical hacker has no prior knowledge of the internal structure, source code, or configuration of the system.

The attacker simulates a real-world external attacker, relying solely on discovery and exploitation techniques.

White box testing = full knowledge

Gray box testing = partial knowledge

The correct answer is C, Fast flux. Fast flux is a DNS-based evasion technique commonly associated with botnets, malware hosting, phishing infrastructure, and command-and-control resilience. In fast flux, one domain name is mapped to many rapidly changing IP addresses, often with very short DNS TTL values. This causes clients resolving the same domain to receive different destination hosts over time, making takedown, blocking, and attribution harder. CEH DNS fundamentals explain that DNS translates human-readable names into IP addresses and that DNS responses may contain address mappings that are cached according to Time-to-Live values. The described behavior—rapidly rotating IP addresses for the same domain—matches fast flux, not DNS tunneling, which hides data inside DNS queries; not DNS poisoning, which inserts false DNS records; and not zone transfer, which copies DNS zone records between servers. Therefore, the technique being used is fast flux.

The scenario points directly to information gathering from the robots.txt file. A robots.txt file is typically located at the root of a website (e.g., https://example.com/robots.txt) and is intended to instruct search engine crawlers which paths should or should not be indexed. During web reconnaissance, testers often review robots.txt because it can unintentionally disclose sensitive directories, administrative panels, staging paths, backup locations, or restricted areas that the organization hoped would remain obscure. The scenario explicitly says Sofia found “a crawler directive at the server’s root” that “allows unintended indexing of restricted areas,” and that this “reveals internal paths.” That is exactly the kind of leakage that can come from misconfigured or overly revealing crawler directives.

This is considered an early-stage reconnaissance / information gathering technique because it does not require exploitation. It leverages publicly accessible configuration hints to map the application’s hidden structure. Even when robots.txt is used correctly, the listed disallowed entries can still serve as a roadmap of interesting targets; if configured incorrectly (for example, allowing indexing or exposing sensitive paths), it can increase exposure by helping those paths surface in search results or be discovered faster by attackers.

Why the other options are less accurate:

Vulnerability Scanning (A) implies using scanners to identify known flaws; here, the tester is manually/strategically inspecting a crawler directive for exposed paths.

Web Server Footprinting/Banner Grabbing (C) focuses on identifying server type/version and technologies via headers or responses, not discovering hidden paths from crawler directives.

Directory Brute Forcing (D) uses wordlists to guess directories; Sofia’s discovery comes from a disclosed list of paths, not brute-force guessing.

Therefore, the technique is B. Information Gathering from robots.txt File.

In CEH v13 Maintaining Access, stealth and persistence are key goals after compromise. Placing a backdoor in a file type excluded from resource maps (such as image metadata, configuration files, or uncommon extensions) reduces the likelihood of discovery by automated scanners and integrity checks.

Option D is correct because many security tools focus on executable or commonly accessed web files. Files excluded from resource maps are less likely to be scanned or monitored.

Option A increases detection risk due to frequent changes. Option B increases signature visibility. Option C still exposes the file to access logs and monitoring.

CEH v13 highlights that attackers often hide backdoors in non-obvious locations to avoid detection. Therefore, Option D is correct.

This question describes a classic example of Tautology-Based SQL Injection, a subcategory of SQL Injection attacks which fall under Web Application Hacking in the CEH curriculum.

In a tautology-based SQL injection, the attacker injects a SQL fragment that always evaluates to true, thus bypassing the authentication mechanism. The string ' C ' ll-T; — is a malformed variant, possibly meant to represent ' OR ' 1 ' = ' 1 ' ; --, which is one of the most basic and widely recognized tautology-based injection payloads. When injected into a vulnerable SQL query, this kind of input manipulates the WHERE clause of the query so that it always evaluates to true, regardless of the original conditions.

Here’s how it works:

If the SQL query is:

SELECT * FROM users WHERE username = ' $username ' AND password = ' $password ' ;

And the attacker inputs:

' OR ' 1 ' = ' 1 ' ; --

The query becomes:

SELECT * FROM users WHERE username = ' ' OR ' 1 ' = ' 1 ' ; -- ' AND password = ' ' ;

This results in the execution of:

SELECT * FROM users WHERE ' 1 ' = ' 1 ' ;

Which always evaluates to true, thereby bypassing authentication and allowing unauthorized access.

This method does not rely on error messages (Error-Based), timing delays (Time-Based Blind), or UNION statements (Union-Based). Its goal is to exploit logic within the query structure itself using boolean-based manipulation.

According to EC-Council ' s CEH v13 Module: Web Application Hacking, understanding tautology-based injection is critical because it ' s one of the most common ways attackers bypass login forms on poorly secured web applications.

CEH documentation explains that WPA-TKIP was a transitional security protocol and does not use AES encryption, relying instead on RC4-based mechanisms.

The lack of AES-based encryption makes WPA-TKIP vulnerable to injection and replay attacks.

Option C is correct.

Options A applies to WEP.

Option B affects authentication, not TKIP weakness.

Option D is not the primary TKIP flaw.

CEH recommends WPA2/WPA3 with AES.

The capabilities described match an enterprise Wireless Intrusion Prevention System (WIPS) tightly integrated with WLAN infrastructure: it uses access points as sensors (placing selected APs into passive scan/monitor mode), correlates and aggregates alarms from multiple controllers into a central engine for analysis and forensic retention, and can push automated countermeasures across the campus (such as coordinated channel scanning and remote configuration enforcement) when a device is classified as malicious. This is most consistent with Cisco Adaptive Wireless IPS.

Cisco’s adaptive WIPS model uses the existing Cisco wireless architecture (controllers and APs) to provide campus-wide monitoring and enforcement. The phrase “selected APs into a passive scan mode” is a strong indicator of adaptive sensor use—APs can be dedicated or time-sliced for scanning, and the system can coordinate coverage across channels. The centralized engine concept also aligns with enterprise WIPS deployments that collect events and alarms from multiple controllers for correlation and long-term storage, supporting incident investigation and compliance.

Why the other options are less fitting:

Fern WiFi Cracker (C) is an attack/assessment tool, not a production defensive platform, and it does not provide centralized alarm aggregation and automated enterprise countermeasures.

RFProtect (B) is a known wireless security/WIPS solution family, but the question’s feature set and wording (“adaptive,” APs used for passive scanning, controller-integrated countermeasures) most closely matches Cisco’s adaptive WIPS concept.

WatchGuard Wi-Fi Cloud WIPS (A) is a vendor-managed WIPS offering; while it can provide monitoring, the scenario stresses multi-controller aggregation into a central engine and coordinated campus countermeasures via WLAN infrastructure—again aligning best with Cisco’s controller/AP ecosystem.

Therefore, the best answer is D. Cisco Adaptive Wireless IPS.

In the CEH SQL injection methodology, the initial stages focus on understanding where and how user-controlled input enters the application and reaches backend components such as database queries. The activity described is reconnaissance and mapping of input vectors: Rachel is observing the shipment search function, watching HTTP GET parameters, and determining whether those parameters are processed in a way that could influence SQL logic. This directly corresponds to the phase commonly described as identifying data entry paths, where the tester locates all possible points of injection such as URL query strings, form fields, cookies, HTTP headers, and API parameters.

At this stage, the ethical hacker is not yet executing payloads to exploit the database. Instead, they are profiling the request structure, parameter names, values, and server responses to understand how the application behaves when supplied with different inputs. CEH guidance emphasizes that effective SQL injection testing begins by enumerating input sources and determining which of them appear to be reflected in server-side operations. Monitoring HTTP GET requests is a typical technique because query string parameters often map to backend search queries, filters, or record lookups, making them frequent injection candidates if server-side validation and query construction are weak.

The other options occur later. Launching SQL injection attacks involves actively injecting test characters and payloads to confirm injection. Database enumeration happens after a vulnerability is confirmed, to extract schema information and data. Advanced SQL injection refers to more specialized techniques such as out-of-band, time-based blind, or WAF evasion. Since the task here is identifying and assessing potential injection points, the correct step is identifying data entry paths.

The activity described is active footprinting because you are not merely listening for wireless broadcasts; you are transmitting crafted 802.11 management frames to elicit responses and gather information. In Wi-Fi reconnaissance, passive methods rely on monitoring beacon frames and other naturally occurring traffic. Active methods, by contrast, deliberately interact with the environment—often by sending probe requests or other management frames—to prompt access points or client devices to respond with details such as SSID, supported data rates, security capabilities, and other parameters.

The scenario explicitly states you “actively send crafted management frames” and then log “immediate responses (including probe responses and capability information).” That is the defining difference between active and passive wireless footprinting. Active footprinting can reveal SSIDs that may not be visible through beacons alone (for example, networks that do not broadcast SSID in beacons may still respond under certain conditions), and it can speed discovery by forcing responses rather than waiting for periodic broadcasts or client activity.

Why the other options are less accurate:

Passive footprinting (B) contradicts the scenario because passive recon involves no transmissions from the auditor’s device.

Wash command (C) refers to a specific tool/command typically associated with WPS enumeration workflows, not the general technique classification being asked here.

Network discovery software (A) is too generic; the question is asking for the technique (active vs passive), and the described behavior is clearly active.

Therefore, the correct answer is D. Active Footprinting.

This scenario precisely matches polymorphic malware, a type of advanced malware described in CEH v13 Malware Threats. Polymorphic malware dynamically alters its code, encryption, or signature each time it propagates, allowing it to evade traditional signature-based antivirus detection.

Additionally, the malware’s ability to remain dormant until triggered indicates logic-based activation, which is common in advanced threats designed to avoid sandbox detection.

CEH v13 emphasizes that polymorphic malware cannot be reliably detected using static signatures. Instead, organizations must rely on behavior-based detection, heuristic analysis, and advanced threat protection systems capable of identifying suspicious runtime behavior.

Options A, C, and D do not match the described behavior. Adware focuses on advertising. Worms self-propagate aggressively. Rootkits focus on stealth and persistence, not code mutation.

Therefore, Option B is the correct answer.

The correct answer is C, Bypass filters. In wireless network security, access points may use MAC address filtering to allow only devices whose MAC addresses are listed in the access point’s whitelist. CEH wireless-hacking material explains that MAC spoofing can be used to change a wireless adapter’s MAC address so it matches an allowed MAC address in the access point’s whitelist, thereby bypassing the MAC filter. This does not provide encryption, because encryption protects data confidentiality using cryptographic algorithms. It is also not IDS, because an intrusion detection system monitors and alerts on suspicious activity. Logging records events and activities, which is unrelated to changing a MAC address. MAC spoofing is an impersonation technique: the attacker observes or obtains a valid MAC address and configures their own interface to use it. Therefore, in the context of CEH wireless attacks and access control weaknesses, MAC spoofing is primarily used to bypass MAC-based access filters.

The system described is a Network-Based Intrusion Detection System because it is positioned near the perimeter firewall and inspects traffic flowing across the network segment rather than activity on a single endpoint. In CEH-aligned coverage, a NIDS is deployed at strategic network points such as behind a firewall, on core switches, or on SPAN or TAP links to monitor inbound and outbound packets. Its purpose is to detect suspicious patterns, signatures, protocol anomalies, and indicators of scanning or exploitation attempts across multiple hosts and an entire subnet. The question explicitly says it “analyzes incoming and outgoing traffic” and looks for patterns “across the entire subnet,” which matches NIDS scope and placement.

A Host-Based IDS, by contrast, runs on individual servers or workstations and monitors local events such as system calls, logs, file integrity, registry changes, and local network connections for that specific host. That does not match the perimeter-positioned, subnet-wide traffic analysis described. Host-based firewalls also operate per endpoint, enforcing rules for that machine only, and do not provide centralized subnet-wide packet inspection from a perimeter vantage point. A network-based firewall primarily enforces allow or deny policy and may perform stateful filtering, but it is not primarily described as a detection tool analyzing suspicious patterns; IDS is the detection-focused control.

Therefore, Olivia is attempting to bypass a Network-Based Intrusion Detection System to demonstrate how malicious traffic might evade monitoring controls placed near the firewall and to help the security team strengthen detection coverage and alerting.

The correct answer is A. Penetration test. In CEH methodology, a penetration test is an authorized security assessment that simulates the actions, methods, and techniques of a real attacker to determine what could be accessed, exploited, or controlled if an organization were attacked. CEH-aligned material states that penetration testing goes beyond vulnerability assessment by simulating a real attacker and evaluating the impact of exploitable weaknesses. It also explains that external penetration testing is performed from a remote external network and resembles a real hacker attempting to gain access to organizational resources over the Internet. This matches the wording “adversarial role” and “what an outsider can access and control.” A policy assessment is focused on policies, standards, and compliance, not attacker simulation. A high-level evaluation is broader and less technically adversarial. A network evaluation may examine network design or configuration, but it does not necessarily exploit weaknesses. Therefore, the best CEH answer is Penetration test.

CEH v13 describes Cross-Site Request Forgery (CSRF) as an attack in which an authenticated user ' s browser is tricked into submitting unauthorized actions to a trusted application without the user ' s intent. CSRF exploits the fact that browsers automatically include stored session cookies when sending requests to a domain the user is logged into. In this scenario, the attacker creates a malicious form that triggers an unwanted funds transfer. Since the application does not validate request origin, enforce CSRF tokens, or require secondary verification, it processes the attacker ' s forged request as if it came legitimately from the victim. CEH emphasizes that CSRF differs from XSS because no malicious script executes on the target website; instead, the attacker leverages the victim’s authenticated session. This is distinct from session fixation (Option A), replay attacks (Option B), and XSS (Option D). The described behavior aligns precisely with CSRF exploitation.

The correct answer is B because massive outbound HTTPS traffic is a strong indicator of data exfiltration, especially when it is designed to blend into normal web traffic. In CEH attack lifecycle concepts, exfiltration occurs after an attacker gains access and can quietly extract protected resources or sensitive data from the environment. The retrieved CEH-aligned material describes exfiltration as the phase where an attacker with elevated access can “quietly extract data,” and notes that exfiltration can occur silently. HTTPS is commonly allowed outbound in enterprise networks, so attackers may use it as a covert or low-noise channel to move stolen files, credentials, database dumps, or archives to an external server. The guide material also notes that malware often uses SSL over port 443 or other easy- to-hide mechanisms rather than obvious suspicious ports. DoS usually creates service disruption, scanning generates probing patterns, and reconnaissance focuses on information gathering. Massive hidden outbound HTTPS most likely indicates data exfiltration.

The CEH Malware Threats module defines polymorphic malware as malicious code that mutates its appearance (code, encryption, packing) each time it propagates, making signature-based detection ineffective. Dormancy and trigger-based activation are also common characteristics.

CEH emphasizes that behavior-based detection, sandboxing, and heuristic analysis are the most effective countermeasures against polymorphic threats.

Option D is correct.

Options A, B, and C do not address polymorphic evasion techniques.

The correct answer is C because using Java Random() for session tokens can create predictable tokens. Session tokens must be unpredictable because they identify authenticated user sessions. In CEH web application and session hijacking concepts, weak or simple session IDs allow attackers to guess or brute-force valid IDs and gain unauthorized access to the target application. CEH session hijacking material also explains that attackers may predict session IDs by observing currently used tokens, identifying constant and variable parts, and guessing the next token. Java Random() is a general-purpose pseudorandom generator, not a cryptographically secure random number generator, so it should not be used for authentication tokens. The secure approach is to generate long, complex, random session IDs and regenerate them after authentication or privilege changes. This is not session fixation, where an attacker forces a known session ID on a victim; not XSS, which injects browser-side scripts; and not CSRF, which abuses a victim’s authenticated browser actions.

A Rogue DHCP Server attack best fits the symptoms because it directly explains unexpected gateway changes, IP conflicts, and traffic redirection to deceptive portals. In CEH network attack coverage, DHCP is a foundational service that automatically provides clients with IP configuration such as IP address, subnet mask, default gateway, and DNS servers. If an attacker introduces a rogue DHCP server on the same broadcast domain, clients may accept leases from the rogue server—especially if it responds faster than the legitimate DHCP infrastructure. Once that happens, the attacker can push a malicious default gateway or DNS server to victims. This allows redirection of traffic, man-in-the-middle positioning, and phishing-style interception, which matches the “unfamiliar gateway settings” and “misleading login portals” described.

The mention of “temporary IP address conflicts” also aligns: a rogue server can hand out addresses that overlap with legitimate allocations, causing intermittent connectivity issues and failed connection attempts. While a DHCP starvation attack can create disruption by exhausting the DHCP pool, the key difference is outcome: starvation primarily denies service until a rogue server takes over. Here, the defining observable behavior is not just outage—it is misconfiguration and redirection, which points to the presence of a rogue DHCP server actively issuing malicious leases.

Packet sniffing alone would not change gateway settings, and MAC flooding is aimed at forcing switches to behave like hubs, not issuing IP configuration. Defensive controls include DHCP snooping, port security, network segmentation, and monitoring for unauthorized DHCP offers and anomalous lease patterns.

Cloud-based DDoS mitigation services provide upstream traffic scrubbing, detecting and filtering high-volume attacks such as DNS amplification and HTTP floods before the traffic reaches the victim’s network. These services use distributed infrastructures capable of handling multi-vector attacks that surpass the capacity of traditional on-premises firewalls and IDS. Traffic scrubbing centers distinguish legitimate traffic from malicious traffic, allowing normal operations to continue without service disruption.

The correct answer is C, Graphical Identification and Authentication DLL. GINA (Graphical Identification and Authentication) is a Microsoft Windows component historically responsible for handling interactive logon functions, including user authentication, secure attention sequences (such as Ctrl+Alt+Del), password changes, and user session management. In CEH system hacking and password attack topics, GINA is often discussed because attackers may attempt to replace or modify authentication-related components to capture user credentials. Malicious programs and credential-stealing tools have historically targeted the GINA mechanism to intercept usernames and passwords entered during the Windows logon process.

Understanding GINA is important in ethical hacking because it illustrates how authentication systems can be abused when attackers gain sufficient privileges on a system. Such attacks are closely related to credential theft, privilege escalation, keylogging, and persistence techniques. The other options are not valid security terms associated with Microsoft authentication architecture. Therefore, from a CEH perspective, GINA refers to the Graphical Identification and Authentication Dynamic Link Library used by older Windows operating systems to manage interactive authentication processes.

A bootkit is the rootkit type that best matches the described behavior because it compromises the system boot process and executes before the operating system fully loads, often before many security controls, drivers, and monitoring services start. CEH materials describe bootkits as a highly persistent class of malware that targets components such as the Master Boot Record, Volume Boot Record, or bootloader. By gaining execution at boot time, a bootkit can load malicious code very early, then hook or tamper with OS loading routines, kernel initialization, or security mechanisms. This early execution is exactly what the scenario emphasizes: the payload runs “before any system-level drivers or services are active,” enabling covert control while evading traditional user-mode detection.

This also explains why administrators see suspicious network activity but forensics do not easily find malicious user-level artifacts. Bootkits can hide by manipulating what the OS and security tools can see after startup, including concealing files, processes, registry keys, or even redirecting reads so scanners receive “clean” data. Because the malicious component is anchored in the boot chain, it can survive reboots and remain present even if many OS-level indicators are cleaned.

A kernel-mode rootkit operates within the OS kernel but typically loads after the OS begins booting and drivers initialize. A hypervisor rootkit relies on virtualization to sit beneath the OS at runtime, but the scenario specifically highlights boot-time execution prior to drivers and services. Firmware rootkits persist in BIOS/UEFI or device firmware, which is possible, but the most direct match to “boot process compromise below the OS” in CEH terminology is a bootkit.

The correct answer is C. Impersonation.

The scenario’s central action is that the assessor pretends to be a third-party IT technician to gain trust and physical access. CEH-aligned social engineering material defines impersonation as a technique where the social engineer pretends to be someone or something he or she is not, such as an employee, valid user, repairman, executive, help desk person, or IT security expert. This can result in physical access to restricted areas and disclosure of sensitive information, including credentials .

Option A. Shoulder Surfing is incorrect because shoulder surfing specifically involves looking over a user’s shoulder to observe credentials or sensitive activity. Although the assessor observes the environment, the primary technique used to gain access is impersonation.

Option B. Eavesdropping is incorrect because eavesdropping involves covertly listening to conversations or communications.

Option D. Dumpster Diving is incorrect because dumpster diving involves searching through trash or discarded materials for useful information. Sticky notes and printouts are mentioned, but the defining technique is the assumed identity of an IT technician.

Therefore, the best answer is C. Impersonation.

The correct answer is A. Stolen equipment. In CEH ethical hacking methodology, “stolen equipment” is a mode of ethical hacking that simulates theft of a critical information resource, such as a laptop owned by an important organizational user, and then provides that asset to the ethical hacker for assessment. The question specifically mentions targeting the CEO’s laptop or backup tapes to extract critical information, usernames, and passwords. These are classic examples of sensitive assets that may contain cached credentials, confidential documents, password hashes, VPN profiles, email archives, or backup copies of production data. This test evaluates whether protections such as full-disk encryption, strong authentication, secure backup handling, and data-at-rest controls are effective. “Physical entry” focuses on entering and compromising the organization’s facilities or ICT infrastructure, while “insider attack” simulates a trusted internal user abusing access. “Outsider attack” typically represents an external threat. Because the focus is on stolen laptops and backup media, the best CEH answer is stolen equipment.

The correct answer is A. ms-sql-m because TCP/1434 is commonly associated with Microsoft SQL Server Monitor / SQL Server Browser–related services, which are used to help clients discover SQL Server instances and their connection details. In standardized service naming, ms-sql-m corresponds to Microsoft SQL “monitor” functionality tied to instance discovery and related metadata exposure. When this port is reachable from networks where it is not needed, it can increase attack surface by exposing information that helps attackers identify database instances, target the correct ports, and focus exploitation attempts.

In the context of a legacy server that is “not listed in the company’s active inventory,” an open 1434 is a red flag because it suggests an unnecessary or unmanaged database discovery component may be running. Attackers often use exposed database-related ports for reconnaissance (identifying instance names, versions, and listening endpoints) and then pivot to authentication attacks or exploitation of known weaknesses. Even when the core SQL service port is controlled, discovery services can still leak useful environment details that lower the cost of an attack.

Why the other options are incorrect:

ms-sql-s typically refers to the primary Microsoft SQL Server service, most commonly associated with TCP/1433 (the default SQL Server port), not 1434.

sql*net is associated with Oracle SQL*Net/Net8 traffic, typically using Oracle listener ports such as 1521, not 1434.

sqlsrv is not the standardized assignment for 1434 in the way ms-sql-m/ms-sql-s are used for Microsoft SQL-related services.

Therefore, based on standardized port associations and the database discovery/monitoring role of this service, the exposure most likely indicates ms-sql-m on TCP/1434, and it warrants further review and potential restriction if not required.

An HTTP Flood attack is an Application Layer (Layer 7) DDoS attack, as defined in CEH v13. In this attack, the adversary sends a massive number of seemingly legitimate HTTP GET or POST requests to exhaust server resources such as CPU, memory, and application threads.

CEH v13 emphasizes that HTTP floods are difficult to detect because they mimic normal user behavior and often bypass traditional network-layer defenses.

Other attacks operate at lower layers:

ICMP, UDP, and SYN floods target network and transport layers.

This scenario describes a Slowloris attack, a classic application-layer DoS attack covered in CEH v13 Network and Perimeter Hacking. Slowloris works by opening many HTTP connections and sending data very slowly, preventing the server from closing the connections.

Because the connections appear legitimate, the server keeps them open, eventually exhausting its connection pool. This causes legitimate users to experience timeouts and service unavailability—exactly as described.

ICMP and UDP floods consume bandwidth, which was ruled out. Fragmentation attacks target packet handling, not application-layer sessions.

CEH v13 highlights Slowloris as particularly dangerous because it requires minimal bandwidth and bypasses many traditional DoS defenses. Therefore, Option A is correct.

The correct answer is D. Twofish because the question explicitly describes a symmetric cipher that: (1) works on 128-bit blocks, (2) supports keys up to 256 bits, and (3) was a finalist in the AES selection process intended to replace DES. Twofish matches all of these characteristics. It is a symmetric block cipher designed by Bruce Schneier and colleagues, and it was one of the five AES finalists (along with Rijndael, Serpent, RC6, and MARS). Twofish uses a 128-bit block size and allows key sizes of 128, 192, or 256 bits, aligning precisely with the “up to 256-bit keys” clue.

Why the other choices do not fit: RC4 is a stream cipher, not a 128-bit block cipher, and it is not an AES finalist. AES itself (Rijndael) is the algorithm that ultimately won the AES competition; the prompt says the algorithm was a finalist, not necessarily the winner, and the description is intended to distinguish a finalist option from AES itself. Blowfish supports variable key lengths up to 448 bits but uses a 64-bit block size, not 128-bit blocks, and it was not an AES finalist (Twofish was designed as Blowfish’s successor with a larger block size to address modern requirements).

In practical terms, the block size and key size characteristics matter for security and performance: 128-bit blocks are standard for modern symmetric encryption, and 256-bit keys provide a high security margin for long-term protection of sensitive logs. The mention of AES finalization also signals that this algorithm belongs to the same generation of modern block ciphers designed with strong resistance to cryptanalysis and efficient software/hardware implementation.

Therefore, based on the stated properties and its AES finalist status, the symmetric encryption algorithm is Twofish.

The correct answer is A. Creepy because the task is specifically about extracting and analyzing geolocation information (geotags) from publicly shared media and mapping that data to real-world locations to infer employee movement patterns. In CEH-aligned reconnaissance/OSINT workflows, geolocation intelligence is a common element of footprinting because it can reveal sensitive operational details such as office locations, travel routines, meeting venues, home addresses, and patterns of presence/absence. Tools designed for geolocation OSINT help testers identify whether staff are unintentionally exposing location metadata through social media posts, uploaded photos, or other public sources.

Creepy is purpose-built for geolocation reconnaissance: it collects location metadata associated with content and presents results in a way that supports mapping and timeline-style analysis, helping analysts correlate people, posts, and coordinates. This directly supports the goal of evaluating whether employees are disclosing sensitive information about office routines by publishing geotagged images. When used in an authorized assessment, such tooling helps demonstrate risk in a measurable way—for example, showing clusters of posts around a specific building, repeated visits at predictable times, or regular travel routes that could support surveillance, targeted social engineering, or physical intrusion planning.

Why the other options are less suitable: Social Searcher is primarily used for monitoring and searching social media content by keywords, usernames, hashtags, and mentions; it is useful for broad OSINT collection but is not specifically focused on geotag extraction and movement mapping. Sherlock is designed to find a username across many platforms, helping link identities, but it does not specialize in geolocation mapping. Maltego is a powerful link-analysis platform that can correlate entities (people, domains, emails, social profiles) and can support OSINT investigations, but for the narrow requirement of extracting and mapping geotagged location data from media, Creepy is the most direct and purpose-specific tool.

Therefore, the best tool for this geotagged image movement analysis task is Creepy.

The scenario emphasizes that Daniel “begins capturing and reviewing live network traffic” to identify unauthorized session behaviors. In CEH-aligned network analysis practice, the most direct method to confirm session hijacking when you already have a packet capture is manual packet analysis using packet sniffing tools. By inspecting live traffic, Daniel can correlate sessions, verify whether multiple sources are reusing the same session identifiers, identify abnormal TCP sequence and acknowledgment behavior, and detect patterns such as duplicated cookies/tokens, replayed requests, inconsistent client IP or user-agent shifts, or sudden session reuse across hosts. This approach provides evidentiary detail beyond an alert and allows validation before escalation.

An IDS can be helpful, but it is a detection system that generates alerts based on signatures or anomalies; it does not inherently “confirm” the issue unless it provides clear supporting evidence, and the question specifically frames Daniel’s action as hands-on traffic review. Checking for predictable session tokens is a preventive and diagnostic step for weak session management design, but it does not directly confirm an in-progress hijacking event from observed network behavior. Monitoring for ACK storms can indicate certain TCP-level hijacking/desynchronization conditions, but it is narrower and may not apply to application-layer session hijacking, which is far more common in enterprise environments and would be validated by inspecting session identifiers and request flows in the capture.

Therefore, given the described workflow and the need to confirm unauthorized session activity from live traffic, CEH methodology aligns best with manual packet analysis using sniffing tools.

The objective is to conduct passive reconnaissance for potentially exposed administrative documents on .onion sites, using advanced search operators. The query should therefore (1) restrict results to the hidden-network domain space, (2) focus on document formats likely to contain internal material, and (3) use a title/header hint that aligns with management or administration content.

Option C is the best match because it combines:

site:onion to constrain results to .onion resources (the target environment of concern),

filetype:pdf to focus on a common format for internal documents (policies, reports, procedures, administrative exports), and

intitle: " admin access " to search for pages/files whose title/header metadata indicates administrative relevance. Using intitle aligns with the requirement to look for files “with headers suggesting management-related content,” because titles are a practical proxy for document headers and indexing metadata.

By comparison, A does not include site:onion, so it is not scoped to hidden services, and it targets “credentials” rather than administrative documents. B includes site:onion and filetype:pdf, but the title focus is “secure login,” which is more likely to find authentication pages or generic security guidance rather than administrative document exposure. D is also plausible (docx + user accounts), but “user accounts” tends to point to account lists or HR-style docs rather than broader administrative access documentation, and PDFs are frequently used for formal administrative documentation and may be more commonly indexed.

Thus, C best satisfies the passive, targeted reconnaissance requirement for admin-related documents on .onion sites.

The correct answer is B, Hacktivists. In CEH hacker-classification concepts, hacktivists are attackers who use hacking techniques to support a social, religious, ideological, or political cause. CEH-aligned material describes hacktivism as actions intended to put forward a cause or political agenda, affect societal change, or highlight perceived political injustice. Another CEH-aligned explanation states that these individuals may hack servers, deface websites, create viruses, and cause disruption because they believe their actions will force social change or bring attention to an issue. Gray hat hackers may reveal vulnerabilities without permission, but their primary motivation is not necessarily social change. Ethical hackers, or white hats, work defensively with authorization and prior consent, not through illegal defacement. Black hat hackers usually act for malicious intent, personal gain, data theft, or service disruption. Therefore, the group specifically associated with hacking and website defacement to promote social or political change is Hacktivists.

The correct choice is the SOA record because it uniquely provides authoritative administrative and operational metadata about a DNS zone. In CEH reconnaissance techniques, DNS enumeration is a high-value passive and semi-passive method to learn about an organization’s infrastructure without actively attacking hosts. The Start of Authority record defines core parameters of the zone and identifies the primary authoritative name server for that domain. Most importantly for this question, the SOA record contains fields that directly match “serial number and refresh interval,” which are classic SOA elements used for zone replication and synchronization behavior between primary and secondary DNS servers.

An SOA record typically includes the primary name server, the responsible party field often formatted like an email address for the zone administrator, the zone serial number, and timing values such as refresh, retry, expire, and minimum TTL. These details can reveal change frequency, operational practices, and sometimes administrative contact clues, all of which are relevant in reconnaissance and reporting.

The other record types do not meet the requirement. MX records identify mail exchangers for the domain but do not include serial or refresh parameters. NS records list authoritative name servers but lack administrative timing metadata. TXT records store arbitrary text such as SPF, DKIM, DMARC, or verification strings and are useful for email security posture analysis, but they do not provide the zone control fields the question references. Since the question explicitly calls out serial and refresh interval, the SOA record is the only option that fits completely.

Covert channel communication is one of the most sophisticated evasion techniques described in CEH v13 Evasion Techniques. By embedding malicious data within unused or rarely inspected protocol fields (such as IP headers), attackers can bypass firewalls, IDS, and IPS systems entirely.

Unlike polymorphic malware (Option C), which can still be detected using behavior analysis, covert channels blend seamlessly into legitimate traffic. Packet fragmentation (Option D) is well-known and often mitigated. Honeypot spoofing (Option B) is rare and defensive in nature.

CEH v13 emphasizes that covert channels are difficult because:

They do not violate protocol specifications

They evade signature-based and stateful inspection

They appear as normal traffic

Detecting covert channels often requires deep protocol analysis and statistical traffic inspection, making them extremely challenging to mitigate.

Thus, Option A is the correct answer.

TCP port 1433 is the well-known default port for Microsoft SQL Server, formally registered as ms-sql-s. In CEH network and perimeter security coverage, identifying services by their default port assignments is a critical reconnaissance and defensive skill. When reviewing firewall rules and exposed services, analysts correlate open ports with their associated protocols to determine risk exposure. Port 1433 is widely recognized as the primary listening port for Microsoft SQL Server instances configured with default settings.

The presence of an undocumented virtual machine actively handling traffic on port 1433 is particularly concerning because database services often store sensitive operational or customer data. If exposed unnecessarily, SQL Server can be targeted for brute-force authentication attacks, SQL injection exploitation, misconfiguration abuse, or exploitation of unpatched vulnerabilities. CEH materials emphasize that database services should not be directly exposed to the internet unless absolutely necessary and must be protected by strict access controls, segmentation, encryption, and monitoring.

Option B, SqlNet, typically refers to Oracle database communication over port 1521. Option D, ms-sql-m, is associated with SQL Server Browser service over UDP 1434, not TCP 1433. Option A, sqlsrv, is not the formal IANA-registered service name for port 1433. Because ms-sql-s is the standard designation for Microsoft SQL Server on TCP port 1433, and given the risk of exposing database services, this finding warrants immediate escalation and review.

CEH reconnaissance and enumeration modules explain that LDAP services often support anonymous binding by default unless explicitly disabled. Anonymous bind allows unauthenticated users to query certain directory attributes, which can lead to disclosure of usernames, organizational hierarchy, and email addresses—critical information for password attacks, phishing campaigns, and privilege escalation planning. In the scenario described, the tester obtained directory data without providing any credentials, demonstrating that anonymous bind permissions were enabled. LDAPS requires TLS encryption and authentication, which contradicts the observed access. Kerberos authentication mandates valid credentials. LDAP via RADIUS is used for authentication integration, not for information disclosure. Since the query was successful with no authentication and no access controls triggered, this aligns exactly with CEH’s description of anonymous LDAP binding.

This scenario describes Differential Cryptanalysis, a powerful cryptanalytic technique covered in CEH v13 Cryptography. Differential cryptanalysis focuses on analyzing how small changes in plaintext input affect the resulting ciphertext output, with the goal of uncovering patterns related to the secret encryption key.

CEH v13 explains that symmetric algorithms rely on complex transformations—such as substitution and permutation—to obscure relationships between plaintext and ciphertext. However, in some algorithms, predictable differences may propagate through encryption rounds in a way that reveals statistical biases. By carefully selecting pairs of plaintext inputs with controlled differences and comparing the resulting ciphertexts, attackers can infer information about intermediate states and eventually the encryption key.

This method does not attempt every possible key (brute force), nor does it rely on execution timing or system performance metrics (timing attacks). It also differs from chosen-ciphertext attacks, which involve submitting chosen ciphertexts for decryption rather than observing encryption behavior.

Differential cryptanalysis was instrumental in breaking early block ciphers and is a key reason why modern algorithms like AES are designed with resistance to differential attacks. CEH v13 emphasizes that understanding this attack is critical for evaluating the strength of symmetric encryption algorithms and their internal structure.

Therefore, Option A accurately describes the technique being employed.

This scenario demonstrates tailgating, which is gaining unauthorized physical access to a secure area by following an authorized person through an access-controlled entry point. Priya does not present credentials, swipe a badge, or otherwise authenticate; instead, she leverages normal human behavior and social assumptions during a busy shift change. Because employees assume she belongs there and do not challenge her, she successfully bypasses the physical access control.

Tailgating is common in workplaces with high traffic, open-plan culture, or weak enforcement of “no badge, no entry” rules. Attackers may exploit politeness, distraction, or the desire to hold doors open. It is especially effective during shift changes, deliveries, or when people are carrying items and appreciate someone holding the door. The security weakness being tested here is not the badge technology itself but the human factor: lack of challenge culture and inconsistent adherence to access policies.

Tailgating versus piggybacking: in many security references, piggybacking implies the authorized person knowingly allows the other to enter (e.g., holds the door intentionally after being asked). Tailgating typically implies the intruder enters without explicit permission, often by slipping in behind a group. In this scenario, no one confronts her and they “assume she belongs there,” indicating she is following them in without asking or being granted explicit permission—tailgating.

The other options are unrelated: shoulder surfing is visual observation of sensitive input; dumpster diving is retrieving information from trash. Therefore, the correct answer is C. Tailgating.

CEH v13 details the standard penetration testing workflow, where confirmed critical vulnerabilities—especially those affecting core systems like database servers—should be prioritized for exploitation only after verification and when explicitly permitted by the rules of engagement. Exploiting a known vulnerability using vetted tools (e.g., Metasploit, CVE-specific exploits) provides evidence of real-world risk and validates the severity rating. Brute-forcing logins (Option B) is inefficient and often outside scope. Ignoring a critical vulnerability (Option C) violates CEH’s prioritization guidelines. A DoS attack (Option D) is never appropriate unless the engagement explicitly authorizes destructive testing, which is rare. CEH stresses that high-impact vulnerabilities should be exploited to demonstrate business risk, privilege escalation potential, data exposure, or lateral movement possibilities—making Option A fully aligned with CEH methodology.

The correct classification is Potentially Unwanted Applications (PUAs). In CEH malware taxonomy, PUAs refer to software that is not strictly malicious in the traditional sense but exhibits undesirable behavior such as displaying intrusive advertisements, modifying browser settings, collecting user data, degrading system performance, or bundling with other freeware without clear user awareness. In this scenario, the toolbar and optimization tool were bundled with a legitimate utility installer and presented with vague descriptions—an extremely common PUA distribution method known as software bundling.

The symptoms described—pop-up ads, homepage modification, sluggish performance, and background data transfers—are consistent with adware or browser hijackers, which fall under the broader PUA classification. Importantly, the question specifies there is no immediate file encryption (which would suggest ransomware) and no self-replication (which would suggest a worm). Botnet agents typically establish command-and-control communication and are designed for coordinated malicious activity such as DDoS or spam campaigns; while unexplained traffic may raise suspicion, the described behavior aligns more closely with adware-style monetization rather than structured botnet activity. Logic bombs are dormant code triggered by specific conditions, which is not indicated here.

From a defensive perspective, CEH recommends secure software acquisition policies, user awareness training, disabling unnecessary bundled installations, implementing endpoint protection with PUA detection enabled, and enforcing application allowlisting to prevent unauthorized or bundled software from executing within the enterprise environment.

CEH explains that hash functions alone, such as SHA-256, only provide integrity checks and do not verify authenticity or non-repudiation. Attackers can modify data and recompute the hash.

Digital signatures combine hashing with asymmetric cryptography, ensuring:

Integrity

Authentication

Non-repudiation

Option D is correct.

Options A and B provide confidentiality, not integrity assurance.

Option C secures communication channels, not standalone data integrity.

CEH explicitly recommends digital signatures for protecting data integrity against tampering.

The correct answer is Information warfare. CEH introductory security coverage explains that information warfare involves coordinated use of information systems, influence operations, disruption, deception, and attacks on digital infrastructure to affect perception, decision-making, and institutional stability. The question includes manipulation of digital media, disruption of communications, and degradation of critical systems, all aimed at weakening a target without traditional military confrontation. That broad strategic combination goes beyond cyber espionage, which focuses on covert intelligence collection, and beyond hacktivism, which is typically ideologically motivated digital protest or disruption. Cyberterrorism can involve fear and critical infrastructure attacks, but the scenario is framed more comprehensively around coordinated influence and infrastructure effects as part of a broader conflict model. CEH materials use information warfare to describe conflict conducted through control, corruption, disruption, or weaponization of information and information systems. Because the activities target both perception and operational capability at a national scale, the most accurate classification is Information Warfare.

CEH IoT security modules describe insecure network services as vulnerabilities arising when IoT devices communicate over unencrypted channels, use unauthenticated update mechanisms, or expose services that fail to validate data integrity. When operational commands and firmware updates are transmitted over HTTP without cryptographic safeguards, attackers can intercept, replay, or modify the data stream. Firmware integrity verification is a critical component of secure device lifecycle management. Without it, adversaries can perform firmware injection, allowing them remote control, persistent compromise, or sabotage of device functionality. This aligns directly with insecure network services, which CEH defines as improperly protected communication mechanisms and service interactions within IoT ecosystems. Insecure ecosystem interfaces generally relate to cloud APIs and web dashboards, insecure default settings involve weak credentials or factory configurations, and insufficient privacy protection relates to data confidentiality rather than command manipulation. The described scenario most clearly fits insecure network services.

The correct answer is A. Honey trap. In CEH social engineering concepts, a honey trap is a technique in which an attacker creates a fake attractive identity, often on social media or dating platforms, to build emotional trust with a target. The attacker then uses that trust to extract sensitive personal, corporate, or security-related information.

In this scenario, Steve created a fake social media profile and used an appealing profile picture and description to attract Stella. Once Stella accepted the request and began communicating with him, Steve gradually asked questions about her company and collected important organizational information. This matches the honey trap method because the attacker used attraction, trust, and manipulation to obtain confidential information.

Option B, diversion theft, involves redirecting deliveries or information to the wrong location. Option C, piggybacking, means gaining physical access by following an authorized person. Option D, baiting, uses an enticing object or offer, such as infected USB media, to lure victims. Therefore, the best answer is Honey trap.

The correct answer is D, BOLA, or Broken Object Level Authorization. This occurs when an API accepts an object identifier supplied by the user, such as an account ID, order ID, invoice ID, or user ID, but fails to verify whether the authenticated user is authorized to access that specific object. CEH web application hacking material describes this same weakness as an authorization flaw/insecure direct object reference: an application uses IDs to distinguish users, and an attacker changes an ID value in the request to access another user’s profile. CEH material also explains that unauthorized access to another user’s resources represents horizontal privilege escalation and that function-level access issues occur when the application does not check authorization before returning protected information. Mass assignment involves binding unexpected fields, XSS involves script injection, and SQLi involves malicious database queries. The key issue here is missing object-level authorization, so BOLA is the best answer.

In CEH v13 Information Security and Ethical Hacking Overview, script kiddies are defined as individuals with limited technical knowledge who rely on pre-written tools, scripts, and exploits created by others to carry out attacks. They typically lack a deep understanding of how the underlying exploits work.

CEH v13 categorizes attackers based on skill level and intent. Script kiddies sit at the lower end of the skill spectrum. They often download exploit kits, automated scanners, or attack frameworks and run them with minimal customization. While their attacks may be unsophisticated, they can still cause damage due to the availability of powerful tools.

Option B accurately reflects this definition. Options A and D describe skilled attackers or programmers, which contradicts the CEH classification. Option C is incorrect because ethical hackers use tools responsibly with authorization and possess a strong understanding of security principles.

CEH v13 emphasizes that although script kiddies are less skilled, they pose a risk because automation allows them to exploit known vulnerabilities at scale. This is why organizations must patch systems promptly and implement baseline security controls.

Thus, Option B is the correct answer.

The correct answer is D, Pass-the-hash. In a pass-the-hash attack, the attacker does not need to crack or know the plaintext password. Instead, the attacker reuses a captured or extracted NTLM hash as an authentication credential to access another Windows system or server. CEH system hacking and password attack material describes this concept directly: the attacker steals the hash and sends it instead of cracking the password, allowing Windows authentication to treat the hash as valid credentials. CEH password attack material also describes hash injection, where extracted logon hashes from SAM or memory are used to log on to other servers and exploit more accounts. Brute force attempts many password guesses, Kerberoasting targets Kerberos service tickets, and replay is a broader category but not as precise here. Because the question specifically mentions reused NTLM hashes without cracking passwords, the exact attack is pass-the-hash.

In CEH v13 Cloud Computing, serverless architectures introduce unique security challenges, particularly around Function-as-a-Service (FaaS) permissions. When a serverless function is compromised through an insecure third-party API, the damage depends largely on what the function is allowed to do.

Implementing function-level permission models and enforcing the principle of least privilege ensures that even if a function is exploited, its ability to execute malicious actions is strictly limited. CEH v13 strongly emphasizes granular IAM controls in serverless environments.

While cloud-native security platforms (Option A) and CASBs (Option C) provide visibility and governance, they do not directly prevent excessive permissions. Regular patching (Option D) is important but does not mitigate permission abuse.

CEH v13 identifies least privilege as the single most critical control in preventing serverless abuse and privilege escalation. Therefore, Option B is the correct answer.

The CEH DDoS Mitigation Strategies section explains that load balancing distributes traffic across multiple servers or infrastructure components to prevent any single resource from being overwhelmed.

By using hardware load balancers and cloud-based traffic distribution, organizations can:

Absorb large volumes of attack traffic

Maintain service availability

Ensure legitimate users are served

Option B is correct and directly matches CEH’s definition.

Option A drops all traffic, including legitimate requests.

Option C focuses on traffic analysis rather than distribution.

Option D limits traffic rather than distributing it.

CEH strongly recommends load balancing as a core DDoS resilience mechanism.

This scenario represents a classic baiting attack, a social engineering technique explicitly described in CEH v13 Social Engineering. In baiting, attackers exploit human curiosity or greed by leaving behind a malicious physical device—most commonly a USB drive—with an enticing label. When the victim plugs the device into a system, malware is automatically executed, leading to compromise.

Option A precisely captures this behavior. The label “Employee Salary Info 2024” is intentionally designed to entice the victim into interacting with the device. CEH v13 highlights USB baiting as particularly dangerous because it bypasses technical controls and relies solely on human behavior.

Option B describes pretexting, which involves impersonation. Option C refers to dumpster diving. Option D describes tailgating, a physical access attack. None of these match the USB-based lure described.

CEH v13 emphasizes that baiting attacks are highly effective in corporate environments and recommends strong security awareness training and disabling USB autorun features as mitigation.

The correct answer is C. Preparation.

The activity described occurs before credential abuse, lateral movement, persistence, or internal expansion. The adversary is gathering intelligence, mapping exposed services, preparing exploit frameworks, and testing malware against defensive tools. These actions represent the pre-attack preparation stage of an Advanced Persistent Threat.

APT activity is characterized by defined objectives, long-term probing, advanced resources, specialized skills and methods, and a high tolerance for remaining undetected . The scenario clearly describes these characteristics: the attacker spends months gathering intelligence, building tools, testing malware, and preparing a coordinated attack plan.

Option A. Persistence is incorrect because persistence occurs after initial access, when the attacker establishes a way to maintain access to the compromised environment.

Option B. Expansion is incorrect because expansion involves moving deeper into the environment, escalating privileges, or spreading laterally after compromise.

Option D. Initial Intrusion is incorrect because initial intrusion refers to the first successful compromise of the target environment. The scenario specifically states that these activities occurred before credential abuse or lateral movement.

Therefore, the best answer is C. Preparation.

According to the Certified Ethical Hacker (CEH) attack methodology, once reconnaissance, footprinting, and website mirroring have been completed, the attacker proceeds cautiously to exploitation while maintaining stealth. CEH documentation emphasizes that low-noise, application-layer attacks are preferable when the objective is to minimize detection.

Option B, attempting SQL Injection, aligns directly with CEH’s Web Application Hacking module. SQL Injection is a server-side attack that can often be executed through normal-looking HTTP requests, making it less likely to trigger intrusion detection systems (IDS) or security alerts. CEH materials highlight SQL injection as a common and effective technique for extracting sensitive data such as usernames, passwords, and business-critical information without disrupting server operations.

Option A is incorrect because immediately modifying server configuration files after session hijacking significantly increases the risk of detection. CEH guidelines stress post-exploitation restraint, especially during red team operations.

Option C is not ideal at this stage because automated vulnerability scanners generate substantial traffic and are highly detectable. CEH explicitly notes that vulnerability scanning is noisy and often logged.

Option D is the least stealthy option. Brute-force attacks generate numerous failed authentication attempts, triggering security alerts and account lockouts. CEH classifies brute-force attacks as high-risk and easily detectable.

Therefore, SQL Injection represents the most effective and stealthy next step in accordance with CEH’s structured attack lifecycle.

Password cracking is a core component of the system hacking phase. CEH materials highlight that once password hashes are obtained, attackers often perform offline cracking to avoid detection and bypass account lockout policies. Tools like Hashcat make use of hardware acceleration—specifically, GPU or multi-core CPU computing—to significantly increase cracking throughput. Hardware acceleration allows the system to perform thousands to millions of hash calculations simultaneously, dramatically improving cracking efficiency compared to traditional CPU-bound methods. While dumping SAM contents is part of credential extraction, it is not the optimization described in the scenario. Dictionary rules influence cracking strategy but not raw speed. NetBIOS spoofing is unrelated to password cracking. The emphasis here is on maximizing computational power to accelerate the hash-cracking process, aligning directly with CEH’s explanation of hardware-accelerated offline cracking techniques.

Wireshark is the primary packet-sniffing tool covered in CEH v13 Network Sniffing. It captures and analyzes live traffic, allowing analysts to view plaintext HTTP packets.

Nessus is a vulnerability scanner, Nmap is for scanning, Netcat is a networking utility. None provide protocol-level inspection like Wireshark.

Thus, Option D is correct.

The behavior described is a textbook indicator of time-based blind SQL injection. In CEH methodology for web application hacking, blind SQL injection is used when the application does not return database errors, query results, or verbose messages to the attacker. Instead of extracting data directly through displayed output, the attacker infers true or false outcomes by observing indirect side effects.

Here, the crafted input appends a conditional test about the database name’s first character. When the condition is true, the page response becomes “significantly longer,” which implies the injected payload triggers a database delay function or a time-consuming operation. This deliberate time difference becomes the communication channel: a longer response indicates “true,” while a normal response indicates “false.” By repeating such tests character-by-character, an attacker can enumerate sensitive values like database names, table names, and sometimes credentials—despite the application showing no errors or returned data.

This differs from Boolean-based blind SQL injection, where the inference is made through visible page content changes (for example, one response page looks different or contains different text when the condition is true). It also differs from UNION-based SQL injection, which relies on combining queries to return data in the application’s response, and error-based SQL injection, which depends on database error messages leaking information. Because the only observable signal here is response time, CEH classifies it specifically as time-based blind SQL injection. Defensive controls include parameterized queries, input validation, least-privilege database accounts, and WAF rules to detect time-delay functions and abnormal query patterns.

The correct choice is C because Nessus Essentials is fundamentally a vulnerability assessment scanner. Its core purpose is to identify security weaknesses by checking systems and services against a large vulnerability knowledge base, which includes detecting outdated or vulnerable versions of operating systems, server software, databases, web servers, and common network services. In practical scanning, Nessus performs remote checks such as banner/version identification, configuration and patch-level assessment (where possible), and vulnerability plugin checks to flag software releases that are known to be insecure or end-of-life. This directly matches the scenario emphasis: supporting “diverse technologies including operating systems, databases, web servers, and virtual environments,” and asking for a capability it provides “as part of its scanning process.”

Why the other options are incorrect:

A (Patch management) is not what Nessus Essentials is designed to do. Nessus identifies missing patches and vulnerabilities, but it does not serve as an operating system and third-party application patch deployment platform.

B (High-speed asset discovery) is more characteristic of dedicated asset discovery/attack surface tools or broader platform features; while Nessus can discover hosts during scans, “high-speed asset discovery” is not the defining, primary capability being tested here.

D (Agent-based detection) refers to endpoint agents running locally for continuous monitoring. Nessus Essentials is primarily used for scanner-driven vulnerability assessment; agent-based functionality is a separate approach/tooling concept and not the main Essentials scanning capability being targeted in this question.

Therefore, the best answer is C: Nessus Essentials is designed to scan and identify vulnerabilities, including detecting outdated/vulnerable versions across many server and service technologies.

Comprehensive and Detailed Explanation From CEH v13 Guide Topics:

The correct answer is D. SYN. TCP (Transmission Control Protocol) establishes reliable communication between a client and a server through a process known as the three-way handshake. This mechanism ensures that both parties are ready to communicate and agree on sequence numbers before data transfer begins.

The three steps are:

SYN (Synchronize): The client initiates the connection by sending a TCP packet with the SYN flag set to the server. This packet contains the client ' s initial sequence number (ISN).

SYN-ACK (Synchronize-Acknowledge): The server responds with a packet containing both SYN and ACK flags. This acknowledges the client ' s request and provides the server ' s own sequence number.

ACK (Acknowledge): The client sends an ACK packet back to the server, confirming receipt of the server ' s sequence number. At this point, the TCP connection is established and data transmission can begin.

Option A (RST) is used to reset or terminate a connection. Option B (ACK) is used to acknowledge received packets but does not initiate a connection. Option C (SYN-ACK) is sent by the server as the second step of the handshake, not by the client to begin it.

Understanding the TCP three-way handshake is fundamental in CEH network security topics because many attacks, such as SYN flooding, exploit this connection establishment process. Therefore, the client begins the negotiation by sending a SYN packet.

The correct answer is A. Enumerating IAM Roles.

The scenario describes a tester who is examining identity entities, attached policies, permission boundaries, and levels of access across cloud resources. These are all functions of Identity and Access Management (IAM). In the CEH cloud security context, cloud security management includes Governance, Risk Management, and Compliance (GRC), Identity and Access Management (IAM), and Patch and Configuration Management, which are used to control secure access to cloud resources .

Enumerating IAM roles is the best match because IAM roles define what identities can do, which policies are attached, and what privileges can be assumed or exercised. A cloud assessment reference also lists IAM checks such as identifying IAM users and roles using aws iam list-users and aws iam list-roles, and reviewing permissions using aws iam get-policy .

Option B. Enumerating S3 Buckets is incorrect because S3 enumeration focuses on storage buckets, permissions on buckets, public exposure, encryption, and logging. It does not primarily identify identity-policy relationships.

Option C. Enumerating EC2 Instances is incorrect because EC2 enumeration focuses on virtual machines, instance metadata, AMIs, regions, security groups, and running compute resources. It does not directly map to querying identity entities and attached policies.

Option D. Enumerating Serverless Resources is incorrect because serverless enumeration focuses on functions, triggers, event sources, and execution configurations. Although serverless functions may use roles, the question’s main focus is identity entities and their permissions, which makes IAM role enumeration the most precise answer.

Therefore, the best answer is A. Enumerating IAM Roles.

The correct answer is D. ldapsearch -h < host > -x -s base namingContexts.

The goal is to query the directory server’s root DSE for exposed naming contexts. The -x option performs simple authentication, -s base limits the search scope to the base object, and namingContexts requests the attribute that lists available naming contexts, such as domain and configuration partitions.

CEH-aligned LDAP enumeration material explains that LDAP directory services provide information about users, systems, networks, services, and organizational structure, and that LDAP enumeration can reveal domain and directory details useful for later targeting .

Option A is incorrect because it assumes a known base DN before discovering the naming contexts.

Option B is incomplete because it does not request the naming context attribute.

Option C also assumes the base DN is already known.

Option D is correct because it retrieves base-level naming context information before deeper LDAP searches.

Therefore, the best answer is D. ldapsearch -h < host > -x -s base namingContexts.

The Certified Ethical Hacker (CEH) Web Application Security module emphasizes that client-side controls cannot be trusted.

Disabling JavaScript allows attackers to bypass:

Password complexity enforcement

CAPTCHA validation

Input validation logic

Option B is the simplest and most effective CEH-approved method.

Option A is unnecessary and noisy.

Option C risks detection.

Option D is effective but more complex and detectable.

CEH explicitly teaches testers to disable JavaScript to evaluate server-side enforcement.

The correct answer is C because the activity described is specifically known as dumpster diving. In CEH social engineering and reconnaissance concepts, dumpster diving refers to searching through an organization’s discarded materials to obtain sensitive or useful information. Attackers may look for printed documents, network diagrams, employee lists, invoices, sticky notes, password reminders, hardware labels, old storage media, or other items that reveal details about the target environment. Although this activity can support intelligence gathering and reconnaissance, those terms are broader phases or objectives. Social engineering is also a broader category that includes manipulating people or exploiting human behavior, and dumpster diving is commonly treated as one technique within that area. The question asks what best describes the exact activity of going through a company’s garbage, so the most precise option is dumpster diving. Organizations reduce this risk by enforcing secure disposal practices such as shredding documents, sanitizing media, locking trash areas, and training employees on information handling.

In the Aircrack-ng suite referenced throughout CEH wireless hacking coverage, Aireplay-ng is the tool used to inject frames into a wireless network. The key phrase in the question is “transmit packets that force client devices to disconnect and reconnect.” That describes a deauthentication attack, where the tester sends 802.11 deauth frames to a client or to the access point, causing the client to drop its association and then reconnect. When a WPA2 client reconnects, the WPA2 four-way handshake is performed again. By forcing this reconnection, an ethical hacker can capture the handshake and later attempt password recovery in an offline process.

Airodump-ng is primarily a passive capture and monitoring tool used to list access points and clients, hop channels, and capture packets and handshakes, but it does not perform packet injection itself. Aircrack-ng is the cracking component that attempts to recover the WPA/WPA2 pre-shared key from a captured handshake using a wordlist or other offline techniques; it is not the tool that kicks clients off the network. Airbase-ng is used for creating a rogue access point or conducting evil twin style attacks, which is different from transmitting deauthentication frames to trigger a handshake.

Therefore, the tool that matches the described action of actively sending frames to force disconnect and reconnect is Aireplay-ng.

SMS Phishing, commonly called smishing, is the correct answer because the attack method is a deceptive text message sent to mobile devices that lures recipients into clicking a malicious link. In CEH-aligned social engineering coverage, smishing is a direct extension of phishing that uses SMS as the delivery channel. The attacker typically creates urgency or authority, such as “critical account update needed,” to trigger fast compliance. The message then pushes the victim to a malicious URL that can deliver malware, prompt credential entry, or enroll the device into a monitoring or management profile depending on platform and permissions. The key indicators in the question are company phones, a crafted message, and a link that installs monitoring software, which fits smishing exactly.

Bluebugging is a Bluetooth-based attack where the attacker exploits Bluetooth weaknesses to gain unauthorized access to a device, read data, place calls, or send messages, and it does not rely on sending a deceptive SMS link. Call spoofing is manipulating caller ID to impersonate a trusted number during voice calls, not delivering a malicious installation link through text. OTP hijacking focuses on intercepting or tricking users into revealing one-time passwords, often through SIM swapping, malware, or real-time phishing, but the scenario emphasizes installing monitoring software through a link rather than capturing a one-time code.

Defenses highlighted in ethical security training include mobile security awareness, blocking unknown links, using mobile threat defense, restricting app installation from untrusted sources, enforcing MDM controls, and monitoring SMS-based social engineering indicators.

According to CEH v13 Security Operations and Incident Response, zero-day vulnerabilities pose one of the highest operational risks because exploits exist before official remediation is available. When active exploitation is observed and no vendor patch exists, immediate compensating controls must be deployed.

The first and most effective action is implementing virtual patching, typically through a Web Application Firewall (WAF) or Intrusion Prevention System (IPS). CEH v13 defines virtual patching as a security measure that blocks exploitation attempts at the network or application layer without modifying the vulnerable software. This approach allows organizations to maintain service availability while reducing exposure.

Shutting down the server (Option A) may prevent exploitation but introduces unacceptable business disruption and is not recommended as a first response. Backups and incident response planning (Option C) are critical but do not actively prevent exploitation. Passive monitoring (Option D) allows attackers to continue exploiting the vulnerability unchecked.

CEH v13 emphasizes that virtual patching is the preferred first response for zero-day threats, especially when systems are mission-critical. It provides immediate risk reduction while allowing time for vendor patch development and controlled deployment.

Qualys VM is the best match because the scenario emphasizes enterprise vulnerability management for a hybrid environment with agent-based endpoint coverage, continuous monitoring, alerting, and centralized visibility across both on-premises and cloud systems. In CEH-aligned security operations concepts, vulnerability management is not only about running periodic scans, but also about maintaining an accurate, continuously updated view of asset exposure, prioritizing risk, and producing actionable remediation workflows. A platform designed for hybrid infrastructures commonly includes lightweight agents for endpoints, cloud connectors, unified dashboards, continuous assessment, and notification or alerting features to support real-time risk decisions. Qualys VM is widely recognized for delivering vulnerability management through a centralized cloud platform with broad asset visibility and support for continuous assessment models that align with large-scale, distributed environments.

The other options are less aligned with the full requirement set. Nikto is a focused web server and web application scanner and does not represent an enterprise-wide vulnerability management platform for endpoints and hybrid assets. OpenVAS is a capable open-source vulnerability scanner, but it is typically implemented as a scanning solution rather than a full hybrid vulnerability management platform with the same level of integrated agent-based endpoint coverage, centralized cloud visibility, and operational alerting described. Nessus is a strong vulnerability scanner and can support agents in some deployments, but the scenario’s emphasis on broad hybrid infrastructure visibility and centralized, continuous monitoring with alerting most strongly aligns with Qualys VM as a vulnerability management platform.

The correct answer is A. Insecure Ecosystem Interfaces.

The weakness involves externally reachable components that interact with management platforms and expose administrative configuration functions. These components also suffer from insufficient input validation and weak authentication controls. This aligns with Insecure Ecosystem Interfaces, which covers insecure web, cloud, mobile, API, and backend interfaces that form part of the IoT device ecosystem.

CEH-aligned IoT material identifies vulnerable interfaces as a major IoT challenge and lists OWASP IoT categories including insecure web, cloud, and mobile interfaces, insufficient authentication/authorization, and insecure network services . It also explains that insecure cloud and mobile interfaces are associated with weak credentials, account enumeration, and poor interface protection . In the newer OWASP IoT wording, these interface weaknesses are commonly grouped under Insecure Ecosystem Interfaces.

Option B. Insecure Default Settings is incorrect because the scenario does not focus on default passwords, default configurations, unnecessary enabled services, or insecure factory settings.

Option C. Insecure Network Services is incorrect because that category focuses on vulnerable network services exposed by the device, such as services susceptible to buffer overflow or denial-of-service conditions. The scenario emphasizes external ecosystem components and management interfaces.

Option D. Lack of Device Management is incorrect because the scenario does not describe missing inventory, missing update management, missing decommissioning, or inability to monitor device lifecycle.

Therefore, the best answer is A. Insecure Ecosystem Interfaces.

CEH v13 explains that cryptographic consistency is essential for secure session management. Variable token lengths can leak information about encryption methods, key sizes, or user privilege levels, making sessions vulnerable to cryptanalysis or targeted attacks.

The most effective mitigation is implementing uniform encryption strength across all roles, ensuring consistent key sizes, algorithms, and token formats. While MFA improves authentication and key rotation improves lifecycle management, neither directly resolves cryptographic inconsistency.

CEH v13 stresses that encryption should be role-agnostic and standardized. Therefore, Option C is correct.

CEH v13 identifies encrypted communication channels as one of the most common and effective firewall evasion techniques. Firewalls that rely on packet inspection or signature-based filtering often cannot inspect encrypted payloads without SSL/TLS interception capabilities.

By encrypting malicious traffic—using HTTPS, VPN tunnels, or encrypted C2 channels—attackers can bypass firewall rules that inspect packet contents. CEH v13 emphasizes that this technique is widely used in malware communication, data exfiltration, and command-and-control operations.

IP spoofing (Option A) is limited by ingress and egress filtering and is less effective against modern firewalls. Open-source operating systems (Option B) do not inherently evade firewalls. Social engineering (Option D) targets users, not firewalls.

Therefore, Option C is the correct and CEH-aligned answer.

According to the CEH IDS/IPS module, false positives occur when legitimate activity is incorrectly flagged as malicious. The most common cause is overly sensitive IDS rules or thresholds.

Option D correctly identifies this issue.

Option A describes the symptom, not the root cause.

Option B is unrelated to IDS alert behavior.

Option C can cause missed detections, not excessive alerts.

CEH recommends proper tuning and baseline profiling.

The behavior described most closely matches an insider attack, because the actor is a temporary contractor who has physical proximity and implicit access to internal areas where employees work and handle sensitive information. In CEH guidance, an “insider” is not limited to permanent employees; it includes contractors, vendors, interns, and any trusted or semi-trusted individuals who can enter facilities or access internal environments. The attack combines two common insider-facilitated techniques: shoulder surfing and dumpster diving. Recording employees entering passwords is a form of shoulder surfing, where credentials are harvested by observing or capturing authentication entry through direct viewing or recording devices. Finding sensitive documents in a trash bin indicates dumpster diving, where attackers recover confidential information from improperly disposed materials.

These actions are typically feasible because the attacker is already inside the perimeter and can exploit weak operational security practices, such as lack of clean-desk enforcement, inadequate shredding policies, and insufficient physical monitoring of visitor or contractor activity. CEH materials emphasize that insider threats are particularly dangerous because they bypass many external perimeter controls and can blend into normal workplace behavior.

The other options do not fit. A distribution attack generally refers to compromise introduced through supply chain or third-party distribution channels, not on-site observation and trash retrieval. A passive attack is too generic and does not capture the key element of an authorized or trusted presence enabling the compromise. “Cisco-in attack” is not a standard CEH attack category for this scenario. Therefore, the most accurate classification is an insider attack.

The correct answer is B. MODBUS.

The defining indicators are TCP port 502, reading coil status, and writing register values. These are classic characteristics of Modbus/TCP, a widely used industrial control protocol.

CEH-aligned OT/ICS material identifies Modbus as a protocol used in industrial control systems and shows Modbus reconnaissance and interaction using port 502. It also describes Modbus function-code operations such as writing a single coil and reading input registers .

Option A. IEC 60870-5-104 is incorrect because IEC 104 is commonly associated with TCP port 2404, not port 502.

Option C. DNP3 is incorrect because DNP3 commonly uses TCP/UDP port 20000.

Option D. OPC UA is incorrect because OPC UA is not identified by Modbus coil/register operations on TCP 502.

Therefore, the best answer is B. MODBUS.

In the CEH Denial-of-Service and Network Attacks coverage, a SYN flood is a classic TCP-based DoS technique that exploits the TCP connection establishment process. In a normal handshake, the client sends SYN, the server replies SYN/ACK, and the client completes with ACK. A SYN flood deliberately sends a high volume of SYN packets (often spoofed) but never completes the final ACK. As CEH describes, this leaves the server holding many half-open connections in SYN_RECEIVED, consuming memory and connection table resources (backlog queue). When the backlog fills, legitimate clients cannot establish connections, degrading availability.

The indicators in your scenario align exactly with CEH’s SYN flood fingerprints: incomplete handshakes and accumulation of half-open connections. The goal is resource exhaustion at the connection-management layer rather than bandwidth saturation.

Option B (Ping of Death) involves malformed/oversized ICMP packets and does not match SYN_RECEIVED behavior. Option C (UDP flood) targets UDP services/ports and creates different symptoms (high UDP traffic, ICMP unreachable messages, service degradation) without half-open TCP states. Option D (Smurf) is ICMP-based amplification via broadcast addresses—again unrelated to incomplete TCP handshakes.

CEH also notes mitigations such as SYN cookies, increasing backlog, reducing SYN-RECEIVED timers, rate limiting, and upstream filtering—further reinforcing that the described event is a SYN flood.

Non-repudiation is the security principle that prevents a sender from denying having performed a specific action, such as sending a message or approving a transaction. In CEH-aligned cryptography, non-repudiation is most commonly achieved using digital signatures backed by public key cryptography and, in many real-world deployments, supported by digital certificates and a trusted certificate authority. When Alice digitally signs the email contract, she uses her private key to create a signature that is mathematically tied to both her identity and the exact content of the message. Bob can then use Alice’s corresponding public key to verify the signature. If verification succeeds, it provides strong evidence that the message originated from the holder of Alice’s private key and that the content has not been altered since it was signed.

This is different from confidentiality, which is about preventing unauthorized disclosure of message contents through encryption. It is also distinct from integrity alone: integrity ensures the message was not modified, but non-repudiation adds accountability by binding the action to a specific signer in a way that can be demonstrated to a third party. Availability is unrelated here, as it concerns ensuring systems and data are accessible when needed.

CEH materials emphasize that non-repudiation depends on proper key management and trust infrastructure. If Alice’s private key is compromised, the evidentiary value is weakened. Therefore, protecting private keys with secure storage, access controls, and revocation mechanisms is essential to preserve non-repudiation.

The correct answer is B. Design Flaws.

The issue is caused by a weakness in the workflow logic of the application. The platform depends on a multi-step identity verification sequence, but the server does not properly enforce completion of each required stage. This is not simply a missing patch or configuration issue; it is a logic/design weakness in how the authentication workflow was built.

CEH-aligned vulnerability material classifies Design Flaws as flaws involving encryption, data validation, logic flaws, and similar systemic weaknesses . CEH web application material also explains that business logic flaws can exist in how an application is designed to function and may be exploited through transaction tampering or incomplete validation of workflow behavior .

Option A. Poor Patch Management is incorrect because the weakness is not described as an unpatched known vulnerability.

Option C. Application Flaws is related, but the more precise classification is a design or business logic flaw because the workflow itself fails to enforce required verification stages.

Option D. Misconfigurations / Weak Configurations is incorrect because the problem is not caused by insecure server settings or default configuration.

Option B. Design Flaws is correct because the root weakness is flawed authentication workflow logic.

Therefore, the best answer is B. Design Flaws.

The correct answer is C because TTL manipulation is associated with IDS/NIDS evasion. TTL, or Time To Live, is an IP header value that decreases by one at each router hop. When the TTL reaches zero, the packet is discarded. In IDS evasion, an attacker may craft packets with low TTL values so that the packet is seen by the IDS sensor but expires before reaching the actual victim host, or is dropped by a later router. This can create a mismatch between what the IDS believes happened and what the target system actually receives. CEH IDS evasion concepts describe this as complex IDS evasion, where packets are passed as far as the IDS and then dropped later using techniques such as low TTL fields, fragmentation, source routing, and other IP options. This is why TTL manipulation is not primarily about evading encryption, routers, or firewalls. Routers process TTL, but the security control being confused or bypassed is the IDS.

Insecure Deserialization is the best match because the scenario explicitly describes user-supplied data being processed during object reconstruction. In CEH-aligned web application security concepts, deserialization is the process of taking serialized data, such as JSON, XML, YAML, or binary objects, and converting it back into in-memory objects the application can use. When an application accepts serialized objects from an untrusted source and reconstructs them without strong validation, integrity checks, and safe type constraints, an attacker can tamper with the serialized content to alter object fields, inject unexpected object types, or trigger unsafe behaviors during reconstruction.

The key clue is that Sophia uploads a crafted template file and gains administrative access and access to restricted dashboards. That outcome commonly occurs when a deserialized object contains role, permission, or account attributes that the server trusts, or when deserialization triggers privileged logic through gadget chains or unsafe callbacks. The prompt also rules out database queries, client-side code execution, and session manipulation, which eliminates common alternatives like SQL injection, XSS, and session hijacking. Local file inclusion would involve forcing the server to include local files using path manipulation, which is not described here. Verbose error messages can leak information but do not directly grant admin access.

Mitigations emphasized in ethical hacking guidance include never deserializing untrusted data when avoidable, enforcing strict allowlists of types, applying cryptographic signing or HMAC integrity validation to serialized data, using safer data formats with explicit schemas, regenerating authorization decisions server-side rather than trusting client-provided object attributes, and logging and blocking anomalous deserialization attempts.

The correct answer is F because the Windows Administrator account is identified by its RID value, not merely by the visible username. In Windows enumeration, a Security Identifier, or SID, uniquely identifies user, group, and computer accounts. The last portion of the SID is the Relative Identifier, or RID. CEH-aligned material explains that Windows uses SIDs and RIDs to track account rights and permissions, and the RID value 500 identifies the built-in Administrator account. The Guest account normally uses RID 501, while standard created users usually begin at 1000 and increment upward. Therefore, when SIDExtractor displays multiple users, the account whose SID ends in -500 is the system administrator account, even if the Administrator account has been renamed. Enumeration tools such as sid2user and user2sid are used to map usernames to SIDs and SIDs to usernames. In this question, John corresponds to the administrator RID, so option F is correct.

WPA with TKIP suffers from vulnerabilities inherited from WEP, particularly the use of weak Initialization Vectors (IVs). CEH v13 explains that these weaknesses allow attackers to perform packet injection and partial decryption attacks.

Although WPA improved upon WEP, TKIP was designed as a temporary solution and still relies on predictable IV behavior. This makes Option C correct.

Lack of AES (Option A) explains why WPA is weaker than WPA2 but does not directly describe the exploit mechanism. Weak passwords (Option D) affect authentication, not packet injection. GTK predictability (Option B) is relevant but not the primary cause here.

CEH v13 explicitly states that IV reuse and predictability in TKIP enable practical attacks. Therefore, Option C is correct.

This scenario is a textbook example of a Whaling Attack, a highly targeted phishing technique described in the CEH v13 Social Engineering module. Whaling specifically targets senior executives or high-ranking individuals, exploiting their authority, access privileges, and decision-making roles.

In the given case, the attacker crafts a personalized email, impersonates the CEO, and uses legitimate corporate branding to build trust. The malicious PDF attachment delivers a backdoor, aligning with CEH v13 descriptions of advanced spear-phishing techniques used against executives.

CEH v13 differentiates whaling from other phishing types:

Broad phishing targets large groups indiscriminately.

Pharming redirects users via DNS manipulation.

Email clone attacks copy legitimate emails but typically target peers, not executives.

Whaling attacks are particularly dangerous because executives often bypass security scrutiny and possess elevated system access. CEH v13 emphasizes executive awareness training as a key mitigation strategy.

Therefore, the correct answer is Whaling attack aimed at high-ranking personnel.

Sherlock is the correct choice because it is specifically designed for OSINT-style username enumeration across a very large number of websites. In CEH-aligned reconnaissance, one common task is “alias correlation,” where the tester checks whether the same username exists across multiple social networks, forums, and content platforms. Sherlock automates this by querying many supported sites and reporting where an account with a given username appears to exist. This directly matches the question’s requirement: “cross-platform username correlation by scanning hundreds of social networking sites.”

The prompt also specifies what the tool does not do: it “does not natively support geolocation tracking or visualizing identity relationships.” That limitation aligns with Sherlock’s role as a focused username discovery tool rather than an analysis platform. By comparison, Creepy is associated with geolocation-focused OSINT, particularly collecting and correlating location metadata from social media posts and images, which is the opposite of the stated limitation. Maltego is well known for relationship analysis and link visualization, allowing investigators to build graphs of people, emails, domains, and social entities—again contradicting the “does not visualize identity relationships” constraint. Social Searcher is more oriented toward searching and monitoring public social media content and mentions, not primarily high-volume username existence checking across hundreds of sites in the same manner.

In CEH reconnaissance workflows, Sherlock fits early-stage enumeration to expand a target’s footprint, after which analysts may pivot into tools like Maltego for link analysis or geolocation tools when location exposure is part of the assessment.

This refers to the CVSS (Common Vulnerability Scoring System), which CEH v13 identifies as the industry standard for vulnerability prioritization. A score of 9.8 indicates critical severity, combining metrics such as exploitability, impact, privileges required, and scope.

CVSS helps organizations prioritize remediation objectively, focusing resources on vulnerabilities with the highest business risk. It also allows consistent communication between technical and management teams.

Options B, C, and D misrepresent CVSS functionality. Therefore, Option A is correct.

CEH v13 follows the Incident Response Lifecycle, which prioritizes identification and analysis before containment, unless there is immediate risk of catastrophic damage. In this scenario, the attacker has escalated privileges, but the organization still needs to understand what actions are being taken, what systems are affected, and whether lateral movement is occurring.

Option C aligns with CEH v13 best practices. Real-time monitoring and documentation allow analysts to:

Identify attacker techniques and tools

Preserve volatile evidence

Understand scope and impact

Implement targeted containment

Immediately powering down the server (Option B) may destroy volatile forensic evidence and disrupt services unnecessarily. Engaging forensic teams (Option A) is important but premature without initial analysis. Running vulnerability scans (Option D) does not address the active threat.

CEH v13 stresses that informed containment is more effective than reactive shutdowns. Therefore, Option C is correct.

The correct answer is C, Preparation. In the incident response lifecycle, preparation is the stage performed before an actual incident occurs. This phase focuses on making the organization ready to respond effectively by creating the incident response plan, forming the incident response team, assigning roles and responsibilities, defining escalation paths, and testing communication procedures. CEH incident management material lists “Preparation for Incident Response” as the first incident response process before detection, classification, notification, containment, investigation, eradication, recovery, and post-incident activities. It also emphasizes setting up an incident response team, identifying the people who should be contacted during an intrusion, and defining lines of communication. Containment occurs after an incident is detected and aims to limit damage. Notification involves informing affected users or stakeholders. Recovery restores affected systems to normal operation. Since building the team and testing communication happen before an incident, the correct phase is Preparation.

The correct answer is C, tcpdump. Passive OS fingerprinting identifies the operating system of a target by observing and analyzing network traffic without actively sending probe packets to the target system. Tools such as tcpdump capture packets traversing a network and allow analysts to inspect characteristics like TCP window size, Time-To-Live (TTL) values, TCP options, and packet behavior that can reveal the operating system in use. Because the target is not directly interrogated, passive fingerprinting is stealthier and less likely to trigger alerts.

Nmap is primarily associated with active OS fingerprinting because it sends specially crafted packets and analyzes the responses to determine the target operating system. Ping is used mainly to verify host availability, while tracert (traceroute) identifies network paths and intermediate hops between systems. Neither ping nor tracert performs OS fingerprinting.

In CEH reconnaissance and enumeration topics, passive information gathering focuses on observing existing communications rather than generating new traffic. Therefore, among the given options, tcpdump is the most appropriate tool for passive OS fingerprinting because it captures and analyzes network traffic without directly probing the target.

OSINT-based reconnaissance includes using search engines to identify publicly exposed cloud assets. CEH highlights Google dorking as a passive method to reveal S3 buckets indexed in search engines through patterns such as site:s3.amazonaws.com or keyword-based queries.

Bluesnarfing is a Bluetooth attack described in CEH v13 Wireless Network Hacking, where attackers exploit misconfigured Bluetooth devices to access sensitive data such as contacts, messages, and files—often without user interaction.

One of the most critical enablers of Bluesnarfing is Bluetooth discoverable mode. When devices are discoverable, attackers can easily identify them and attempt unauthorized connections or exploit vulnerabilities in Bluetooth services.

Disabling discoverable mode significantly reduces the attack surface by preventing unauthorized devices from locating Bluetooth-enabled systems. CEH v13 explicitly recommends setting Bluetooth devices to non-discoverable mode when not pairing.

While firmware updates (Option B) are important, they do not immediately prevent discoverability-based attacks. Stronger PINs (Option C) help against pairing attacks but do not stop unauthorized queries. Network-level encryption (Option D) is inherent in Bluetooth protocols and does not mitigate discovery abuse.

CEH v13 highlights that visibility control is the most immediate and effective defense against Bluesnarfing. Therefore, Option A is the correct answer.

The correct answer is B, It replaces legitimate programs. A rootkit is malicious software used after compromise to hide the attacker’s presence, maintain privileged access, and avoid detection. CEH-aligned material describes rootkits as tools that obscure system compromise by replacing or substituting administrator utilities with modified versions that hide malicious activity. Linux rootkit material also states that rootkits contain replacement executables for critical operating system components, used to hide evidence and provide backdoor access. Therefore, among the options, replacing legitimate programs is the best match. Option A describes a backdoor concept more generally. Option C describes a vulnerability/exploitation condition, not a rootkit’s purpose. Option D may describe one possible backdoor behavior, but it is not the primary rootkit objective. Rootkits commonly hide files, processes, registry entries, logs, and malicious services, making detection and removal difficult.

CEH v13 states that vulnerabilities with a CVSS score ≥ 9.0 are critical and require immediate containment. When remote code execution is possible, the system may already be compromised.

The recommended response is to isolate the affected system, preventing lateral movement, then perform a forensic audit before applying patches. Immediate patching without isolation may alert attackers or destroy evidence.

Thus, option D aligns with CEH incident response best practices.

Untethered jailbreaking is the only option that matches all key characteristics described: the device can reboot normally without needing a computer, and the jailbreak remains active after the restart with kernel-level modifications still in effect. In CEH-aligned mobile security concepts, the main difference among jailbreak types is what happens after a reboot.

A tethered jailbreak requires a computer to boot the device at all. If the phone restarts without being connected to a computer, it will not complete the boot process. That contradicts the scenario, which explicitly says the device can fully restart without requiring a computer. A semi-tethered jailbreak allows the phone to reboot without a computer, but it boots into a non-jailbroken state, meaning elevated privileges and kernel patching are not active until re-enabled through a tool. A semi-untethered jailbreak is similar in that it can boot normally without a computer, but the jailbreak does not persist automatically; it typically requires re-activating the jailbreak after each reboot to regain kernel patching and privileged access.

The scenario states the restart occurs while still “maintaining a patched kernel” and continuing access to protected filesystem data, which indicates persistence across reboot. That persistence is the defining feature of an untethered jailbreak. From a defensive and assessment perspective, this is considered higher risk because it provides continuous post-reboot privileged access, increasing the window for data access, tampering, and persistence mechanisms compared with reboot-reset jailbreak states.

The correct answer is C. Analyze Firmware.

The firmware image has already been obtained. The tester is now inspecting the binary to understand its format, architecture, readable strings, and low-level structure. This is part of the Analyze Firmware stage.

The referenced firmware analysis material lists commands such as file < bin > , strings, strings -n5 < bin > , strings -tx < bin > , binwalk < bin > , and hexdump -C < bin > as firmware analysis activities used to inspect firmware content and structure .

Option A. Extract the Filesystem is incorrect because filesystem extraction would involve extracting embedded filesystems from the firmware image, commonly with tools such as binwalk -e.

Option B. Obtain Firmware is incorrect because the question states that the tester already received the firmware image.

Option D. Emulate Firmware is incorrect because emulation involves running or simulating the firmware environment, which has not yet occurred.

Therefore, the best answer is C. Analyze Firmware.

The correct answer is B. Green Hat Hacker.

A Green Hat Hacker is a beginner or newcomer who is learning hacking techniques and building practical skills. The profile in the scenario describes someone new to cybersecurity, actively learning from online communities, and experimenting with basic tools.

CEH-aligned hacker classification material describes a Neophyte, also called a n00b, newbie, or Green Hat Hacker, as someone who is new to hacking or phreaking and has little or no knowledge or experience with technology and hacking .

Option A. Blue Hat Hacker is incorrect because a blue hat hacker is commonly associated with external bug testing before a system launch.

Option C. Gray Hat Hacker is incorrect because gray hats may violate rules or permissions while not necessarily having malicious intent.

Option D. Red Hat Hacker is incorrect because red hats are generally associated with aggressive action against malicious hackers or high-value targets.

Therefore, the best answer is B. Green Hat Hacker.

A FIN scan is a classic “stealth” TCP scan technique discussed in CEH network scanning methodology. Unlike a TCP Connect scan, which completes the full three-way handshake and is highly visible in logs, a FIN scan sends a TCP packet with only the FIN flag set to a target port. The scan then interprets the target’s response to infer whether the port is open or closed, without establishing a normal TCP session. This matches the scenario’s requirement to “infer port states without completing a full connection” and to keep visibility low.

The logic relies on expected TCP behavior defined for many TCP/IP stacks. For a closed port, the target typically responds with an RST packet, indicating there is no service listening. For an open port, many systems do not respond at all to an unexpected FIN packet (because it does not correspond to an existing connection). That “no response” behavior becomes the signal the tester uses to suspect the port may be open or filtered. CEH emphasizes that because FIN scans do not perform a handshake, they can be less likely to trigger certain basic connection-based logging, and they generate fewer obvious connection events than TCP Connect scans.

Option D, NULL scan, is also a stealth method, but it uses a packet with no flags set. The question specifically highlights leveraging TCP flags and is commonly mapped in CEH-style questions to FIN scanning as the representative “TCP flag stealth scan.” Option B is too generic, and option A is the most detectable. Therefore, FIN scan best aligns with the described stealth reconnaissance strategy.

The best answer is B. Cryptographic Failures because the scenario centers on weak protection of sensitive data in transit, enabling an attacker to intercept and manipulate the information. In CEH-aligned web and application security concepts (and consistent with modern web risk categories), cryptographic failures occur when an application does not properly use cryptography or secure transport protections to ensure confidentiality and integrity of sensitive data. If transport encryption is missing, weak, or incorrectly configured, attackers can perform man-in-the-middle style interception, tamper with traffic, steal session material, and exfiltrate regulated data—leading to outcomes like identity theft and payment card fraud, exactly as described.

The references to cookie snooping and downgrade attacks further reinforce this. Cookie snooping is commonly associated with session cookies being exposed due to insecure transport (for example, lack of HTTPS, mixed content, or cookies missing secure attributes), allowing an attacker on the network path to capture session identifiers and hijack accounts. Downgrade attacks occur when an attacker forces a connection to use weaker security settings (such as older TLS versions or insecure cipher suites) or coerces a fallback from HTTPS to HTTP when protections like HSTS are absent or misapplied. Both issues are tightly linked to improper cryptographic configuration and transport-layer security weaknesses.

Why the other options are not the best match: Broken Access Control concerns authorization—what users are allowed to access—not interception/manipulation of traffic. Identification and Authentication Failures focus on login/session identity mechanisms (passwords, MFA, session handling) but the key failure here is the weakness of cryptographic protection for data in transit. Security Misconfiguration can be a contributing cause (e.g., misconfigured TLS), but the question emphasizes the resulting weakness category—insufficient cryptographic/transport protections—making Cryptographic Failures the most precise answer.

Therefore, MediVault’s exposure to interception, manipulation, cookie snooping, and downgrade attacks most clearly indicates Cryptographic Failures.

The finding described maps directly to Insecure Data Storage. In CEH-aligned mobile security guidance and OWASP Mobile risk discussions, insecure data storage occurs when a mobile application saves sensitive information locally in a way that can be easily recovered by an attacker, especially on a rooted or jailbroken device where sandbox protections can be bypassed. Storing usernames and passwords in plain text is a high-severity example because it allows immediate account takeover and enables access to protected client records, case notes, and other confidential material.

Mobile devices routinely store app data in local file systems, shared preferences, databases, logs, or cached content. If sensitive data is stored without proper protections, an attacker with physical access, malware, backup extraction capability, or root access can read it directly. CEH materials emphasize that rooting dramatically increases attacker capability by permitting access to app directories and system areas that would otherwise be restricted. That is exactly what the scenario shows: credentials are recovered from the device once root access is available.

The best practice mitigation is to never store credentials in plain text. Use secure, OS-provided storage such as Android Keystore or iOS Keychain, apply strong encryption with keys protected by hardware-backed mechanisms when available, minimize what is stored locally, and ensure secrets are not written to logs or debug artifacts. Insecure Communication would involve weak transport protections, and Improper Credential Usage can include hardcoded credentials or poor authentication handling, but the specific issue here is plainly unsafe local storage of credentials, so Insecure Data Storage is the correct choice.

The most likely missing BYOD guideline is reviewing application permissions before installation. In CEH mobile security guidance, a major risk in BYOD environments is the introduction of untrusted or malicious applications that abuse the mobile permission model to access corporate data, intercept authentication tokens, read storage, capture keystrokes via accessibility services, or communicate externally. When users install apps without scrutinizing requested permissions, they may unknowingly grant excessive privileges that enable data theft or access-control bypass, especially if the app leverages OS weaknesses or misconfigurations.

The scenario states Javier “installs a malicious app that bypasses access controls” and gains access to sensitive financial data because devices “lack a specific security measure to restrict app access.” This maps directly to a policy gap around controlling and validating apps and their permission requests. CEH emphasizes that organizations should reduce attack surface by limiting app privileges, avoiding sideloading from untrusted sources, and enforcing least privilege through user awareness and enterprise controls such as MDM application allowlisting and permission governance. Reviewing permissions is the user-facing guideline that prevents employees from granting dangerous access (for example, SMS, storage, contacts, accessibility, device admin, or VPN configuration permissions) that can enable credential theft or unauthorized data access.

Option B adds an extra layer for local access but does not stop a malicious app with granted permissions from accessing corporate data. Option C helps if a device is physically stolen, but it does not prevent malicious apps already running under the user context. Option D protects data at rest, yet a malicious app can still exfiltrate data once it is decrypted and accessed by the user session. Therefore, permission review is the most directly relevant missing BYOD guideline.

The correct answer is WPA2. CEH wireless security material explains that WPA2 uses AES-based encryption together with CCMP, which provides confidentiality and message integrity protection. The scenario also mentions a structured four-message key negotiation process before protected traffic begins, which aligns with the well-known four-way handshake used in WPA and WPA2 environments. The deciding factor is the encryption and integrity combination: AES with CCMP is strongly associated with WPA2 in CEH guidance. WEP is far weaker and based on RC4, while WPA originally relied on TKIP as its hallmark improvement over WEP. WPA3 introduces newer protections and a different exam emphasis, but the classic CEH mapping for four-way handshake plus AES/CCMP is WPA2. CEH references also note that WPA2 was designed to improve enterprise-grade wireless security and that CCMP addresses integrity concerns more effectively than earlier approaches. Because the packet capture shows AES-based counter mode encryption with integrated integrity checks after the handshake sequence, the observed standard is best identified as WPA2.

The correct answer is A. Activating Dynamic ARP Inspection to validate ARP packets.

The scenario describes a switch discarding ARP replies that do not match known IP-to-MAC and address-to-port bindings. This is the function of Dynamic ARP Inspection (DAI).

CEH-aligned sniffing and ARP defense material states that Dynamic ARP Inspection is used with DHCP snooping, where IP-to-MAC bindings are tracked from DHCP transactions to protect against ARP poisoning. It also notes that DHCP snooping is required to build the MAC-to-IP bindings used for DAI validation . The same material lists the configuration command ip arp inspection vlan < vlan number > and the verification command show ip arp inspection .

Option B is incorrect because displaying the DHCP snooping table only verifies bindings; it does not enforce ARP validation.

Option C is incorrect because DHCP Snooping builds the trusted binding database, but DAI is the feature that validates and drops invalid ARP packets.

Option D is incorrect because BPDU Guard protects spanning-tree edge ports from unexpected BPDUs. It does not validate ARP packets.

Therefore, the best answer is A. Activating Dynamic ARP Inspection to validate ARP packets.

If a system stores passwords in weak or reversible formats, attackers can perform offline cracking. CEH emphasizes dictionary attacks as the fastest and most efficient method to exploit weak hashing practices. This avoids detection and leverages known password patterns to recover plaintext credentials.

CEH v13 identifies kernel-level rootkits as among the most dangerous malware types. Because they operate at the lowest OS level, they can hide processes, files, and system calls.

CEH v13 states that the only guaranteed remediation is a complete system wipe and clean OS reinstallation from a trusted source. Attempting removal risks incomplete eradication.

Powering down alone does not remove the rootkit. Honeypots are for detection, not remediation. Tailored removal tools may fail at kernel depth.

Thus, Option C is correct.

Ping of Death is a classic Denial-of-Service technique in which an attacker sends oversized or malformed IP packets that exceed the maximum allowed size when reassembled. In IP networks, the maximum packet size is 65,535 bytes. Historically, attackers exploited fragmentation by sending a series of IP fragments that, when reassembled by the target, resulted in a packet larger than the permitted limit or produced an invalid buffer condition. Vulnerable systems could crash, reboot, or become unstable because the network stack mishandled the reassembly process or failed to properly validate packet length and structure.

The scenario matches this behavior precisely: Sofia transmits “oversized, malformed packets” and the server “crashes intermittently due to processing failures.” That symptom is more consistent with a malformed-packet handling flaw than with pure traffic volume. An ICMP flood and an ACK flood are volumetric or resource-exhaustion attacks that overwhelm bandwidth or connection-handling capacity, typically degrading performance rather than directly causing crashes from malformed packet parsing. A Smurf attack is an amplification-based ICMP attack using broadcast addresses to multiply traffic toward a victim; again, it is about volume, not crafted malformed packets that trigger parsing failures.

CEH guidance highlights that PoD-style attacks exploit improper packet validation and reassembly logic. Modern systems are generally patched, but poorly maintained devices, legacy OS stacks, and some embedded implementations can still exhibit instability when exposed to malformed fragmentation and reassembly edge cases.

The correct answer is B, Lateral movement. In CEH security operations and incident response concepts, audit logs are essential for tracing user activity, source IP addresses, logon/logoff events, system changes, and other important security events. CEH-related material states that audit logs are vital for backtracking an incident and finding the root cause; when accounting or logging information is insufficient, incident investigation becomes extremely difficult. Lateral movement is especially difficult to detect without centralized logging because the attacker’s activity is spread across multiple internal hosts. Detecting it requires correlating events such as authentication attempts, remote service execution, SMB access, PowerShell use, privilege changes, and connections between endpoints. If each system keeps logs locally, defenders may miss the full attack path, especially if the attacker clears or tampers with local logs. CEH hacking methodology also notes that attackers can compromise connected intermediate systems and use compromised systems to launch attacks against others. Recon, delivery, and initial access may still appear in perimeter, email, proxy, or firewall logs, but lateral movement depends heavily on cross-host audit correlation.

Comprehensive and Detailed Explanation From CEH v13 Guide Topics:

The correct answer is A. HTTP cookies often store session identifiers or authentication-related tokens after a user logs in to a website. If these cookies remain on the system after the browser closes, an attacker with access to the device, malware, or stolen browser data may reuse those cookies to impersonate the authenticated user. This is commonly associated with session hijacking, cookie theft, or unauthorized reuse of trusted browser sessions.

Automatically deleting cookies when the browser terminates reduces the chance that an attacker can recover valid session cookies later. Option B relates more to privacy tracking and browsing history analysis, not the main authentication risk. Option C refers to SQL database compromise, which cookie deletion does not directly prevent. Option D refers to locally stored passwords, which are separate from HTTP cookies. Therefore, the policy is primarily intended to mitigate unauthorized access to trusted websites through stolen authentication/session data.

The CEH v13 content explains that stealth scanning involves modifying scan timing parameters to reduce packet frequency, randomize intervals, and avoid recognizable patterns typically flagged by intrusion detection systems. Slow, randomized timing—often achieved with Nmap’s T0 or T1 timing templates—prevents bursts of traffic and allows scans to blend into normal network noise. IDS/IPS systems tuned for high-volume events may fail to detect such gradual reconnaissance. Fast SYN scans generate distinctive patterns easily identified by security monitoring tools. UDP scans, especially across all ports, produce high traffic volume and are extremely noisy. Xmas scans, although sometimes used for stealth against stateless filters, are still signature-detectable and inappropriate when stealth over time is required. Therefore, applying slow, randomized timing options aligns with CEH-approved reconnaissance techniques for evading detection while enumerating open ports.

The vulnerability described is characteristic of XML External Entity (XXE) Injection. In CEH web application security coverage, XXE occurs when an application parses XML input without properly disabling external entity resolution. If the XML parser is configured insecurely, an attacker can define a malicious external entity that references local files or internal system resources. When the parser processes the XML document, it resolves the external entity and may return the contents of sensitive files in the server’s response.

The scenario clearly states that the issue arises from “handling of external references in document parsing” and results in exposure of internal file paths and database connection strings. This aligns directly with XXE behavior, where attackers leverage external entity declarations to retrieve local files such as configuration files, environment settings, or system credentials. In some cases, XXE can also enable server-side request forgery by forcing the server to make internal network requests.

The other options do not match the described behavior. Identification and authentication failures relate to improper access controls, not document parsing. HTTP response splitting involves manipulating headers to inject malicious responses. Security logging and monitoring failures refer to detection gaps, not data exposure through parsing. CEH-recommended mitigation strategies include disabling DTD processing, turning off external entity resolution in XML parsers, validating input formats, implementing least privilege on file access, and using secure parsing libraries that prevent XXE exploitation.

This scenario represents a Tautology-Based SQL Injection, a fundamental SQL injection technique covered under the Web Application Hacking module in the CEH v13 curriculum. The defining characteristic of this attack is the injection of a condition that always evaluates to TRUE, thereby bypassing authentication or authorization controls.

In the given example, the injected input 1 OR ' T ' = ' T ' ; -- manipulates the logical condition of the SQL query. A typical vulnerable login query may resemble:

SELECT * FROM users WHERE user_id = 1 AND password = ' input ' ;

When the attacker submits the injected payload, the resulting SQL statement becomes:

SELECT * FROM users WHERE user_id = 1 OR ' T ' = ' T ' ; -- ' ;

The expression ' T ' = ' T ' is a tautology, meaning it always evaluates to TRUE regardless of context. As a result, the database returns records without properly validating the user’s credentials, granting unauthorized access.

According to EC-Council CEH v13, tautology-based SQL injection is classified as a Boolean-based injection technique where attackers exploit improper input validation to alter the logical flow of SQL queries. This attack does not depend on database error messages (as in Error-Based SQL Injection), does not extract data using UNION statements (Union-Based SQL Injection), and does not rely on response delays (Time-Based Blind SQL Injection).

CEH v13 emphasizes that such attacks are especially effective against login forms and authentication mechanisms when developers fail to implement input sanitization, parameterized queries, or prepared statements. This attack is one of the most common and exam-tested SQL injection types because it clearly demonstrates how flawed logic can compromise application security without advanced techniques.

Understanding tautology-based SQL injection is critical for ethical hackers, as it forms the foundation for identifying and mitigating more complex SQL injection variants.

The correct answer is A. Risk management framework. The question describes an enterprise-level risk management approach used by management and other personnel to identify events that may affect business objectives, manage risks and opportunities, and provide reasonable assurance that objectives will be achieved. In CEH-aligned information security concepts, risk management focuses on identifying organizational assets, threats to those assets, and vulnerabilities, then selecting countermeasures to reduce risk and improve the organization’s security posture. EC-Council risk management phases include Risk Identification, Risk Assessment, Risk Treatment, Risk Tracking, and Risk Review. Qualitative risk assessment is only one method of assessing risk using descriptive ratings such as low, medium, and high; it is not the full enterprise framework. PCI-DSS applies specifically to payment card data security, and NIST SP 800-37 is a specific federal information-system risk management publication. Therefore, the best general CEH answer is Risk management framework.

The correct answer is DNS interrogation. CEH reconnaissance guidance explains that active footprinting involves direct interaction with the target environment, which can generate logs or alerts. DNS interrogation is an active technique used to query name servers for information about domain structure, hostnames, mail servers, subdomains, and other records that reveal how public-facing systems are logically arranged. The question specifically says Justin is retrieving structural details about the organization’s public-facing systems and that his activity is logged by the target, which is consistent with active DNS queries. Network or port scanning is also active, but it focuses on discovering open ports and reachable services rather than the logical naming and organizational structure of public systems. Social engineering is human-focused, and user and service enumeration typically aims at accounts or system services rather than domain structure. CEH materials repeatedly emphasize DNS as a rich reconnaissance source because records such as A, MX, NS, TXT, and SOA can reveal infrastructure relationships and naming conventions. Since the goal is to understand how the organization’s internet-facing systems are organized and represented, DNS interrogation is the best fit.

The best choice is encrypting stored data with quantum-resistant algorithms because the scenario’s core risk is long-term confidentiality of data at rest in a cloud environment under a future where large-scale quantum computing could break widely used public-key schemes. In CEH cryptography coverage, the most direct way to protect confidentiality is to use strong encryption that remains secure against the expected attacker capabilities. “Harvest now, decrypt later” is a practical concern: adversaries can copy encrypted data today and wait until new capabilities make decryption feasible. Therefore, the control must be cryptographic and future-resistant, not merely procedural or architectural.

Option B aligns with post-quantum readiness by moving encryption and key-establishment mechanisms toward quantum-resistant primitives. This is especially important for protecting stored records over long retention periods. Even if symmetric encryption such as AES is generally more resilient to quantum attacks than classical public-key algorithms, organizations still must ensure appropriate key sizes, robust key management, and quantum-resistant approaches where public-key cryptography is used for key exchange, key wrapping, or digital signatures that support storage encryption workflows.

Option A, distributing fragments, can improve availability and limit exposure in some breach scenarios, but it does not replace encryption and does not guarantee confidentiality if fragments are obtained. Option C is not applicable because the problem is stored cloud data, not quantum communications. Option D is a good governance practice, but it is not itself a cryptographic control that ensures confidentiality. The priority, per CEH-aligned cryptographic defense principles, is quantum-resistant encryption and key management for data at rest.

CEH materials describe this attack pattern as Living-off-the-Land (LotL), where attackers abuse legitimate tools to avoid detection. Because these binaries are normally trusted, traditional antivirus solutions may not flag them.

CEH recommends file integrity monitoring (FIM), which tracks cryptographic hashes of sensitive executables and alerts administrators when unauthorized modifications occur.

Option D is correct.

Options A and B support resilience but do not detect tampering.

Option C alone is insufficient against LotL attacks.

The correct answer is B. ARP Spoofing because the described outcome—silently redirecting traffic between two hosts through the attacker’s machine on a LAN without changing switch configurations—is the classic effect of ARP poisoning (also called ARP spoofing). In CEH-aligned network sniffing and man-in-the-middle (MITM) techniques, ARP spoofing works by sending forged ARP replies onto the local network so that a victim host associates the attacker’s MAC address with the IP address of a legitimate system (commonly the default gateway or another target host). Once the victim’s ARP cache is poisoned, frames intended for the real destination are instead sent to the attacker, who can then forward them to the legitimate host to maintain connectivity while inspecting or altering the traffic.

The scenario states David “injects crafted messages” and then “all traffic between a finance workstation and the authentication server is silently routed through his system.” That behavior strongly indicates ARP spoofing performed in both directions: poisoning the workstation to believe the attacker is the authentication server (or gateway) and poisoning the server to believe the attacker is the workstation (or gateway). This enables a transparent MITM position where credentials can be observed—especially if protocols are unencrypted or if the attacker can downgrade or strip protections. The fact that “no proxy or VPN is in use” supports the idea that the redirection is happening at Layer 2/Layer 3 on the local segment rather than via an explicit application-level proxy.

Why the other options are less accurate: Switch port stealing targets switch CAM tables to redirect frames, but it is less directly described than ARP cache poisoning between two IP endpoints. An STP attack manipulates spanning tree to become the root bridge and can influence paths, but it is a different control-plane attack and usually affects broader Layer 2 topology. IRDP spoofing involves ICMP Router Discovery Protocol to advertise a rogue router, but the scenario fits the much more common and direct MITM sniffing technique on a switched LAN: ARP spoofing.

Therefore, David most likely used ARP spoofing.

The correct answer is C. Leveraging DDoS Prevention Offerings from an ISP or DDoS Mitigation Service.

The scenario describes a large-scale DDoS attack that exceeds the organization’s local mitigation capacity. The traffic is rerouted through an upstream filtering or scrubbing infrastructure that absorbs malicious traffic and forwards legitimate traffic back to the organization. This is the function of an ISP-backed or specialized DDoS mitigation/scrubbing service.

CEH-aligned DDoS countermeasure material notes that, for a true DDoS attack, the practical answer is often involvement of the upstream ISP because endpoint-level defenses may not keep up with a sophisticated global botnet attack .

Option A. RFC 3704 Filtering is incorrect because ingress/egress filtering helps reduce spoofed traffic but does not describe large-scale traffic scrubbing.

Option B. Cisco IPS Source IP Reputation Filtering is incorrect because source reputation filtering alone does not match upstream traffic rerouting and scrubbing.

Option D. Black Hole Filtering is incorrect because blackholing drops traffic, often including legitimate traffic, while the scenario says clean traffic is forwarded back to the retailer.

Therefore, the best answer is C. Leveraging DDoS Prevention Offerings from an ISP or DDoS Mitigation Service.

The requirement that each device authenticate through a centralized server using unique usernames and passwords aligns directly with 802.1X authentication, which CEH materials describe as port-based Network Access Control used in enterprise wired and wireless environments. In Wi-Fi, 802.1X is typically implemented as WPA2-Enterprise or WPA3-Enterprise and relies on EAP methods with a backend AAA server, most commonly RADIUS. The access point acts as the authenticator, forwarding the client’s authentication exchange to the RADIUS server, which validates the user or device identity and returns an accept or reject decision along with session keys and policy attributes. This provides strong control and auditing because access can be tied to individual identities, supports account disablement, and can enforce different access levels.

The other options do not match the “centralized server with unique credentials” description. Disabling TKIP improves security by removing an outdated encryption protocol, but it does not provide per-user authentication. MAC address filtering is weak because MAC addresses are easily discovered and spoofed, and it does not use centralized identity validation. Upgrading to WPA3 improves cryptographic strength, and WPA3-Enterprise can work with 802.1X, but WPA3 alone does not guarantee centralized username and password authentication unless the enterprise mode with 802.1X is specifically deployed. Therefore, the correct countermeasure that fits the described design is to use 802.1X authentication with a centralized authentication server, enabling strong access control, accountability, and improved resistance to unauthorized device connections.

CEH training emphasizes that mobile applications frequently mishandle local storage, leaving sensitive data such as tokens, passwords, API keys, or personal information unencrypted within SQLite databases, shared preferences, or flat-file storage. When encryption is absent or improperly implemented, attackers can directly access this data through filesystem extraction, Android Debug Bridge (ADB) access, physical device access, or rooted environments. CEH identifies “Insecure Data Storage” as one of the most critical mobile vulnerabilities because it bypasses server-side defenses entirely. Since the vulnerability specifically concerns data at rest, the most direct and effective exploitation method is to retrieve the locally stored unencrypted data. SQL injection (Option B) evaluates backend security, not device storage. XSS (Option C) is a web attack and unrelated to local encryption. Brute-forcing credentials (Option D) is unnecessary when sensitive information is already stored insecurely. Therefore, accessing local storage is the correct exploitation method.

The best answer is D. Insecure routing protocols because the scenario describes legacy neighbor-to-neighbor device communications that lack encryption and integrity validation, allowing operational routing data to be exchanged without verification. In CEH-aligned network hacking concepts, this is a classic weakness of older or improperly secured routing protocols (and related network control-plane exchanges) where routers trust updates from neighbors and do not cryptographically validate the authenticity and integrity of routing information.

When routing updates are accepted without strong verification, an attacker who can position themselves on the same segment (or spoof a trusted neighbor) may inject or manipulate routing information. This can enable attacks such as route injection, route poisoning, man-in-the-middle (MITM) traffic redirection, blackholing traffic, or causing instability/denial of service by continuously advertising bad routes. The mention of “neighboring systems” and “operational data” strongly maps to routing adjacencies where devices exchange reachability and topology information. The absence of integrity checks makes it feasible to alter routing messages in transit or forge them, and the absence of encryption can expose routing details that further assists reconnaissance and targeted manipulation.

Why the other options are less accurate:

Firewall vulnerabilities relate to filtering and policy enforcement, but the core issue here is the trust model and protection of routing/control messages, not firewall rule flaws.

Lack of password protection is too generic and typically refers to weak/no credentials on management access, not unauthenticated routing exchanges.

Lack of authentication is conceptually related, but the question asks for the type of vulnerability most clearly present given “legacy communication mechanisms” between neighbors carrying operational data—this is most specifically categorized in CEH terms as insecure routing protocols (i.e., routing updates lacking authentication/integrity and sometimes encryption).

In practice, organizations mitigate this by enabling routing protocol authentication (where supported), using cryptographic integrity protections, restricting routing adjacencies, and segmenting or filtering routing/control-plane traffic to trusted peers only.

The correct answer is D, Split DNS. Split DNS, also called split-horizon DNS, uses separate DNS views or servers for internal and external name resolution. In this configuration, the DNS server in the DMZ provides public-facing records for external users, while the internal DNS server provides private records for internal hosts and services. This prevents sensitive internal hostnames, IP addresses, and infrastructure details from being exposed to the public. CEH networking topics describe DNS as the system that translates hostnames to IP addresses and vice versa, making DNS records valuable during footprinting and enumeration. CEH perimeter-security material also explains that a DMZ is a buffer area between the internal private network and the external public network, used for services that must be reachable externally. DNSSEC is used to protect DNS integrity cryptographically, DynDNS maps changing IP addresses to names, and “DNS Scheme” is not the standard term. Therefore, this configuration is Split DNS.

The attackers described are most consistent with black hat hackers because their actions are clearly unauthorized, intentionally harmful, and motivated by financial gain. They compromise a financial institution, deploy credential-stealing malware, exfiltrate customer account data, and then sell the stolen information on underground forums. This aligns with criminal hacking behavior: monetizing access and stolen data through illicit marketplaces, fraud, and repeated targeting of similar victims.

The scenario explicitly rules out ideologically motivated activity: “no political or social statements are made.” That makes hacktivists unlikely, since hacktivism typically involves a political, social, or ideological motive and often seeks publicity for a cause (defacements, leaks, DDoS protests). It also rules out ethical categories: white hat hackers operate with authorization and report findings to improve security rather than steal and sell credentials. Script kiddies are generally low-skill attackers who rely on existing tools and scripts; while they can cause harm, the scenario highlights sustained targeting, credential theft, and underground monetization—behavior more strongly associated with organized cybercriminals/black hats.

Black hats typically pursue objectives like theft of credentials, financial fraud, ransomware deployment, and sale of access or data. Their operations often emphasize anonymity, operational security, and repeatability across many similar targets—consistent with “continuing to target similar organizations for financial gain.”

Therefore, the most likely category is A. Black Hat hackers.

The correct answer is Follow TCP Stream. CEH packet analysis and sniffing material explains that Wireshark can reconstruct an application conversation from captured packets belonging to the same TCP session. When investigating HTTP logins, this feature is especially useful because it allows the analyst to view the reassembled request and response content in readable sequence rather than examining individual packets one by one. If credentials are being transmitted in cleartext over HTTP, Follow TCP Stream can reveal them directly within the reconstructed session. Filtering by IP address or by protocol can narrow the visible traffic set, which is helpful, but those functions alone do not reconstruct the full conversation. Monitoring specific ports is also less precise for understanding the actual payload content. CEH guidance emphasizes that once suspicious or relevant traffic is identified, stream reconstruction is a powerful method for analyzing what data was exchanged between client and server. Since Thomas is specifically trying to isolate and read unencrypted HTTP authentication exchanges during login sessions, Follow TCP Stream is the Wireshark feature that best supports both visibility and interpretation of those credentials in context.

Zero-day exploits are considered the most dangerous mobile attack vector in CEH v13 Mobile Platform Hacking. These exploits abuse previously unknown vulnerabilities, meaning no patches, signatures, or defenses exist at the time of attack.

In healthcare environments, mobile devices access sensitive EHR systems and operate under strict compliance requirements. Zero-day exploits can bypass mobile OS security, sandboxing, and antivirus controls entirely.

App spoofing and Bluejacking are easier to detect and mitigate through user awareness and Bluetooth controls. Side-channel attacks are highly specialized and rare in enterprise mobile environments.

CEH v13 stresses that zero-day attacks pose the greatest risk due to lack of detection mechanisms, making Option A correct.

The correct answer is C. Container Escape.

The scenario describes a compromised containerized workload breaking out of its intended isolation boundary and accessing host-level resources or adjacent workloads. This is the defining behavior of a container escape.

CEH-aligned cloud and virtualization material explains that containerization can suffer from container breakouts/leaks, where an attacker may gain unauthorized access to other containers on the same host, leading to privilege escalation and data leakage .

Option A. Man-in-the-Cloud Attack is incorrect because that attack abuses cloud synchronization tokens or cloud account access mechanisms, not container isolation boundaries.

Option B. Side-Channel Attack is incorrect because a side-channel attack infers sensitive data indirectly through shared resource behavior, timing, cache, or other indirect signals.

Option D. Golden SAML Attack is incorrect because Golden SAML involves forging SAML authentication assertions using stolen identity-provider signing material.

Therefore, the best answer is C. Container Escape.

CEH v13 identifies ARP spoofing/poisoning as a primary MitM technique in local networks. In such attacks, a single IP address maps to multiple MAC addresses, indicating ARP table manipulation.

This anomaly allows attackers to intercept traffic between victims and gateways. Increased traffic or DNS activity may occur but are not definitive indicators. Thus, IP-to-MAC inconsistencies are the most reliable confirmation of MitM activity.

This scenario describes Living-off-the-Land (LotL) malware techniques, where attackers modify or abuse legitimate system binaries and services to evade detection. CEH v13 identifies this as a highly stealthy persistence mechanism commonly used in advanced persistent threats (APTs).

The most effective countermeasure is file integrity monitoring (FIM), specifically by tracking cryptographic hashes of critical system executables. CEH v13 emphasizes that monitoring file hashes enables early detection of unauthorized modifications to binaries such as PowerShell, cmd.exe, or Windows services.

Backups (Option A) aid recovery but do not prevent or detect compromise. Antivirus updates (Option C) often fail against modified legitimate tools. Firewall hardening (Option D) reduces attack surface but does not detect tampering of trusted binaries.

CEH v13 explicitly recommends hash-based integrity verification as a core defense against stealthy persistence mechanisms. Therefore, option B is correct.

The correct answer is C. Insecure Data Storage because the vulnerability described is the storage of sensitive information locally on the mobile device in a manner that is not encrypted and is accessible by simply browsing the file system. In mobile application security, this is a classic risk category: when an app stores confidential data (case notes, client records, tokens, documents, cached responses, databases, logs, or exported files) in clear text or in insecure locations, an attacker who gains device access—or uses backup extraction, file explorers, rooted/jailbroken access, or malware with storage permissions—may retrieve that data without needing to authenticate to the application.

The scenario makes the weakness unmistakable: Daniel can use a “standard explorer tool” to open sensitive records “without any authentication.” This indicates the app is failing to apply appropriate protections such as encryption at rest, secure key handling, proper file permissions, and secure storage mechanisms. In secure mobile design, sensitive records should be encrypted using platform-supported protections (e.g., using OS keystores/keychains for keys, encrypting databases/files, and minimizing local retention). Additionally, apps should avoid storing highly sensitive regulated data unless essential, and should implement secure session controls and data lifecycle management (cache control, expiration, remote wipe support in enterprise settings).

Why the other options are not the best fit: Insecure communication concerns data exposure while transmitted over networks (e.g., lack of TLS, weak TLS, MITM susceptibility), whereas the issue here is purely local storage. Improper credential usage relates to mishandling passwords, tokens, or authentication secrets (hard-coded credentials, weak storage of credentials), but the prompt focuses on stored records themselves. Inadequate privacy controls is broader and typically involves over-collection, improper disclosure, or weak user privacy settings, not direct clear-text storage exposure.

Therefore, the most clearly present OWASP Top 10 Mobile Risk is Insecure Data Storage.

The correct answer is A because a deauthentication attack is commonly used to force a connected wireless client to disconnect from an access point and then reconnect. During that reconnection process, the WPA/WPA2 authentication handshake can be captured and later used for offline password-cracking attempts. CEH wireless hacking concepts describe breaking WPA by capturing WPA/WPA2 authentication handshaking packets and forcing a connected client to disconnect and reconnect so authentication packets can be captured for Pairwise Master Key analysis. This matches the purpose of a deauth attack. Jamming is mainly an availability or denial-of-service attack that disrupts wireless communication, not a handshake-capture method. Spoofing means impersonating a device or MAC address, and replay means reusing captured traffic or authentication data. Although replay attacks can be part of wireless exploitation, the specific attack used to trigger a fresh handshake capture is deauthentication. Therefore, option A is the best CEH-aligned answer.

This scenario describes steganographic sniffing, a highly sophisticated technique covered in CEH v13 Network Sniffing and Steganography. By embedding sensitive data inside legitimate image files—such as CT scans—attackers can intercept or exfiltrate patient information while avoiding detection.

Option D represents a steganography-based covert channel, which is extremely difficult to identify because:

The file appears legitimate

Standard encryption and IDS tools do not flag it

Medical images naturally contain large data volumes

Options A and B involve malware, which is more detectable. Option C involves text-based covert channels, which are easier to analyze than binary image embedding.

CEH v13 identifies steganography as one of the hardest data-hiding techniques to detect, making Option D correct.

The correct answer is A because the client can already see the wireless network and is sending association requests, which means the SSID and channel are likely correct. In wireless networking, association is the process of a client connecting to an access point. CEH wireless material explains that clients must associate with an AP before using the network, and MAC filtering is a control that allows only listed wireless NIC MAC addresses to associate with the AP. If the client’s MAC address is missing from the allowed list, the WAP may ignore or reject the association attempt. DHCP is not the best answer because DHCP occurs after Layer 2 wireless association, when the client is already connected enough to request IP configuration. The client also cannot be on the wrong channel if it can see the network and send association frames. Therefore, the most likely problem is MAC filtering on the WAP.

This scenario most accurately represents repackaging legitimate apps. CEH mobile social engineering coverage explains that in a repackaging attack, an adversary takes a real application, modifies its internal code or structure to include malicious functionality, and redistributes it through a third-party marketplace. The important clues here are that the app appears visually and functionally identical to the legitimate version, yet sandboxing reveals additional outbound activity and binary comparison confirms structural differences from the official build. That pattern is stronger than merely publishing a look-alike malicious app, because the question indicates there are two versions of what is essentially the same application and the unofficial copy has been altered. Smishing involves fraudulent SMS messages and fake security applications typically masquerade as protective tools, neither of which matches this case. CEH warns that unofficial application stores are a common distribution point for repackaged mobile apps because attackers can embed spyware, adware, credential theft code, or other malicious logic into otherwise trusted software. The user often sees a familiar interface and therefore assumes the application is safe, making repackaging a highly effective mobile-based social engineering method.

The correct answer is A, DNS anomalies. When a compromised endpoint uses DNS queries to communicate with a command-and-control server, the most relevant indicator is abnormal DNS behavior. In CEH-style incident detection, analysts correlate endpoint and network telemetry to identify suspicious communication patterns. DNS-based C2 may appear as repeated beaconing, unusually long domain names, excessive TXT queries, requests to newly registered or suspicious domains, high query volume, or DNS traffic that does not match normal baseline behavior. CEH materials discuss covert tunneling where commands can be hidden inside DNS name lookup query/reply traffic, making it appear like ordinary protocol traffic to network tools. IDS/monitoring concepts also emphasize anomaly detection by comparing activity against a baseline and investigating unusual behavior. Memory leaks, CPU spikes, and disk usage may occur in some malware cases, but they do not specifically indicate DNS-based C2. Therefore, the best indicator for this scenario is DNS anomalies.

CEH v13 explains that Windows systems running older or default configurations often allow anonymous or null session connections to IPC$ shares, enabling attackers to enumerate users, groups, shares, and other system details without authentication. Null session enumeration is highlighted as a classic yet effective technique because it generates minimal detectable activity and does not require credentials, making it ideal for stealth operations. CEH stresses that SMB null sessions are frequently overlooked in legacy or poorly hardened environments, especially when default permissions remain unchanged. Packet sniffing (Option A) may provide some data but requires traffic visibility and may be detected through monitoring tools. DNS zone transfers (Option B) require misconfigurations and usually do not reveal user list details. SNMP queries (Option D) require community strings and often generate alerts. Therefore, exploiting null sessions is the most covert and effective method for enumerating Windows systems under default configurations.

The correct answer is B because an attack that abuses the intended workflow, rules, or assumptions of an application is classified as a logic flaw or business logic flaw. In web application hacking, business logic defines how the application should behave, such as pricing rules, transaction sequencing, authorization decisions, coupon use, fund transfer limits, or approval workflows. A business logic flaw occurs when those rules are incomplete, poorly enforced, or can be manipulated by an attacker. The CEH web application material explains that business logic flaws exist when the application’s core rules are not foolproof and can be exploited to compromise the application; these flaws often require careful review of architecture and design because automated scanners may not detect them reliably. XSS abuses improper output/input handling to run scripts in a browser. CSRF abuses a user’s authenticated session. SQLi abuses database query construction. The option that directly matches abusing business logic is Logic flaw.

The correct answer is D because, in DNS, a zone is the administrative portion of the DNS namespace that contains DNS resource records for that portion of the domain tree. These records define how names are resolved and how services are located. Examples include A records for host-to-IP mapping, MX records for mail servers, NS records for name servers, CNAME records for aliases, PTR records for reverse lookups, and SOA records that identify the authoritative DNS server for the zone. In CEH reconnaissance and footprinting topics, DNS information is important because a DNS zone can reveal valuable network details such as hostnames, mail servers, name servers, and other infrastructure information. Option A is too broad because a zone is not merely a collection of domains. Option B is vague and does not define the zone itself. Option C is too narrow because alias records are only CNAME records, one type of DNS resource record. Therefore, a DNS zone is best defined as a collection of resource records.

The correct answer is B. Repackaging Legitimate Apps after modifying their internal structure.

The scenario states that the application looks and behaves like the legitimate rewards app, but binary comparison shows structural differences and sandbox monitoring reveals unauthorized outbound connections. This means the original legitimate application was modified and redistributed through an unofficial marketplace.

CEH mobile social engineering material defines repackaging legitimate apps as an attack where the attacker downloads a legitimate application, modifies it to contain malware, and uploads the repackaged version to a third-party app store for users to download . Another CEH reference explains that repackaged applications may be distributed through third-party stores and can send credentials or other data to an attacker-controlled server .

Option A. SMiShing is incorrect because no fraudulent SMS message is involved.

Option C. Fake Security Applications is incorrect because the app is not pretending to be a security tool.

Option D. Publishing Malicious Apps is close, but that usually refers to creating a malicious app that merely imitates a trusted brand. The binary comparison confirms this is a modified version of the legitimate app, making repackaging more accurate.

Therefore, the best answer is B. Repackaging Legitimate Apps after modifying their internal structure.

The correct answer is B. In CEH ethical hacking and penetration-testing guidance, testers must operate strictly within the authorized scope, agreement, and reporting procedures. When sensitive data such as credit card numbers and PII is unexpectedly discovered, the tester should not copy, move, examine further, or continue testing as though it were a normal finding. CEH-aligned guidance specifically warns that when illegal or highly sensitive material is encountered, it should not be copied to the tester’s own device, and the tester must follow team guidance and remain within the engagement agreement. Continuing the test could increase exposure, disturb evidence, or violate PCI-DSS and privacy handling requirements. Making a local copy is especially wrong because it creates another unauthorized location for regulated data. Contacting the employee directly is also improper because escalation should go through the approved client point of contact or management. Therefore, the best course of action is to stop the test immediately and contact management.

According to the Certified Ethical Hacker (CEH) IDS/IPS and Evasion Techniques module, packet fragmentation is a technique attackers use to split malicious payloads into smaller fragments so that signature-based IDS sensors may fail to reassemble and inspect the complete packet.

CEH explains that anomaly-based IDS systems are more effective against fragmentation evasion because they analyze behavioral deviations rather than relying solely on known signatures. Fragmented traffic often deviates from baseline network behavior in terms of packet size, sequencing, and reassembly anomalies.

Option A is correct because anomaly-based detection can identify abnormal fragmentation behavior even if the payload itself does not match known signatures.

Option B is unreliable, as attackers do not use consistent intervals.

Option C is impractical, since legitimate traffic may be fragmented.

Option D is less effective because signature-based IDS systems can be bypassed by fragmentation techniques.

CEH recommends packet normalization and anomaly-based detection as effective countermeasures.

AES is the industry-standard symmetric encryption algorithm endorsed by CEH v13. It provides strong confidentiality and resists traffic analysis when used with proper modes (e.g., CBC, GCM).

DES is obsolete, HMAC ensures integrity not encryption, PSA is not a standard encryption algorithm.

Thus, Option B is correct.

The correct answer is A, Anti-forensics. Disabling logging services after compromising an administrator account is an attempt to hide evidence, prevent detection, and make later investigation harder. In CEH system hacking phases, this aligns with covering tracks, where an attacker removes or modifies evidence after gaining access. The CEH material describes covering tracks as wiping evidence, removing event logs, error messages, and other indicators so the attack is not easily discovered. It also lists disabling auditing, clearing logs, and manipulating logs as common techniques used by attackers. CEH hacking methodology also explains that clearing tracks helps attackers remain undetected by overwriting system, application, and related logs to avoid suspicion. This is not exfiltration, because no data theft is described. It is not reconnaissance, because the attacker is not gathering information. It is not privilege escalation, because the account is already administrative. Therefore, disabling logging services is best classified as anti-forensics or covering tracks.

The scenario describes a host-level monitoring agent installed on a single workstation that records local system events such as file access, configuration changes, and unauthorized process execution. These are classic indicators of Host-Based Intrusion Detection System (HIDS) functionality. A HIDS runs on an endpoint (server or workstation) and monitors activity on that host, including operating system logs, file integrity, registry/config changes, system calls, application logs, and process behavior. Because it has direct visibility into what is happening locally, it can detect suspicious activity that may not be obvious from network traffic alone.

The clue that “attackers often attempt to disable or evade this type of monitoring to avoid being detected at the host level” also aligns strongly with HIDS. Adversaries commonly try to stop endpoint agents, tamper with logs, or evade detection by living-off-the-land techniques precisely because host-based sensors can catch actions like privilege escalation attempts, persistence mechanisms, malicious process launches, or unauthorized modifications to critical files and configurations.

Why the other options are not the best match:

A Network-Based Firewall (A) is a perimeter or network control that filters traffic based on rules (IPs, ports, protocols). It does not typically record detailed local file/process/configuration events on a single workstation.

A Host-Based Firewall (B) resides on the endpoint but primarily controls inbound/outbound network connections at that host. While it can log connection attempts, it is not chiefly designed to track file access, configuration integrity, or process execution.

A Network-Based IDS (C) analyzes traffic on the network segment (via taps/SPAN) to identify suspicious patterns. It does not require installing an agent on a single workstation and lacks direct visibility into local file and process events.

Therefore, the security system Olivia is demonstrating is D. Host-Based Intrusion Detection System.

The correct answer is C, Supply chain risk. A Java application commonly depends on third-party libraries, frameworks, packages, and modules. When those dependencies are outdated and have known CVEs, the application inherits the weakness even if the organization’s own custom code is secure. CEH web application security material describes this as using components with known vulnerabilities: third-party components may themselves be vulnerable, and if vulnerable components are used, the new application becomes vulnerable. CEH-aligned OWASP coverage also explains that libraries, frameworks, and software modules often run with high privileges, and exploitation of a vulnerable component can lead to serious impacts such as data loss, server takeover, or undermining application defenses. CSRF tricks authenticated users into submitting unwanted requests, XSS injects malicious scripts, and DoS targets availability. The key risk here is dependency exposure through the software supply chain.

Comprehensive and Detailed Explanation From CEH v13 Guide Topics:

The correct answer is D. nmap -T4 -F 10.10.0.0/24. The objective is to quickly enumerate hosts within the same subnet as the compromised server (10.10.0.5), which belongs to the 10.10.0.0/24 network.

In Nmap, the -F (Fast Scan) option scans only the most commonly used ports instead of the full port range, significantly reducing scan time. Combined with -T4, which increases scan speed through a more aggressive timing template, it is the fastest option among the choices provided for rapidly identifying active systems and services on the subnet.

Option A (-q) does not perform host enumeration and is not a standard Nmap host-discovery optimization. Option B (-O) performs OS detection, which generates additional probes and takes longer than necessary when the goal is simply to identify systems quickly. Option C (-r) scans ports sequentially and targets the wrong subnet (10.10.1.0/24), making it incorrect.

From a CEH reconnaissance and network scanning perspective, when speed is important, security professionals commonly use optimized Nmap scans such as Fast Scan and aggressive timing templates to identify live hosts efficiently before conducting deeper enumeration activities.

The scenario points to a JavaScript-based keylogger because the data capture occurs entirely within a web page and does not require installing software on the victim’s machine. In CEH-aligned social engineering and web attack concepts, phishing pages commonly include client-side scripts that capture form inputs in real time. When a user types credentials into a fake login form, JavaScript event handlers can record keystrokes or the final field values and transmit them to an attacker-controlled endpoint. This explains why Tyler’s “payload” works without local privilege, without dropping executables, and without triggering traditional antivirus focused on file-based malware. The key detail is that “captured keystrokes came exclusively from a web-based form embedded in the fake login page,” which matches browser-based capture rather than OS-level logging.

The other options imply deeper system access than the prompt describes. A keyboard keylogger typically operates at the operating-system level by intercepting keyboard input system-wide, which usually requires running code on the host and is more likely to be detected by endpoint protections. A hypervisor-based keylogger is a highly advanced technique that relies on virtualization-layer control and is not consistent with a simple phishing web page. An application keylogger usually targets specific processes on the endpoint (such as browsers or email clients), again requiring execution on the local machine.

From a defensive viewpoint emphasized in CEH, mitigations include user awareness training to spot phishing pages, enforcing MFA to reduce the value of stolen credentials, using anti-phishing protections and URL filtering, monitoring for lookalike domains, and deploying browser and email security controls that detect credential-harvesting pages and suspicious form-post destinations.

Priya is performing Verification because the team has already completed the remediation work (patches and fixes), and is now conducting follow-up scans and attack-surface review to confirm that the applied changes actually resolved the identified vulnerabilities. In a standard vulnerability-management lifecycle, remediation is the phase where vulnerabilities are addressed through actions such as patching, configuration hardening, compensating controls, or removing vulnerable services. Verification comes immediately after remediation to ensure fixes are effective, nothing was missed, and no new issues were introduced.

The scenario’s sequencing is the strongest clue: “already applied patches and fixes” means remediation is done; “run follow-up scans…to confirm” indicates validation of remediation outcomes; and “only after this step will she prepare a compliance report” reflects that organizations typically require evidence that remediation is effective before reporting status to leadership or auditors. Verification often includes rescanning the affected assets, checking configuration baselines, validating that vulnerable versions are no longer present, ensuring services are running as intended, and confirming that the original finding cannot be reproduced.

Why the other options do not match:

Remediation (D) would be the patching/fixing activity itself, which has already occurred.

Risk Assessment (C) is the prioritization and impact evaluation stage, typically performed before remediation to decide what to fix first and how urgently.

Monitoring (A) is ongoing observation and continuous assessment (tracking exposure, trends, new vulnerabilities), but Priya’s specific task is a post-fix confirmation step, which is verification.

Therefore, the correct phase is B. Verification.

CEH v13 identifies misconfigured cloud security groups as the leading cause of cloud data exposure. Open ports, public storage buckets, and overly permissive firewall rules frequently expose sensitive data.

Brute force and DoS do not directly expose stored data, and side-channel attacks are rare and advanced.

The described behavior aligns precisely with ARP spoofing, also known as ARP poisoning, a common man-in-the-middle attack technique covered extensively in CEH materials. ARP operates at Layer 2 of the OSI model and is responsible for mapping IP addresses to MAC addresses within a local network. Because ARP lacks authentication mechanisms, any host can send forged ARP replies to other devices on the LAN.

In this scenario, Marcus injects crafted messages that alter how two hosts identify each other. This strongly indicates forged ARP replies were sent to both the payroll workstation and the authentication server. By telling each system that his machine’s MAC address corresponds to the other party’s IP address, Marcus positions himself logically between the two endpoints. As a result, traffic is transparently routed through his system without requiring changes to switch configurations, proxies, or VPN tunnels.

This technique enables interception and potential modification of credentials in transit. DNS spoofing affects domain name resolution rather than direct Layer 2 host identification. MAC flooding overflows the switch CAM table to force broadcast behavior but does not specifically manipulate IP-to-MAC mappings between two targeted hosts. Switch port stealing targets MAC table entries but does not rely on altering host identity mappings in the same way ARP poisoning does.

Therefore, ARP spoofing is the most accurate technique described in this scenario.

The correct answer is D. Set Passwords for Apps to Restrict Others from Accessing Them.

The device already has an operating system passcode, but the weakness appears after the phone is unlocked. The financial application opens directly to sensitive dashboards without requiring any additional application-level authentication. The most direct mitigation is to require a separate password, PIN, biometric prompt, or reauthentication control for sensitive corporate applications.

CEH mobile/BYOD material explains that BYOD introduces security and control challenges because personally owned smartphones and tablets access organizational resources. Mobile Device Management solutions commonly enforce policies such as passcodes, remote locking, remote wipe, root/jailbreak detection, application deployment, monitoring, and policy enforcement .

Option A. Use Encryption Mechanism to Store Data is important for protecting data at rest, especially if the device is lost, but it does not stop access after the phone is already unlocked.

Option B. Set a Strong Passcode on the Device and Change It Relatively Often is already partially implemented because the OS requires a passcode. The issue is lack of app-level verification.

Option C. Maintain a Clear Separation between Business and Personal Data is useful for BYOD governance, but it does not directly prevent an unlocked device from opening sensitive dashboards.

Option D. Set Passwords for Apps to Restrict Others from Accessing Them is correct because it directly mitigates unauthorized access to corporate apps after device unlock.

Therefore, the best answer is D. Set Passwords for Apps to Restrict Others from Accessing Them.

According to the CEH Network and Perimeter Security module, one of the most effective and widely used firewall evasion techniques is the use of encrypted communication channels. When traffic is encrypted using protocols such as HTTPS, TLS, or VPN tunnels, traditional firewalls and packet-inspection tools may be unable to inspect payload contents unless SSL/TLS inspection is explicitly enabled.

CEH documentation explains that attackers commonly encrypt command-and-control (C2) traffic to:

Blend in with legitimate encrypted traffic

Bypass content-based inspection

Evade signature-based detection

Option B is therefore correct.

Option A (IP spoofing) is less effective against stateful firewalls.

Option C is a human-focused attack, not firewall evasion.

Option D has no relevance to firewall bypass techniques.

CEH highlights encryption misuse as a major blind spot in perimeter defenses.