ECCouncil 312-50v13 Dumps

CEH v13 identifies Man-in-the-Browser (MitB) attacks as one of the most dangerous and difficult-to-detect session hijacking techniques, especially in online banking environments. In MitB attacks, malware operates inside the user’s browser, intercepting and manipulating transactions in real time.

Unlike XSS or session fixation attacks, MitB bypasses server-side security controls entirely. Even strong encryption, multi-factor authentication, and secure cookies are ineffective because the attack occurs after authentication, within a trusted session.

Passive sniffing is limited by encryption, and session fixation relies on poor session management. Covert XSS requires injection points and is more easily mitigated.

CEH v13 emphasizes that MitB attacks can modify transaction details without user awareness, making detection extremely difficult. Therefore, Option B is correct.

According to CEH v13 System Hacking and Web Application Hacking, once reconnaissance and footprinting are complete, attackers typically move into controlled exploitation while maintaining stealth. Since the CEH has already identified a session hijacking vulnerability, leveraging that weakness is the most logical and stealthy progression.

Session hijacking allows attackers to impersonate legitimate users without triggering authentication alerts, making it significantly less detectable than brute-force or scanning activities. Option B aligns with CEH methodology: hijacking a valid session provides authorized-level access, which can then be abused to make configuration changes discreetly.

SQL injection (Option A) may trigger database errors and IDS alerts. Brute-force attacks (Option C) are noisy and easily logged. Automated vulnerability scanning (Option D) generates excessive traffic and is typically avoided once exploitation begins.

CEH v13 emphasizes using already-identified weaknesses and minimizing footprint during exploitation. Therefore, Option B is correct.

In CEH v13 Mobile, IoT, and OT Hacking, firmware-level attacks on Programmable Logic Controllers (PLCs) are categorized as high-impact and stealth-oriented threats, often designed to evade traditional network-based defenses. Malicious firmware compromises the integrity of the device itself, allowing attackers persistent and covert control over industrial processes.

The first and most critical step is to verify the integrity of the firmware and software running on the PLCs. CEH v13 emphasizes that before containment or mitigation actions are applied, accurate identification and confirmation of compromise must occur. Firmware inspection enables analysts to detect unauthorized code injections, modified logic blocks, altered checksums, or tampered boot loaders—hallmarks of OT malware such as Stuxnet-like attacks.

Immediate isolation (Option A) may be necessary later, but premature isolation can disrupt industrial operations and destroy volatile forensic evidence. IDS enhancements (Option C) focus on traffic patterns and are ineffective against firmware-resident malware. Restricting remote access (Option D) is preventative but does not validate or remove an existing firmware compromise.

CEH v13 stresses that OT environments require forensic verification at the device level, especially when abnormal behavior originates from controllers themselves. Firmware validation using vendor-approved tools and hash verification is the correct first step to confirm compromise and plan remediation without risking operational safety.

CEH v13 emphasizes that advanced injection attacks often evade input validation through encoding and obfuscation. A Web Application Firewall (WAF) with evasion detection can analyze request patterns, payload behavior, and anomalies in real time.

Code reviews are important but reactive. SIEM correlates logs after attacks. 2FA does not prevent injection.

Thus, Option B provides the most effective immediate protection.

The correct answer is Search Engine Phishing. CEH social engineering material explains that search engine phishing involves creating fraudulent websites and manipulating search visibility so that victims discover and visit the malicious site through search results rather than through a direct email or message lure. In this scenario, patients searching for the clinic’s appointment system are led to a fake portal that closely resembles the official one and is positioned prominently in search engine results. That is the defining pattern of search engine phishing. Pharming would involve silently redirecting users to a fraudulent site through DNS or host-resolution manipulation, but the question specifically states that internal DNS servers were not altered and that users voluntarily navigated there through search results. Spear phishing would require targeted communications sent directly to victims, and whaling is aimed at high-profile executives. CEH guidance emphasizes that search engine phishing can be especially effective because users believe they are independently finding the legitimate service. Since the attacker relied on a cloned portal and manipulated search visibility rather than direct messaging or DNS tampering, Search Engine Phishing is the best answer.

CEH v13 explains that WPA3 introduces SAE (Simultaneous Authentication of Equals), which resists traditional offline dictionary and brute-force attacks by removing crackable handshake material. Because WPA3 prevents attackers from capturing a reusable handshake, the most practical offensive method is to force a downgrade attack, tricking clients into associating using WPA2 instead of WPA3. Once the victim reconnects under WPA2-PSK, the attacker captures the standard 4-way handshake, which can then be cracked offline using dictionary or GPU-accelerated brute-force methods. CEH discusses downgrade attacks as a significant real-world threat when mixed-mode configurations are enabled or when access points fail to enforce strict WPA3-only operation. Options B and C are ineffective because WPA3 handshake materials cannot be brute-forced offline. Option D is unrelated to Wi-Fi encryption. Downgrading to WPA2 is the most effective and widely documented attack path.

The observed characteristics point most strongly to WPA2 because the scenario explicitly identifies CCMP-like headers and AES-based encryption, along with replay protection using a packet number (PN) and the familiar four-way handshake. WPA2 (based on IEEE 802.11i) replaced older approaches that relied on RC4 and TKIP, introducing AES-CCMP as the standard data confidentiality and integrity mechanism for Wi-Fi protected networks. CCMP uses AES in a mode designed for wireless frames and includes a per-packet number to prevent replay attacks.

The mention that these features were “introduced to replace older TKIP/RC4 approaches” is a major clue. Original WPA was designed as a transitional upgrade over WEP and commonly used TKIP with RC4, whereas WPA2 standardized the stronger AES-CCMP mechanism. The four-way handshake is used to derive and install fresh session keys (pairwise transient keys) between the client and access point, and the packet number increases with each encrypted frame to provide replay protection and maintain encryption correctness.

Why the other options don’t fit as well:

WEP (D) uses RC4 with weak IV handling and lacks the robust key management and handshake properties described.

WPA (B) typically centers on TKIP/RC4 rather than AES-CCMP as the defining feature set, especially in CEH-style distinctions.

WPA3 (C) introduces improvements such as SAE (Simultaneous Authentication of Equals) replacing the legacy PSK handshake method in WPA2-Personal, and enhanced protections (e.g., stronger password-based authentication). While WPA3 can still use AES-based encryption, the scenario’s emphasis is on CCMP/AES replacing TKIP/RC4—most directly the WPA2 shift.

Therefore, the access point is most likely using A. WPA2.

The correct answer is A, Lateral movement. Lateral movement occurs after initial compromise, when an attacker moves from one system to other internal hosts, accounts, or resources. This phase is especially difficult to detect without centralized logging because evidence is scattered across many endpoints, servers, authentication systems, and network devices. CEH incident response and SOC concepts emphasize SIEM functions such as identifying, monitoring, recording, auditing, and analyzing security incidents, which depend heavily on centralized log collection and correlation. CEH foundation material also notes that when audit/event logs are not properly configured or maintained, incident investigation becomes extremely difficult. In hacking methodology, expanding control from one host to other hosts in the network is described as takeover, which maps closely to lateral movement. Recon, delivery, and initial access may be visible at perimeter or endpoint controls, but lateral movement requires cross-system correlation, making it the hardest phase to detect without centralized logs.

The best answer is Corporate Espionage. CEH reconnaissance coverage explains that footprinting can be used not only for technical attack preparation but also for competitive intelligence gathering against organizations. In this scenario, a rival company appears to have derived meaningful strategic information about product design, pricing, and roadmap decisions from publicly available data and external disclosures before launch. The resulting harm is not just accidental exposure in the abstract; it is the use of collected intelligence to gain a business advantage over the target organization. That makes corporate espionage the most accurate classification. Information leakage is certainly part of the pathway, because some information had to be exposed or inferable from public sources, but the threat asked for is the footprinting-related consequence represented by the competitor’s behavior. Business loss describes an impact, not the threat category itself. Social engineering would require manipulative interaction with people, which is not stated here. CEH materials note that careless public disclosures, metadata, career postings, partner information, and strategic announcements can all support footprinting by competitors or adversaries. When such data is systematically collected to mirror or undermine business strategy, the activity is best described as corporate espionage.

The correct answer is B because the question directly describes a web application deserializing untrusted data, which is the classic condition for insecure deserialization. Deserialization is the process of converting serialized data back into an object or usable program structure. When an application accepts serialized data from an untrusted source and processes it without proper validation, integrity checking, or type restrictions, an attacker may manipulate the serialized object and influence application logic. In serious cases, this can result in remote code execution, privilege escalation, authentication bypass, or application takeover. The CEH web application security material maps this issue to OWASP web risks, where insecure deserialization is identified as a flaw that can lead to remote code execution attacks, which are among the most severe application impacts. SSTI involves server-side template injection, SQLi targets database queries, and XSS executes script in a user’s browser. Since the question specifically mentions untrusted deserialized data causing RCE, the precise flaw is insecure deserialization.

The correct answer is B. Use a scan tool like Nessus. In CEH vulnerability assessment and reconnaissance concepts, vulnerability scanners are used to discover security weaknesses on systems, applications, services, and network devices. Nessus is a widely known vulnerability assessment tool that can scan Windows-based systems for missing patches, weak configurations, open ports, insecure services, outdated software, and known vulnerabilities.

Option A is not the best answer because MITRE CVE provides vulnerability information, but it does not directly assess whether a specific Windows computer is vulnerable. Option C is related to system imaging or forensic preparation, not vulnerability discovery. Option D, Windows Update, helps install patches, but it does not perform a complete vulnerability assessment or detect misconfigurations and exposed services.

For a healthcare provider, vulnerability scanning is especially important because systems may process sensitive patient or business data. A scanner such as Nessus gives structured results that can be prioritized and remediated.

Therefore, the best approach is to use a scan tool like Nessus.

Whaling is the correct answer because the scenario describes a highly targeted phishing attempt aimed at a “big fish”—a senior executive (the CEO). In CEH terminology, whaling is a specialized form of phishing that focuses on high-profile, high-authority individuals (e.g., CEOs, CFOs, directors) to maximize impact. These targets often have access to sensitive data, financial approvals, privileged systems, and strategic communications, making their credentials significantly more valuable than those of typical employees.

The attacker (Clara) uses classic social engineering drivers emphasized in CEH training: authority (impersonating the legal department), urgency/fear (a “pending lawsuit”), and trust in internal processes (a link to a supposed internal portal). This combination is designed to short-circuit normal verification behavior and prompt quick compliance. The inclusion of a credential-harvesting link aligns with common phishing goals: capturing usernames/passwords, enabling account takeover, and potentially facilitating broader compromise (e.g., email access for business email compromise, lateral movement, or privileged escalation).

Why the other options are less accurate: Spear phishing is also targeted, but it is a broader category aimed at specific individuals or groups at any level. The defining clue here is the executive-level target, which elevates it to whaling. Clone phishing involves copying a legitimate email previously received and swapping a malicious link or attachment—this detail is not present. Consent phishing typically abuses legitimate OAuth/app consent flows rather than a fake portal requesting credentials.

A Directory Traversal attack, also known as path traversal, exploits weaknesses in how a web server or web application processes user-supplied file and directory paths through URLs or parameters. In CEH-aligned terminology, the attacker crafts requests that use traversal sequences such as dot-dot-slash patterns or encoded equivalents to escape the intended web root or permitted directory and reach sensitive locations on the underlying file system. The question states Sofia “manipulates resource paths” and successfully accesses “restricted system files,” revealing “sensitive configuration data.” This is the defining outcome of directory traversal: unauthorized access to files that should never be directly retrievable via the web interface, including application configuration files, server configuration, environment files, or other OS-level resources.

The prompt also eliminates other options by describing what the issue is not. It is not header manipulation, which would be more consistent with HTTP response splitting or header injection behaviors. It is not cached content tampering, which points to web cache poisoning. It is not credential compromise, which would indicate password cracking. Instead, the root cause is explicitly “failure to validate input paths,” matching CEH emphasis on inadequate input validation and improper path normalization or canonicalization before file access. Defensive guidance typically focuses on strict allowlisting of accessible resources, canonicalizing paths and enforcing a fixed base directory, blocking traversal tokens and their encoded forms, using indirect references instead of raw file paths, and applying least-privilege permissions to reduce impact if traversal is attempted.

The method described—sending TCP packets with no flags set—is a NULL scan. In TCP header terminology, a NULL packet has all control flags cleared (no SYN, ACK, FIN, RST, PSH, URG). The scanner then interprets the target’s response behavior to infer port state. Traditionally, for many TCP/IP stacks, a closed port responds with RST, while an open port may respond with no reply (silence) because the packet does not correspond to any valid state in the TCP state machine. This behavior can vary by OS and filtering devices, but the defining characteristic is the “no flags” probe.

The scenario also highlights stealth: compared to a TCP connect scan, which completes a full three-way handshake and is easily logged, NULL scans can be less conspicuous because they avoid a normal connection setup. Some intrusion detection systems focus heavily on repeated SYN handshakes or completed connections; unusual flag scans may slip through weak detection, though modern IDS/IPS can still detect them.

Why the other options are incorrect:

TCP Connect Scan (A) uses the operating system’s connect() call to establish a full TCP connection; it is not a “no flags” technique and is generally noisier.

FIN Scan (B) sends packets with the FIN flag set; it is a different “stealth” scan type, but not “no flags.”

ACK Scan (D) sends packets with the ACK flag set and is typically used to map firewall rules (filtered vs unfiltered), not to determine open vs closed ports in the same way, and again it is not “no flags.”

Therefore, the scanning method is C. NULL Scan.

The correct answer is C. S/MIME.

S/MIME, or Secure/Multipurpose Internet Mail Extensions, is the email security standard used to provide encryption and digital signing for MIME-based email messages. The CEH cryptography reference describes S/MIME as a standard for public-key encryption and signing of MIME data . It is also defined as a standard for encrypting and authenticating MIME data, primarily used for Internet email .

This directly matches the scenario because the organization requires:

Confidentiality through email encryption.

Authentication through digital signatures.

PKI-based trust using certificates.

Compatibility with Microsoft Outlook environments.

Option A. FlowCrypt is incorrect because it is an email encryption tool/service, mainly associated with OpenPGP-based email encryption, not the standard being asked for.

Option B. RMail is incorrect because it is a secure email service/platform, not the core standardized PKI-based email encryption framework.

Option D. OpenPGP is incorrect because OpenPGP supports encryption and signatures, but it is not the best match where the requirement specifically emphasizes certificate authority-based PKI trust and Outlook-style enterprise certificate validation.

Therefore, the best answer is C. S/MIME.

The correct answer is C. Overwriting Data/Metadata.

The key clue is that the file contents could not be reconstructed because the physical sectors no longer contained recognizable fragments of the original material. Simple deletion removes file references from directory structures, but the underlying data may still remain recoverable until overwritten. Here, the original sector contents were replaced, which indicates overwriting.

Option A. Data Hiding in File System Structures is incorrect because the data was not hidden in alternate file system locations or metadata structures.

Option B. Data/File Deletion is incorrect because ordinary deletion would usually leave recoverable data remnants.

Option D. Artifact Wiping is broader and often refers to removing traces such as logs, history, temporary files, or forensic artifacts. The scenario specifically describes replacement of file-sector contents.

Therefore, the best answer is C. Overwriting Data/Metadata.

Application Flaws is the best classification because the root cause is a coding error in the application’s input handling that results in a buffer overflow. In CEH-aligned vulnerability categorization, application flaws include implementation mistakes such as improper bounds checking, unsafe string handling, and inadequate input validation. The scenario explicitly states Lucas used fuzz testing against input validation logic and triggered a buffer overflow using malformed taxpayer ID strings, then observed unintended disclosure of payroll data due to unchecked data boundaries. Those details point to defective code behavior at runtime, not an administrative or configuration issue.

Poor Patch Management typically refers to failing to apply vendor patches or updates, leaving known vulnerabilities exploitable. The prompt does not indicate the issue was a previously known, patched defect that remained unpatched; instead, it describes a newly discovered weakness traced to an internal module and a “coding oversight.” Misconfigurations or weak configurations involve insecure settings such as overly permissive access controls, exposed services, default credentials, or insecure cloud storage policies. None of those are the trigger here; the trigger is malformed input causing memory corruption. Design Flaws relate to weaknesses in the system’s architecture or security model, such as missing authorization logic, flawed trust boundaries, or insecure workflows. While poor design can contribute to impact, the specific vulnerability mechanism described is an implementation-level memory handling failure.

Therefore, the correct classification is Application Flaws, because the vulnerability is fundamentally an input-processing and bounds-checking defect in the application code that results in a buffer overflow and data exposure.

Cloud-based DDoS mitigation services provide upstream traffic scrubbing, detecting and filtering high-volume attacks such as DNS amplification and HTTP floods before the traffic reaches the victim’s network. These services use distributed infrastructures capable of handling multi-vector attacks that surpass the capacity of traditional on-premises firewalls and IDS. Traffic scrubbing centers distinguish legitimate traffic from malicious traffic, allowing normal operations to continue without service disruption.

The correct answer is D, Network traversal. In CEH system hacking and post-exploitation concepts, lateral movement refers to an attacker moving across a compromised environment from one host, account, or resource to another. After gaining initial access, the attacker may enumerate systems, harvest credentials, abuse trust relationships, access shared resources, or use remote administration protocols to reach additional machines. The uploaded hacking methodology material describes the “takeover” phase as expanding control from a single host to other hosts in the network, which directly aligns with lateral movement. Pivoting is closely related, but it is more accurately a technique used to route traffic through a compromised system to reach otherwise inaccessible networks. Privilege escalation means increasing permissions on a system, and data exfiltration means stealing or transferring data out of the environment. Since the question asks what lateral movement is, the most precise answer is network traversal.

The correct answer is B, Residual risk. In CEH risk-management terminology, residual risk is the amount of risk that remains after security controls, safeguards, countermeasures, or mitigation strategies have been applied. A penetration test identifies vulnerabilities, threats, and weaknesses that may expose an organization to risk. After the tester recommends controls such as patching, access control improvements, network segmentation, monitoring, hardening, or user awareness training, those controls reduce the likelihood or impact of exploitation. However, security controls rarely remove all risk completely. The remaining exposure is known as residual risk, and management must decide whether to accept, transfer, avoid, or further mitigate it. Inherent risk is the original level of risk before any controls are applied. Gap analysis is a comparison between the current security state and the desired or required state. Total risk usually refers to the overall risk before accounting for implemented safeguards. Therefore, the best term for risk remaining after controls is residual risk.

The correct answer is D. ntpq -p [host].

The scenario requires querying the active NTP service to review its current associations and operational state. The ntpq utility is designed to query and monitor the NTP daemon. CEH-aligned NTP enumeration material states that ntpq is a command-line utility used to query the NTP server, monitor ntpd operations, and determine performance. It also states that the -p option prints a list of peers known to the server and summarizes their state .

Option A. ntptrace is incorrect because ntptrace follows the chain of NTP servers back to the primary time source. The scenario specifically says Kevin is not tracing the upstream hierarchy.

Option B. ntpq [-inp] [-c command] [host] [...] is a general syntax form for ntpq, but the most precise command for viewing peer associations and state is ntpq -p [host].

Option C. ntpdc is incorrect because although ntpdc can query ntpd, it is more associated with querying daemon state and requesting state changes. The question asks for the command to review current associations and operational status, which is most directly matched by ntpq -p.

Option D. ntpq -p [host] is correct because it directly queries the NTP service and prints peer association/status information.

Therefore, the best answer is D. ntpq -p [host].

The correct choice is C because Nessus Essentials is fundamentally a vulnerability assessment scanner. Its core purpose is to identify security weaknesses by checking systems and services against a large vulnerability knowledge base, which includes detecting outdated or vulnerable versions of operating systems, server software, databases, web servers, and common network services. In practical scanning, Nessus performs remote checks such as banner/version identification, configuration and patch-level assessment (where possible), and vulnerability plugin checks to flag software releases that are known to be insecure or end-of-life. This directly matches the scenario emphasis: supporting “diverse technologies including operating systems, databases, web servers, and virtual environments,” and asking for a capability it provides “as part of its scanning process.”

Why the other options are incorrect:

A (Patch management) is not what Nessus Essentials is designed to do. Nessus identifies missing patches and vulnerabilities, but it does not serve as an operating system and third-party application patch deployment platform.

B (High-speed asset discovery) is more characteristic of dedicated asset discovery/attack surface tools or broader platform features; while Nessus can discover hosts during scans, “high-speed asset discovery” is not the defining, primary capability being tested here.

D (Agent-based detection) refers to endpoint agents running locally for continuous monitoring. Nessus Essentials is primarily used for scanner-driven vulnerability assessment; agent-based functionality is a separate approach/tooling concept and not the main Essentials scanning capability being targeted in this question.

Therefore, the best answer is C: Nessus Essentials is designed to scan and identify vulnerabilities, including detecting outdated/vulnerable versions across many server and service technologies.

CEH v13 explains that the Deep Web contains content not indexed by search engines, including exposed databases, misconfigured portals, leaked credentials, and internal documents.

This makes it a critical area to assess unintended data exposure. The Deep Web is not primarily for attacker profiling or insider detection.

Thus, Option D is correct.

In CEH v13 Information Security and Ethical Hacking Overview, script kiddies are defined as individuals with limited technical knowledge who rely on pre-written tools, scripts, and exploits created by others to carry out attacks. They typically lack a deep understanding of how the underlying exploits work.

CEH v13 categorizes attackers based on skill level and intent. Script kiddies sit at the lower end of the skill spectrum. They often download exploit kits, automated scanners, or attack frameworks and run them with minimal customization. While their attacks may be unsophisticated, they can still cause damage due to the availability of powerful tools.

Option B accurately reflects this definition. Options A and D describe skilled attackers or programmers, which contradicts the CEH classification. Option C is incorrect because ethical hackers use tools responsibly with authorization and possess a strong understanding of security principles.

CEH v13 emphasizes that although script kiddies are less skilled, they pose a risk because automation allows them to exploit known vulnerabilities at scale. This is why organizations must patch systems promptly and implement baseline security controls.

Thus, Option B is the correct answer.

CEH v13 explains that NTP (UDP port 123) can leak sensitive network information if misconfigured. When an NTP daemon allows unrestricted external queries (e.g., monlist or ntpq commands), attackers can enumerate internal IP addresses and hostnames.

This exposure is a known reconnaissance weakness and has been exploited in both information disclosure and amplification attacks. CEH v13 strongly recommends restricting NTP query access using access control lists.

DNS poisoning and honeypots do not explain legitimate NTP enumeration responses. Therefore, option D is correct.

In CEH network security concepts, a common way to verify whether a host is running a sniffer is to test for promiscuous-mode behavior using an active stimulus and then observing whether the suspected machine reacts to traffic it should normally discard. The “ping method” is a classic approach: the tester sends ICMP Echo Request traffic crafted so the Ethernet frame uses an incorrect destination MAC address, while the IP layer still targets the suspected host’s IP. Under normal NIC operation, frames with a destination MAC that does not match the interface (and is not broadcast/multicast) are dropped at the data-link layer and never reach the IP stack, so the host will not respond.

If the interface is in promiscuous mode, the NIC passes more frames up to the operating system for processing. In some configurations, this can allow the IP stack to see and respond to the ICMP request even though the frame’s MAC destination was wrong. That unexpected reply is used as an indicator that the host may be capturing traffic promiscuously, consistent with sniffer presence.

The other options are less aligned with the “classic active verification” described. Reverse DNS monitoring is an indirect heuristic and not a reliable confirmation of promiscuous mode. An NSE script is tool-specific rather than the classic foundational technique the question emphasizes. ARP-based methods exist for sniffer detection, but the option presented is less directly tied to the well-known ICMP incorrect-MAC confirmation described in CEH materials.

The correct answer is RSA. CEH cryptography coverage describes RSA as a widely used asymmetric algorithm that supports encryption and digital signatures and is commonly deployed in public-key infrastructures. The question states that the transaction data is hashed, the hash is signed with the sender’s private key, and the recipient verifies the signature with the matching public key. That is the classic RSA signature model presented in CEH materials. The additional clue is that the same algorithm is said to support encryption, digital signatures, and secure communications use cases. Diffie-Hellman is mainly a key exchange mechanism and is not used for digital signatures in the way described here. DSA is designed for digital signatures, but not for general encryption. ElGamal can support encryption and signatures, but CEH exam framing most strongly associates this full combination of encryption plus digital-signature verification with RSA. CEH references repeatedly emphasize RSA as the standard asymmetric cryptosystem for confidentiality, authentication, integrity, and nonrepudiation in enterprise communications. Because the described implementation combines hashing, private-key signing, and public-key verification within a broad asymmetric framework, RSA is the most accurate answer.

CEH v13 outlines insertion attacks as IDS evasion methods in which attackers send packets deliberately crafted so that the IDS processes them differently from the target host. In an insertion attack, malformed packets appear legitimate to the IDS—allowing malicious traffic to blend with benign inspection results—while the end host rejects or modifies the packets due to incorrect checksums, invalid flags, or protocol inconsistencies. As a result, the IDS sees one set of reconstructed data, while the actual host processes a different version or nothing at all. CEH emphasizes that intrusion detection systems may not follow full TCP/IP stack validation, making them susceptible to deception by malformed or borderline-conformant packets. Polymorphic shellcode (Option B) changes payload signatures, not packet structure. Session splicing (Option C) splits payload across packets to evade pattern matching but does not rely on checksum manipulation. Fragmentation attacks (Option D) divide traffic into smaller fragments, not alter validity fields. The described behavior fits insertion attacks precisely.

This scenario best illustrates impersonation, which is a core social engineering technique emphasized in CEH under pretexting and physical security testing. Impersonation occurs when an attacker assumes a believable identity, such as an IT technician, vendor, maintenance worker, or delivery person, to gain trust and bypass access controls. In the prompt, the red team member adopts a third-party IT technician role and is granted entry because the receptionist assumes the visit is legitimate and does not verify credentials. That is the defining moment of impersonation: exploiting human trust and procedural gaps to obtain unauthorized physical access.

While the attacker later observes open terminals, unattended printouts, and sticky notes, those observations are opportunistic data collection that becomes possible only after successful impersonation. Shoulder surfing is specifically observing a user entering credentials or viewing a screen while standing nearby, typically during active use. Eavesdropping focuses on capturing spoken or transmitted information, such as listening to conversations or intercepting communications. Dumpster diving involves retrieving sensitive information from trash or discarded materials in waste bins, not simply seeing sticky notes left on desks.

CEH guidance highlights that impersonation often succeeds when organizations lack visitor verification, badge enforcement, escort policies, and security awareness training. Controls include validating work orders, requiring government-issued ID, issuing visitor badges, escorting visitors, enforcing clean desk practices, locking workstations, and secure printing to prevent exposure of credentials and sensitive data.

The correct answer is C. Container Escape.

The scenario describes a compromised containerized workload breaking out of its intended isolation boundary and accessing host-level resources or adjacent workloads. This is the defining behavior of a container escape.

CEH-aligned cloud and virtualization material explains that containerization can suffer from container breakouts/leaks, where an attacker may gain unauthorized access to other containers on the same host, leading to privilege escalation and data leakage .

Option A. Man-in-the-Cloud Attack is incorrect because that attack abuses cloud synchronization tokens or cloud account access mechanisms, not container isolation boundaries.

Option B. Side-Channel Attack is incorrect because a side-channel attack infers sensitive data indirectly through shared resource behavior, timing, cache, or other indirect signals.

Option D. Golden SAML Attack is incorrect because Golden SAML involves forging SAML authentication assertions using stolen identity-provider signing material.

Therefore, the best answer is C. Container Escape.

The central failure in the scenario is that a lost smartphone remained capable of accessing sensitive data, which means the organization lacked an effective lost device response control. In CEH-aligned mobile security guidance, one of the most important protections for lost or stolen devices is the ability to remotely secure the endpoint by locking it and wiping corporate data. This is typically implemented through Mobile Device Management tools and enterprise mobility controls. Registering devices with a remote locate and wipe facility ensures the security team can immediately take action once a device is reported missing, reducing the window in which an attacker can use stored sessions, cached credentials, saved tokens, or application access to reach protected resources such as patient records.

Option C is the best answer because it addresses both key needs implied by the incident: location capability to aid recovery and remote wipe to eliminate data exposure if recovery is uncertain. In healthcare environments, where protected health information is highly sensitive, CEH documentation emphasizes compensating controls that protect confidentiality when physical control of the device is lost. Remote wipe supports incident containment by preventing further access and limiting data disclosure.

Option B only provides tracking and does not guarantee data protection if the device cannot be recovered quickly. Option A helps protect data in transit on untrusted networks, but it does not solve the risk of a stolen device already authenticated to internal systems. Option D can help overall hygiene, but antivirus and DLP do not reliably stop misuse of a legitimately authenticated, lost device. Remote locate and wipe is the most direct mitigation for this exact gap.

Comprehensive Explanation from CEH v13 Courseware:

CEH v13 describes worms as standalone malicious programs capable of self-replication without requiring user assistance. Unlike viruses, which need a host file and are triggered typically by user actions, worms propagate autonomously by scanning networks, exploiting vulnerabilities, or copying themselves to accessible machines. Worms are known for causing rapid, widespread damage by consuming bandwidth, degrading system performance, and creating backdoors for attackers. Classic examples such as Conficker, WannaCry, and SQL Slammer reinforce the destructive potential of automated propagation. CEH stresses that worms often use network shares, open ports, or unpatched vulnerabilities to move laterally. In contrast, keyloggers harvest keystrokes, ransomware encrypts data and demands payment, and viruses require user involvement to spread. The behavior in the scenario—automatic replication across the network—is the defining characteristic of worm activity according to CEH’s malware taxonomy.

The correct answer is C. Impersonation.

The scenario’s central action is that the assessor pretends to be a third-party IT technician to gain trust and physical access. CEH-aligned social engineering material defines impersonation as a technique where the social engineer pretends to be someone or something he or she is not, such as an employee, valid user, repairman, executive, help desk person, or IT security expert. This can result in physical access to restricted areas and disclosure of sensitive information, including credentials .

Option A. Shoulder Surfing is incorrect because shoulder surfing specifically involves looking over a user’s shoulder to observe credentials or sensitive activity. Although the assessor observes the environment, the primary technique used to gain access is impersonation.

Option B. Eavesdropping is incorrect because eavesdropping involves covertly listening to conversations or communications.

Option D. Dumpster Diving is incorrect because dumpster diving involves searching through trash or discarded materials for useful information. Sticky notes and printouts are mentioned, but the defining technique is the assumed identity of an IT technician.

Therefore, the best answer is C. Impersonation.

CEH identifies insecure data transfer as a critical IoT weakness. Outdated encryption protocols such as SSLv2 fail to protect confidentiality or integrity. Without strong encryption and authentication, attackers can intercept, decrypt, and manipulate video feeds.

The finding described maps directly to Insecure Data Storage. In CEH-aligned mobile security guidance and OWASP Mobile risk discussions, insecure data storage occurs when a mobile application saves sensitive information locally in a way that can be easily recovered by an attacker, especially on a rooted or jailbroken device where sandbox protections can be bypassed. Storing usernames and passwords in plain text is a high-severity example because it allows immediate account takeover and enables access to protected client records, case notes, and other confidential material.

Mobile devices routinely store app data in local file systems, shared preferences, databases, logs, or cached content. If sensitive data is stored without proper protections, an attacker with physical access, malware, backup extraction capability, or root access can read it directly. CEH materials emphasize that rooting dramatically increases attacker capability by permitting access to app directories and system areas that would otherwise be restricted. That is exactly what the scenario shows: credentials are recovered from the device once root access is available.

The best practice mitigation is to never store credentials in plain text. Use secure, OS-provided storage such as Android Keystore or iOS Keychain, apply strong encryption with keys protected by hardware-backed mechanisms when available, minimize what is stored locally, and ensure secrets are not written to logs or debug artifacts. Insecure Communication would involve weak transport protections, and Improper Credential Usage can include hardcoded credentials or poor authentication handling, but the specific issue here is plainly unsafe local storage of credentials, so Insecure Data Storage is the correct choice.

An HTTP flood is an application-layer (Layer 7) DoS/DDoS technique that targets web application resources by sending large volumes of seemingly valid HTTP GET/POST requests. Because the traffic can look “legitimate” at the protocol level, controls that primarily focus on network/transport characteristics (such as basic firewalls) are often insufficient. The tool described in the scenario is explicitly inspecting and filtering malicious HTTP traffic while allowing legitimate customer requests—that behavior aligns most directly with a Web Application Firewall (WAF).

A WAF is designed to protect web applications by analyzing HTTP/S requests and responses, applying security rules that detect and block abnormal or malicious patterns. In an HTTP flood scenario, a WAF can enforce rate limiting, detect request anomalies (e.g., repeated requests to resource-intensive endpoints like checkout), identify bot-like behavior, and apply signatures/behavioral policies to mitigate attacks while continuing to permit valid users. The key clue is the focus on HTTP-level inspection and filtering to maintain service continuity—a classic WAF use case during Layer 7 attacks.

Why the other options are less suitable:

A Load Balancer (A) improves availability by distributing traffic across servers, but it does not inherently inspect and filter malicious HTTP requests. It can help absorb load, yet it’s not primarily a security inspection/filtering control.

An Intrusion Prevention System (C) can block malicious activity, but many IPS deployments are stronger at network/transport-layer patterns and may not provide the same depth of application-aware HTTP policy enforcement as a WAF for targeted web endpoints.

A traditional Firewall (D) mainly filters by IP/port/protocol and cannot reliably distinguish malicious vs legitimate HTTP GET/POST floods when they use allowed ports (80/443).

The CEH IDS/IPS Evasion module describes packet fragmentation as a common evasion technique used to bypass signature-based detection.

Option B is correct.

Other options represent different attack categories.

CEH highlights reassembly normalization as a countermeasure.

The correct answer is B, Clickjacking Attack. Clickjacking is a web application attack in which an attacker tricks a victim into clicking on a hidden or disguised element different from what the victim perceives on the screen. The most common technique involves placing a transparent or invisible iframe over legitimate-looking content. When the victim clicks the visible button, image, or link, the click is actually directed to the hidden iframe controlled by the attacker.

In CEH web application hacking topics, clickjacking is considered a user-interface redress attack because it manipulates the user’s perception of the web page. Attackers use this technique to force users to perform unintended actions such as changing account settings, authorizing transactions, enabling webcams, downloading malware, or granting permissions on trusted websites while remaining unaware of the action being performed.

HTTP Parameter Pollution involves manipulating application parameters, HTML Injection inserts malicious HTML into a web page, and Session Fixation forces a user to use a predefined session identifier. Since the scenario specifically describes a transparent iframe tricking the victim into clicking hidden content, the attack is Clickjacking.

Answer: B QUESTION NO: 25 [Malware Threats]

What kind of detection technique is being used in antivirus software that identifies malware by collecting data from multiple protected systems and instead of analyzing files locally it ' s made on the provider ' s environment?

A. Heuristics based

B. Honeypot based

C. Behavioral based

D. Cloud based

Answer: D

The correct answer is D. Cloud based because the question describes an antivirus architecture where suspicious files, metadata, reputation information, and threat intelligence are collected from multiple protected endpoints and analyzed within the vendor’s cloud infrastructure rather than exclusively on the local machine. In CEH malware defense concepts, cloud-based detection leverages centralized analysis engines, reputation services, machine learning models, and global threat intelligence gathered from many endpoints. This approach enables rapid identification of emerging malware and zero-day threats because intelligence learned from one protected system can immediately benefit all other protected systems.

Heuristic-based detection focuses on identifying suspicious code characteristics and malware-like patterns. Behavioral-based detection monitors how a program behaves on a system, such as unauthorized registry changes, process injection, or unusual network activity. Honeypot-based solutions use decoy systems to attract and study attackers. None of these specifically describe offloading analysis to the antivirus provider’s environment. The key phrase in the question is that malware analysis is performed in the provider’s environment using information collected from many protected systems, which is the defining characteristic of cloud-based malware detection. Therefore, option D is the most accurate CEH-aligned answer.

The correct answer is D. Exposed Bearer Tokens in Logs.

The scenario states that authentication artifacts associated with Kubernetes service accounts are appearing in logs or system-generated output. If those values can be reused to access cluster resources, they are functioning as bearer credentials. A bearer token grants access to whoever possesses it, so exposing it in logs creates a serious privilege-reuse risk.

Option A. No Certificate Revocation is incorrect because the weakness does not involve inability to revoke TLS or client certificates.

Option B. Unauthenticated HTTPS Connections is incorrect because the issue is not that HTTPS connections lack authentication. The issue is that valid authentication tokens are being logged.

Option C. No Non-repudiation is incorrect because non-repudiation concerns proving who performed an action. The scenario concerns credential exposure.

Option D. Exposed Bearer Tokens in Logs is correct because service-account bearer tokens recorded in logs could be reused by anyone who can access those logs.

Therefore, the best answer is D. Exposed Bearer Tokens in Logs.

This scenario aligns with a Replay Attack against RF-based smart key systems, covered in CEH v13 IoT and OT Hacking. Attackers capture radio-frequency signals transmitted by key fobs and replay them to unlock vehicles.

CEH v13 emphasizes that detecting and preventing such attacks requires monitoring wireless RF signals for anomalies such as signal replay, interference, or jamming patterns. RF analysis helps confirm unauthorized signal capture and retransmission.

Firmware updates may mitigate future vulnerabilities, but confirmation requires RF monitoring. Physical surveillance and smartphone malware controls are unrelated to RF replay attacks. Therefore, option D is correct.

The correct answer is D, Least privilege. In Linux, sudo temporarily grants elevated/root-level privileges to execute administrative commands. The CEH-aligned principle of least privilege requires that users, services, and processes receive only the minimum permissions needed to perform their authorized tasks. Allowing passwordless sudo for multiple commands weakens this control because a normal user can execute privileged actions without reauthentication, increasing the risk of accidental misuse, insider abuse, credential compromise, or privilege escalation. CEH materials emphasize least privilege as an authorization control and also note that sudo provides temporary root privileges. Zero trust is broader and focuses on continuous verification, defense in depth uses layered controls, and CIA refers to confidentiality, integrity, and availability. The specific misconfiguration here is excessive privilege assignment, so the violated security principle is least privilege. A secure configuration should tightly scope sudo permissions to only required commands and users, require authentication where appropriate, and log privileged actions.

The described behavior matches DNS Zone Transfer Enumeration. In CEH reconnaissance, DNS enumeration aims to discover hosts and services by querying DNS records. A zone transfer is a special DNS operation intended for legitimate replication between an authoritative primary DNS server and its secondary DNS servers. When misconfigured, a DNS server may allow an unauthorized requester to perform a zone transfer, returning the entire DNS zone database. This can reveal extensive internal naming information such as subdomains, hostnames, mail exchangers, service records, and aliases, exactly like the “full list of internal mappings, including subdomains, mail hosts, and system aliases” described in the question. The clue “secondary system responds unusually” is especially telling, because secondary DNS servers are commonly the ones configured for replication and may be mistakenly left open to transfers from any host.

The other options do not fit the output. LDAP enumeration targets directory services and would not yield DNS-style mappings unless you already had directory access and queries. NTP enumeration relates to time synchronization services and can reveal time/server details, not comprehensive host/subdomain lists. NetBIOS enumeration focuses on Windows networking (names, shares, workgroups) typically on internal networks and would not produce a DNS zone’s record set.

CEH-recommended mitigations include restricting zone transfers to authorized secondary server IPs only, using TSIG keys for authenticated transfers, minimizing publicly exposed DNS data, splitting internal and external DNS (split-horizon), and continuously auditing DNS configurations to prevent inadvertent information leakage.

The correct answer is D. Application Keylogger because the scenario describes keystroke capture from desktop applications on a Windows workstation without installing kernel drivers and without requiring physical access or browser-level script injection. In CEH-aligned keylogger classifications, an application (user-mode) keylogger operates at the application layer by using user-space techniques such as hooking common Windows APIs (for example, keyboard input functions and message-handling routines) to intercept keystrokes as they are processed by applications. This enables logging of credentials typed into local programs, draft emails written in desktop clients, and sensitive text entered into business tools—exactly the outcome Tyler observed.

The question provides two strong eliminators. First, it states no kernel drivers were installed, which rules out kernel keyloggers that capture input at the kernel level (often requiring driver installation and deeper OS integration). Second, it states the attack did not require browser injection, which rules out a JavaScript keylogger (typically implemented by injecting script into a web page/application to capture form inputs within a browser session). It also explicitly notes that there was no physical device access, which rules out a hardware keylogger (a physical device placed between keyboard and computer or embedded in a keyboard) that requires in-person installation.

Application keyloggers are frequently used in post-exploitation because they can be deployed quickly with standard user-level privileges (though higher privileges may expand coverage), can target a broad range of applications, and can run covertly. From a defense perspective, monitoring for suspicious API hooking behavior, unusual process injection, abnormal input-capture patterns, and endpoint controls that detect credential access techniques are common countermeasures.

Therefore, given the constraints and the observed logging of desktop application input, the most likely keylogger type is an application keylogger.

The correct answer is Nikto. CEH web server security coverage identifies Nikto as a specialized open-source web server vulnerability scanner designed to assess HTTP and HTTPS services for dangerous files, insecure default content, outdated server versions, and version-specific problems. The scenario mentions examination of server headers, detection of installed web server software, checks for outdated components, identification of dangerous files and misconfigurations, SSL support, and exportable reporting. Those characteristics align closely with Nikto’s typical use in CEH-style web server assessments. OpenVAS, Nessus, and Qualys VM are broad vulnerability management platforms with much wider enterprise coverage, but the question describes a focused HTTP-server scanner rather than a full-spectrum infrastructure scanner. CEH materials frequently present Nikto in the context of web server enumeration and vulnerability discovery after the tester has identified the target web platform. It is especially useful for quickly checking internet-facing servers for known risky files, weak configurations, and outdated software. Because the assessment is centered on the specific exposure of web servers and matches the recognized feature set of Nikto, option D is the best answer.

The issue described is verbose error messages, where an application reveals excessive technical details when handling invalid input. The scenario states that the platform returns “detailed system information, including database query strings and directory paths” instead of a generic error. Exposing internal paths and query strings is a common symptom of verbose error handling: stack traces, SQL statements, file system locations, framework versions, and configuration hints can appear in responses when exception handling is misconfigured or when debug settings are enabled in production.

These details are valuable to attackers because they reduce guesswork. Directory paths can reveal the operating system, deployment layout, and sensitive file locations; database query strings can reveal table/column names and query structure, enabling more effective SQL injection payloads or targeted data extraction. Verbose errors can also leak usernames, internal hostnames, API endpoints, and even secrets if mishandled. Even if the initial invalid request does not compromise the system, the leaked information can significantly improve the attacker’s ability to craft subsequent attacks with higher precision.

Why the other options are less accurate:

Improper error handling (A) is a broader category and could include verbose errors, but the question’s best match is the specific symptom: detailed internal information disclosure.

Directory traversal (B) involves manipulating path input to access unauthorized files; here, the application is revealing paths due to errors, not being coerced into reading arbitrary files.

CORS misconfiguration (D) relates to cross-origin browser access controls and is unrelated to leaking stack traces or database queries.

Therefore, the correct answer is C. Verbose Error Messages.

The correct answer is A. A collision attack targets a hash function by attempting to find two different inputs that produce the same hash output. In CEH cryptography topics, hashing is a one-way mathematical function used mainly to verify integrity, not to encrypt data. A good hash should produce a unique fixed-length digest for each different input, and even a tiny change in the original data should create a very different hash value. CEH material states that, in hash algorithms, a collision occurs when two or more distinct inputs produce the same output. It also explains that collision attacks are attacks against hashing algorithms where two or more files create the same output, which should not normally happen. Option B is incorrect because public keys relate to asymmetric cryptography, not hash collisions. Options C and D are incorrect because collision attacks do not split hashes to recover plaintext or private keys.

The best choice is encrypting stored data with quantum-resistant algorithms because the scenario’s core risk is long-term confidentiality of data at rest in a cloud environment under a future where large-scale quantum computing could break widely used public-key schemes. In CEH cryptography coverage, the most direct way to protect confidentiality is to use strong encryption that remains secure against the expected attacker capabilities. “Harvest now, decrypt later” is a practical concern: adversaries can copy encrypted data today and wait until new capabilities make decryption feasible. Therefore, the control must be cryptographic and future-resistant, not merely procedural or architectural.

Option B aligns with post-quantum readiness by moving encryption and key-establishment mechanisms toward quantum-resistant primitives. This is especially important for protecting stored records over long retention periods. Even if symmetric encryption such as AES is generally more resilient to quantum attacks than classical public-key algorithms, organizations still must ensure appropriate key sizes, robust key management, and quantum-resistant approaches where public-key cryptography is used for key exchange, key wrapping, or digital signatures that support storage encryption workflows.

Option A, distributing fragments, can improve availability and limit exposure in some breach scenarios, but it does not replace encryption and does not guarantee confidentiality if fragments are obtained. Option C is not applicable because the problem is stored cloud data, not quantum communications. Option D is a good governance practice, but it is not itself a cryptographic control that ensures confidentiality. The priority, per CEH-aligned cryptographic defense principles, is quantum-resistant encryption and key management for data at rest.

Maria most likely used fileless malware, because the scenario explicitly describes malicious activity that does not write a payload executable to disk and instead executes entirely in memory using PowerShell and process injection. In CEH-aligned malware classifications, fileless malware is characterized by leveraging legitimate system tools (often called “living off the land” utilities) such as PowerShell, WMI, cmd.exe, or scripting engines to execute attacker-controlled code without creating traditional malware files on the filesystem. Since many legacy antivirus solutions depend heavily on signature-based scanning of files on disk, purely memory-resident execution can reduce or eliminate typical AV detections and leave minimal artifacts in standard AV logs.

The description also mentions that after a reboot the system returns to normal, which strongly supports fileless behavior: if the attacker did not establish persistence (for example via registry run keys, scheduled tasks, services, or WMI event subscriptions), then the in-memory code and injected instructions would be cleared when memory is reset. The “abnormal spikes in resource usage” are consistent with malicious scripts running inside a trusted process context, where attackers may inject or reflectively load code to blend into normal operating activity and evade straightforward monitoring.

Why the other options are incorrect: a rootkit primarily focuses on stealth through deep system-level hiding (often kernel/driver-level) and is commonly associated with persistent concealment rather than “no disk footprint” PowerShell-only execution. A trojan is typically a malicious program masquerading as legitimate software and usually involves a delivered executable or application. Ransomware is defined by encrypting data and extorting payment, which is not described here.

Thus, the technique most consistent with the test is fileless malware executed via PowerShell and memory-only injection.

This phase is Information Gathering, the first and most foundational step in an IoT penetration test methodology described in CEH-aligned material. The goal here is to build an accurate inventory of the IoT environment and understand how devices communicate, what hardware and software versions are present, and which protocols and interfaces are in use. Jordan is collecting device models, manufacturer names, firmware versions, and supported protocols such as Zigbee and BLE. That activity maps directly to enumeration and profiling of the target IoT ecosystem, which is performed before any intrusive testing. In CEH methodology terms, this step helps identify the attack surface, including wireless interfaces, management ports, cloud backends, mobile apps, and gateways that bridge IoT networks to enterprise networks.

Information gathering is crucial because IoT risk is highly dependent on specific device types and firmware builds. Knowing a firmware version can reveal whether known CVEs apply, whether default credentials are likely, or whether insecure services are commonly enabled. Identifying Zigbee and BLE indicates potential avenues for wireless assessment, such as insecure pairing, weak encryption or key handling, misconfigured access control, and protocol-specific weaknesses.

The other options occur later. Vulnerability scanning is the step where the tester actively checks the identified devices and services for weaknesses using scanners, enumeration probes, or targeted validation. Launch attacks and gain remote access are exploitation steps that follow planning and discovery. Since Jordan is only documenting and understanding the ecosystem, the correct step is Information gathering.

The technique demonstrated is Elicitation. CEH social engineering coverage explains elicitation as the art of drawing out information from a target through conversation without making direct or obviously suspicious requests. The attacker carefully guides dialogue so the victim voluntarily reveals sensitive details, often believing the discussion is normal, harmless, or professionally relevant. That is exactly what happens here: the person poses as a recruitment consultant, builds rapport through multiple informal interactions, and gradually obtains information about research, timelines, and internal code names. No credentials are requested and no overt trade or reward is offered, so this is not quid pro quo. It is also not baiting, which typically relies on an enticing object or opportunity, nor a honey trap, which usually involves romantic or intimate manipulation. CEH materials emphasize that elicitation is especially dangerous because the victim often does not realize that the attacker’s questions are strategically sequenced to extract valuable intelligence piece by piece. The gradual, conversational, non-confrontational harvesting of sensitive project details in this scenario is the defining pattern of elicitation.

The activity described is passive wireless packet capture in monitor mode—specifically collecting management frames (such as beacon frames and probe responses) and observing client/AP interactions (including authentication-related frames) while not injecting or transmitting anything. In the Aircrack-ng suite, the tool designed for exactly this reconnaissance-and-capture purpose is Airodump-ng.

Airodump-ng is the component that listens on the air interface once the card is placed into monitor mode, then captures 802.11 frames and displays useful reconnaissance data such as BSSID, channel, encryption type, signal strength, and associated clients (stations). Critically, it can write captured traffic to files (e.g., .cap) for offline analysis—which matches the scenario’s “record into a capture file for later offline analysis.” This is a common CEH workflow: reconnaissance → capture → analyze, keeping the initial step non-intrusive.

By contrast:

Aireplay-ng (A) is primarily used for active attacks / packet injection (e.g., deauthentication, replay) and would typically involve transmitting frames.

Aircrack-ng (B) is used mainly for key cracking (WEP/WPA/WPA2 handshakes) after capture, not for passive collection itself.

Airbase-ng (C) focuses on creating a rogue AP / MITM-style setups, which is also an active transmission role.

So, for silent monitoring + capturing beacons/probes/auth frames to a file, the best match is D. Airodump-ng.

According to the Certified Ethical Hacker (CEH) IoT, OT, and SCADA Security module, side-channel attacks exploit indirect information leaks such as power consumption, electromagnetic emissions, timing variations, or thermal output rather than software vulnerabilities.

Option A is correct because monitoring hardware-level anomalies is the primary method for detecting side-channel exploitation. CEH materials emphasize that these attacks bypass traditional security controls.

Option B relates to cryptographic weaknesses, not side-channel analysis.

Option C addresses interface misuse, not covert data leakage.

CEH highlights that SCADA systems are especially vulnerable due to legacy hardware and limited monitoring capabilities.

The correct answer is Inference-Based Assessment. CEH vulnerability assessment material explains that some scanning approaches do not blindly run every possible test against a host. Instead, they infer what checks are appropriate by first identifying protocols, ports, and services, then dynamically selecting tests that are relevant to those discoveries. The scenario describes exactly that behavior: the platform catalogs communication protocols, determines which services are associated with the observed ports, and automatically adjusts the vulnerability tests during execution. This inference-driven logic improves efficiency and reduces unnecessary probing because the scanner tailors its checks to the environment it discovers. Service-based and product-based phrasing may sound plausible, but the question is specifically about the scanning logic and decision model rather than the type of vendor offering. Tree-based assessment does not best describe the sequence presented. CEH guidance uses inference-based assessment to describe scanners that progressively refine their actions using information learned during earlier scanning stages. Because the selection of tests depends on discovered service characteristics and adapts as the scan proceeds, Inference-Based Assessment is the most accurate answer.

The correct answer is B. Dynamic Testing.

The analyst is interacting with the running application, sending structured test inputs, and observing live response differences. That is dynamic testing. The payloads are not random; they are deliberate SQL injection probes designed to determine whether user-controlled input influences backend SQL logic.

CEH-aligned SQL injection material explains that testers can identify SQL injection by submitting inputs such as a single quote and observing whether errors or behavioral differences appear. It also references testing inputs such as ' OR 1=1-- to determine whether the application is vulnerable . CEH material further explains that SQL injection vulnerability detection includes injecting code into input fields and observing responses, error messages, GET/POST values, cookies, and string values .

Option A. Static Testing is incorrect because static testing reviews source code or configuration without executing the application.

Option C. Function Testing is incorrect because the purpose is not ordinary feature validation; it is security testing of query behavior.

Option D. Fuzz Testing is incorrect because fuzzing usually involves sending large volumes of random or unexpected input. The scenario uses targeted SQL logic tests.

Therefore, the best answer is B. Dynamic Testing.

Once the base DN is identified through LDAP namingContexts, CEH teaches that the next step in enumeration is to query the directory tree using this DN. This allows retrieval of users, groups, computers, and other AD objects. LDAP-based enumeration requires valid search filters rooted in the base DN.

The correct answer is Follow TCP Stream. CEH packet analysis and sniffing material explains that Wireshark can reconstruct an application conversation from captured packets belonging to the same TCP session. When investigating HTTP logins, this feature is especially useful because it allows the analyst to view the reassembled request and response content in readable sequence rather than examining individual packets one by one. If credentials are being transmitted in cleartext over HTTP, Follow TCP Stream can reveal them directly within the reconstructed session. Filtering by IP address or by protocol can narrow the visible traffic set, which is helpful, but those functions alone do not reconstruct the full conversation. Monitoring specific ports is also less precise for understanding the actual payload content. CEH guidance emphasizes that once suspicious or relevant traffic is identified, stream reconstruction is a powerful method for analyzing what data was exchanged between client and server. Since Thomas is specifically trying to isolate and read unencrypted HTTP authentication exchanges during login sessions, Follow TCP Stream is the Wireshark feature that best supports both visibility and interpretation of those credentials in context.

CEH teaches that insufficient input validation on mobile applications enables code injection attacks. Injecting JavaScript or crafted payloads into fields validates whether the application improperly processes untrusted data. If executed, it confirms that the app is vulnerable to injection-based attacks.

The behavior described matches the countermeasure commonly referred to in CEH materials as escaping or encoding special characters, most notably the single quote character. SQL injection frequently relies on breaking out of a quoted string in the SQL statement using the single quote, then appending logical operators such as OR 1=1, comments, or additional clauses. When an application replaces special characters with escaped equivalents before the SQL statement is executed, it attempts to ensure the input is treated purely as data rather than executable SQL syntax. A classic example is transforming a single quote into an escaped form such as \ ' or doubling it to ' ' depending on the database and escaping rules. By doing so, the database parser interprets the quote as part of the literal string value, preventing the attacker from terminating the string and altering query logic.

Option B is therefore the best fit because it precisely describes encoding or escaping the single quote, which is the most commonly targeted delimiter in SQL injection payloads. Option A, user input validation, is broader and typically refers to allowlisting accepted characters and formats, but the question specifically emphasizes replacement with escaped equivalents rather than rejecting invalid input. Option D, parameterized queries or prepared statements, is the strongest modern control recommended in CEH guidance because it separates code from data at the API level, but it is different from character escaping and does not rely on rewriting input characters. Option C limits damage but does not prevent injection. The observed mechanism is clearly single-quote encoding.

The CEH v13 courseware states that insecure communication occurs when mobile applications transmit sensitive data over unencrypted or weakly encrypted channels, exposing information to interception. When an application uses plain HTTP or does not properly validate certificates, attackers can place themselves between the client and server using a man-in-the-middle (MitM) attack. This allows them to read session tokens, credentials, API keys, or personal user data as it travels across the network. CEH materials emphasize that MitM attacks are the primary exploitation technique for insecure data transmission because they exploit weaknesses in transport-layer security rather than weaknesses in backend code or authentication mechanisms. SQL injection and CSRF attacks target web application logic, not transport encryption. Brute-force attacks target authentication mechanisms and are unrelated to how data is transmitted. Therefore, the most effective exploitation method is intercepting traffic via MitM to capture or manipulate unencrypted communications.

The correct answer is A. Call Spoofing because the defining behavior in the scenario is manipulating the caller ID information so that the victim’s phone displays a trusted number—specifically, the credit union’s official line. In CEH-aligned social engineering and mobile attack discussions, call spoofing is a technique where an attacker falsifies caller ID data to impersonate a legitimate organization, department, or known contact. This increases credibility and exploits human trust in recognized numbers, making victims more likely to comply with sensitive requests such as disclosing usernames, passwords, or one-time codes.

The attack is also a form of vishing (voice phishing), where the attacker uses phone calls and persuasive pretexts (“mandatory security check”) to trick employees into revealing credentials. The success factor here is the authority and legitimacy signal created by the spoofed number. When staff see what appears to be an official institutional phone number, they are more likely to assume the call is authentic and bypass normal verification steps, especially under time pressure or when framed as a security requirement.

Why the other options are incorrect: OTP hijacking refers to stealing or intercepting one-time passwords (for example via SIM swap, malware, or social engineering focused specifically on MFA/OTP codes). While the attacker could ask for OTPs, the scenario’s core mechanism is the spoofed caller ID, not OTP interception. Bluebugging is a Bluetooth-based attack that gains unauthorized control over a device through Bluetooth vulnerabilities; it is unrelated to caller ID impersonation. SMiShing is phishing via SMS/text messages, not a voice call.

Therefore, the mobile attack vector demonstrated—displaying a trusted institutional number to deceive employees during a credential-harvesting call—is call spoofing.

VLAN hopping is an advanced attack technique described in CEH materials, used to bypass VLAN segmentation by exploiting switch misconfigurations or vulnerabilities. Two primary methods—switch spoofing and double tagging—allow attackers to gain access to traffic from VLANs they are not authorized to view. This technique enables the capture of inter-VLAN traffic without requiring administrative privileges or triggering security tools. Port mirroring requires administrative control and is not an attack method. Rogue DHCP servers target IP assignment, not VLAN segmentation. ARP poisoning is effective only within a single broadcast domain and cannot traverse VLAN boundaries. Because the objective is to silently access multiple VLANs despite enforced segmentation, VLAN hopping is the correct technique as per CEH’s network perimeter attack methodology.

The correct answer is IMDS Attack. CEH cloud security material explains that cloud instances often obtain temporary credentials from an Instance Metadata Service, commonly called IMDS, which supplies identity and role-based access details to workloads running on the virtual machine. If an attacker gains code execution on the instance, even through a separate web application flaw, the attacker may query the metadata endpoint locally and retrieve temporary credentials associated with the instance role. That is precisely what happens in this scenario: the tester runs a script on the VM, extracts temporary role credentials, and then uses them to enumerate storage and other services within the same cloud account. Wrapping attacks target SOAP message manipulation, while cloud snooper and CP DoS do not match the behavior of harvesting role credentials from local cloud metadata. CEH emphasizes that overprivileged instance roles and exposed metadata access can allow attackers to pivot from a single compromised workload into broader cloud service access. Because the key step is retrieving temporary credentials from the instance metadata service, the best match is IMDS Attack.

CEH v13 highlights behavioral analytics as one of the most effective techniques for identifying ambiguous or stealthy threats such as data exfiltration, command-and-control traffic, and insider abuse. When interactions appear suspicious but not definitively malicious, behavioral profiling provides the most direct visibility.

Behavioral analytics tools establish a baseline of normal system and network behavior, including typical communication patterns, data transfer volumes, destinations, and timing. Deviations from this baseline trigger alerts, allowing analysts to detect previously unknown threats without relying on signatures.

Option C is the most appropriate because it both identifies anomalies and supports continuous mitigation. A full zero-trust shutdown (Option A) is disruptive. Forensics (Option B) is reactive and better suited after confirmation of compromise. Training (Option D) does not address system-level interactions.

CEH v13 emphasizes that modern attacks often blend into normal traffic, making behavioral analysis essential. Therefore, Option C is the correct answer.

The correct answer is C because DEP, or Data Execution Prevention, is a memory-protection control that prevents code from executing from memory regions intended only for data storage, such as stack or heap/data memory. In CEH system exploitation and buffer overflow concepts, attackers may try to inject malicious shellcode into a buffer and then redirect program execution to that injected code. The CEH-aligned material explains that buffer overflow attacks can overwrite adjacent memory and allow different executable code to run; it also notes that ASLR and DEP are common defenses against these memory-management attacks. EC-Council material also states that buffer overflow exploitation depends on a machine being able to execute code in the data/stack segment, and lists disabling stack execution as a defense. Therefore, DEP does not block encryption, logging, or scanning. It specifically blocks execution from data memory areas.

This scenario describes an Android rooting approach where the attacker installs a rooting tool directly on the device as an APK and uses it to exploit vulnerabilities to gain elevated privileges. The key feature that makes this approach effective, as stated in the question, is that it works without requiring a computer connection. That aligns directly with option B: “It is an APK that can run directly on the device without a PC.”

Rooting tools packaged as APKs are effective in environments where physical access is limited to the device itself (or where connecting to a PC is impractical or would raise suspicion). Once installed, such an app can attempt privilege escalation by leveraging known weaknesses in the OS, drivers, or vendor components, aiming to obtain root-level access. From a security assessment standpoint, this demonstrates that mobile devices may be at risk if users can install untrusted applications, if the device is not fully patched, or if application controls (enterprise MDM policies, app allowlisting, unknown-sources restrictions) are weak.

The other options are inconsistent with Android APK-based rooting as described. “Tethered jailbreak” terminology applies to iOS jailbreaking, not Android rooting, and the scenario explicitly says no computer connection is required. Weak SSL validation relates to application-layer transport security issues rather than privilege escalation to root. Bluetooth pairing flaws are a different attack class and are not indicated here; the described method is an on-device exploit chain initiated by installing a rooting APK.

Therefore, the feature that makes this rooting approach effective in the scenario is B: it runs directly on the device as an APK without needing a PC.

The best match is VeraCrypt because the scenario explicitly requires three capabilities commonly associated with it in CEH cryptography and data protection coverage: encrypted containers, strong modern ciphers such as AES with 256-bit keys, and the ability to hide a protected volume inside another volume to reduce detectability. VeraCrypt is a successor to TrueCrypt and is widely referenced in ethical hacking curricula as a practical disk encryption utility that can create encrypted file containers and encrypt entire partitions or drives. It supports multiple algorithms and combinations, including AES-256, and can mount encrypted containers as virtual drives so applications can access data normally while it remains encrypted at rest.

The key distinguishing requirement is concealment of secure storage using hidden volumes. VeraCrypt supports plausible deniability by allowing a hidden volume to exist inside an outer encrypted volume. If compelled to reveal a password, a user can disclose the outer volume password while the hidden volume remains undetectable without its separate credentials. The prompt’s phrase “conceal secure volumes within standard ones” maps directly to this VeraCrypt feature and is not a standard capability of BitLocker or FileVault.

BitLocker and FileVault provide strong full-disk encryption, but they do not provide hidden volumes for plausible deniability. Rohos can create encrypted containers, but hidden-volume style plausible deniability is most strongly and commonly associated with VeraCrypt in CEH-oriented discussions. Therefore, VeraCrypt is the most appropriate tool for Noah’s stated objectives.

The correct answer is D. Brute force. A brute-force attack is a password-cracking method that systematically attempts every possible combination of characters until the correct password is discovered. Because it does not rely on precompiled wordlists, common passwords, or previously generated hash databases, it is considered the most exhaustive and time-consuming password-cracking technique.

In CEH password-attacking concepts, a dictionary attack is generally faster because it uses a predefined list of commonly used passwords and words. Rainbow tables are even faster in many situations because they rely on precomputed hash values that can be matched against captured password hashes. Shoulder surfing is not a technical password-cracking method; it involves directly observing a user entering credentials.

The effectiveness and duration of a brute-force attack depend on password complexity, length, character set, account lockout policies, and available computing power. Strong passwords containing uppercase letters, lowercase letters, numbers, and special characters significantly increase the number of possible combinations, making brute-force attacks far more difficult and time-consuming.

CEH Exam Tip:

Dictionary Attack = Faster, wordlist-based.

Rainbow Tables = Precomputed hash lookup.

Brute Force = Tries every possibility; most time and effort required.

Shoulder Surfing = Social engineering observation technique.

Therefore, Brute Force is the correct answer.

CEH v13 classifies application-layer DoS attacks as the most difficult to detect and mitigate. A distributed SQL injection-based DoS exploits database query processing by overwhelming backend systems with malicious but syntactically valid requests.

Unlike volumetric attacks, this method generates low-bandwidth, high-impact traffic that appears legitimate. Traditional DDoS protections often fail to identify such traffic, especially when it targets authenticated services like online banking.

UDP floods, Smurf attacks, and ICMP-based attacks are well-known and more easily mitigated with rate limiting and filtering. Zero-day exploits cause service disruption but are not primarily DoS techniques.

CEH v13 highlights that application-layer DoS attacks blend seamlessly with normal traffic patterns, making them exceptionally challenging. Thus, option A is correct.

The correct answer is External Scanning. CEH vulnerability assessment material explains that external scanning evaluates the systems, services, and exposures visible to parties outside the organization, typically from the perspective of an internet-based attacker. In this scenario, the consultants are reviewing infrastructure reachable through publicly registered domain records, identifying open ports on exposed servers, checking for outdated components, and reviewing DNS information that is visible to remote systems. Those activities clearly indicate an external perspective. Network-based scanning is broader and can occur either internally or externally, so it is not the most precise answer here. Internal scanning would assess assets from inside the organization’s environment, and manual scanning would describe the method rather than the exposure perspective. CEH emphasizes that external scans are used to understand the public attack surface, including internet-facing services, exposed applications, open ports, SSL/TLS posture, and domain-related information available to outsiders. Because the engagement is centered on what can be reached and learned from outside the network through public records and exposed hosts, the scan is best classified as External Scanning.

In OT hacking methodology, once exposed industrial assets have been identified, the next logical step—before attempting exploitation—is to actively assess those assets for weaknesses. The scenario states the tester is “actively probing controllers, services, and interfaces to identify exploitable weaknesses” and explicitly confirms that no exploitation attempts or persistence mechanisms have occurred. That combination maps most closely to the Vulnerability Scanning phase.

Vulnerability scanning in OT contexts includes carefully enumerating and assessing industrial components such as PLCs, HMIs, historians, engineering workstations, and industrial gateways. The goal is to discover issues like outdated firmware, insecure services, weak authentication, exposed management interfaces, misconfigurations, and known CVEs affecting industrial protocols or device web consoles. “Actively probing” is an important clue: information gathering can be passive (asset inventories, diagrams, OSINT, passive network visibility), but scanning moves into active interaction with hosts and services to identify vulnerabilities—still short of exploitation.

The other answer choices do not align with the described boundaries. Gain Remote Access implies initial compromise or establishing access paths (e.g., leveraging credentials, remote services, or exploits) and is a later step once weaknesses are identified and selected. Launch Attacks is even further along, where exploitation or disruption actions occur. Information Gathering would fit earlier when the tester is identifying assets and collecting details with minimal interaction; however, the scenario says that stage is already past (“has already identified exposed industrial assets”) and that the tester is now probing for exploitable weaknesses.

Therefore, the current phase is D. Vulnerability Scanning.

The Certified Ethical Hacker (CEH) Incident Response lifecycle begins with Identification, followed by containment, eradication, recovery, and lessons learned. CEH documentation stresses that understanding the scope and nature of an incident is critical before taking disruptive action.

Option A is the correct initial response because it focuses on real-time monitoring and log analysis, which are essential during the identification phase. CEH materials emphasize analyzing logs, authentication failures, and traffic anomalies to confirm whether an incident has occurred and determine the attacker’s techniques, persistence level, and impact.

Option B, while valuable, is more appropriate after initial identification. Conducting deep outbound traffic audits without first understanding the attack vector can delay containment decisions.

Option C is premature. CEH warns that changing credentials too early may alert the attacker and cause them to escalate or destroy evidence.

Option D represents a containment strategy, not an initial response. CEH guidelines advise against immediately disconnecting systems unless there is confirmed active data exfiltration that cannot be otherwise controlled, as this may disrupt business operations and erase volatile forensic evidence.

Therefore, the CEH-approved approach is to monitor, analyze, and identify the incident before moving to containment and eradication.

The correct answer is A. Insecure Design.

The issue is not just a single input validation bug. The scenario describes recurring weaknesses across multiple applications, inconsistent controls between teams, and the need to standardize security requirements across future development efforts. That points to a design-level problem, not just a patching or configuration issue.

CEH-aligned secure development material emphasizes that threat modeling identifies and reviews threats, trust boundaries, data flows, vulnerabilities, and weaknesses in application security design . Web application mitigation guidance also identifies server-side validation, whitelisting or blacklisting of input characters, sanitization, output validation, encoding, prepared statements, parameterized queries, and bind variables as mitigations for input validation flaws .

Option B. Broken Access Control is incorrect because the scenario focuses on inconsistent input-handling and validation design, not unauthorized access to functions or objects.

Option C. Security Misconfiguration is incorrect because the root problem is not an incorrectly configured server or framework setting.

Option D. Cryptographic Failures / Sensitive Data Exposure is incorrect because the issue is not about weak encryption or exposure of protected data through cryptographic failure.

Therefore, the best answer is A. Insecure Design.

The correct answer is D because world-writable cron directories allow unauthorized users or attackers to add or modify scheduled tasks. In Linux, cron is used to run commands or scripts automatically at defined times, and CEH-aligned material identifies crontab as the mechanism for listing scheduled jobs/tasks. If cron directories are writable by everyone, an attacker can place a malicious script or cron entry that repeatedly runs after compromise, after login, or after reboot. This supports the CEH system-hacking phase of maintaining access, also called persistence. The uploaded red-team reference specifically associates Linux “permanent access” with cron-based scheduled execution. Linux permissions are based on read, write, and execute rights, and overly permissive settings such as full access for all users create serious control weaknesses. This is not SQL injection or XSS because no web application input is involved. It is not primarily DoS. The best CEH answer is persistence.

SHA-256 is a cryptographic hash function, and CEH v13 clearly states that hash functions alone provide data integrity, but not authenticity or non-repudiation. If attackers can modify data and recompute the hash, integrity checks will still pass.

The issue arises because SHA-256 does not prove who created or modified the data. To address this weakness, CEH v13 recommends using digital signatures, which combine hashing with asymmetric cryptography. A digital signature ensures:

Integrity (data has not changed)

Authentication (data was signed by a known entity)

Non-repudiation (the signer cannot deny the action)

Digital signatures work by hashing the data and encrypting the hash with the sender’s private key. Any modification to the data invalidates the signature.

Encryption alone (Options A and C) protects confidentiality, not integrity or authenticity. SSL/TLS (Option B) secures data in transit but does not protect stored data from tampering.

CEH v13 explicitly identifies digital signatures as the correct cryptographic control when integrity mechanisms alone are insufficient. Therefore, Option D is correct.

CEH v13 explains that WPA2-PSK security relies on the strength of the pre-shared key. Once the 4-way handshake is captured, the attacker must attempt offline cracking. CEH emphasizes that the dictionary attack is the most efficient and commonly used cracking method because it tests structured wordlists, human-derived passwords, and hybrid permutations, dramatically reducing time compared to full brute force. Brute forcing (Option B) is computationally heavy and often impractical unless the password is extremely short. XSS (Option A) and SQL injection (Option D) have no relevance to WPA2 authentication, which occurs at the wireless protocol level, not the router’s web interface. The dictionary attack is highlighted in CEH as the principal technique used with tools like aircrack-ng, hashcat, and pyrit, allowing rapid key testing using optimized GPU or CPU cracking. Thus, Option C is the most effective and CEH-aligned method.

Social engineering attacks that target business processes are especially effective when they mimic legitimate workflows. CEH learning materials emphasize that attackers often exploit trust relationships and organizational procedures rather than attempting broad or generic phishing methods. In the context of HR operations, onboarding portals are highly trusted and frequently accessed by new employees who expect to enter personal information, submit documents, and receive initial network credentials. By creating a fake onboarding portal that closely resembles the organization’s internal system, an attacker can collect credentials without triggering suspicion because the action being requested appears normal and expected. This method leverages procedural familiarity, brand consistency, and the implied authority of HR communications, making it far more effective than generic phishing emails or unsolicited social media messages. Phone calls, while sometimes useful, involve real-time interaction and increase the chance of detection. The fake portal, however, seamlessly integrates into existing processes, making it the most effective and lowest-profile approach for acquiring network credentials.

The correct answer is A. Sending an email to a non-existent address during an authorized penetration test can trigger a bounce-back or non-delivery report. These responses may reveal useful reconnaissance information such as mail server names, IP addresses, SMTP banners, internal hostnames, anti-spam gateways, mail routing behavior, and how the organization handles undeliverable messages. This technique supports the CEH reconnaissance and footprinting phase, where testers gather publicly or externally exposed information before deeper testing. It is not intended to create spam, identify root users, test antivirus directly, or perform a denial-of-service attack.

CEH v13 identifies Slowloris as a low-bandwidth yet highly effective application-layer DoS technique that works by opening many HTTP connections and sending headers very slowly, never completing the request. Because the server must maintain these half-open HTTP sessions, its connection pool becomes saturated, preventing it from servicing legitimate users. Slowloris is particularly dangerous because it does not rely on malformed packets, high traffic volume, or protocol abuses; instead, it mimics legitimate HTTP behavior, making it difficult for firewalls or IDS systems to distinguish malicious traffic. This aligns exactly with the described scenario, where thousands of legitimate-looking HTTP connections are gradually consuming server resources. Fragmentation attacks (Option B) target packet reconstruction, UDP floods (Option C) generate high-bandwidth noise, and SYN floods (Option D) impact the TCP handshake layer, not the HTTP header behavior. Slowloris’ unique use of slow HTTP headers directly matches the symptoms described.

The scenario describes a jailbreak that boots normally without requiring a computer, but after a reboot the device loses the jailbroken (elevated) state until the user runs an on-device app to re-enable jailbreak features. That behavior matches semi-untethered jailbreaking.

In iOS jailbreaking terminology, the key differentiator is what happens after a restart and whether a computer is required to regain jailbroken functionality. With a semi-untethered jailbreak, the device can reboot on its own into a normal, usable iOS state (so it is not “bricked” or stuck at boot), but jailbreak features such as elevated privileges, unsigned code execution, and tweaks are not active immediately after reboot. To reapply the jailbreak, the user launches a jailbreak app installed on the device, which triggers the exploit chain again and re-enables the modified state until the next reboot. This aligns exactly with “temporarily lost after restart until the user launches a special on-device app.”

Why the other choices don’t match:

Tethered jailbreaking (A) requires the device to be connected to a computer to boot; without tethering, the device cannot boot properly or remains unusable. The scenario explicitly says it can “boot normally without a computer,” so it is not tethered.

Untethered jailbreaking (B) persists across reboots; the device remains jailbroken after restarting with no extra steps. That contradicts the described need to reapply modifications after restart.

Semi-tethered jailbreaking (D) is similar in that the device can boot without a computer, but typically the device boots into a non-jailbroken mode and may require a computer or additional steps to return to a jailbroken state depending on the method; the scenario specifically highlights re-enabling via an on-device app, which is the hallmark most commonly associated with semi-untethered jailbreaks.

Therefore, the jailbreaking method shown is C. Semi-untethered Jailbreaking.

The CEH Web Application Hacking module identifies Session Fixation as a powerful session management attack that can bypass advanced authentication controls, including MFA.

In session fixation, the attacker forces the victim to authenticate using a session ID already known to the attacker. Once authentication completes, the attacker hijacks the valid session without needing credentials.

Option A directly targets session management logic.

Option B exploits authorization logic, not session handling.

Option C is unrelated to session management.

Option D is mitigated by encrypted cookies and HTTPS.

CEH explicitly warns that applications must regenerate session IDs after authentication.

The Spearphone attack, covered in CEH v13 Mobile Platform Hacking, exploits smartphone accelerometers to infer speech vibrations from loudspeakers—without microphone permissions.

This attack demonstrates how built-in sensors can be abused for covert surveillance, making it ideal for assessing privacy risks.

Other options involve different attack vectors not related to sensor-based eavesdropping.

Thus, Option C is correct.

Side jacking, as defined in CEH v13 Web Application Hacking, is a form of session hijacking where an attacker captures valid session identifiers—usually cookies—by sniffing network traffic. This attack is particularly effective when applications fail to encrypt session cookies using HTTPS.

In CEH v13, side jacking is commonly associated with attacks performed on unsecured wireless networks, where attackers passively monitor traffic using packet sniffers such as Wireshark. If session cookies are transmitted in plaintext, the attacker can replay them to impersonate the victim without needing login credentials.

Option B precisely matches this definition: capturing unencrypted session cookies and reusing them to gain unauthorized access.

Other options describe different attack types:

A is credential harvesting via social engineering.

C is network exploitation.

D is cross-site scripting (XSS).

CEH v13 emphasizes enforcing HTTPS, Secure and HttpOnly cookie flags, and session regeneration as defenses against side jacking.

The CEH Enumeration module explains that SMTP supports commands such as VRFY, EXPN, and RCPT TO, which can be abused to enumerate valid email users if not properly restricted.

In this scenario, the smtp-enum-users Nmap script successfully uses EXPN and RCPT, indicating that the server responds differently to valid and invalid usernames.

Option C is correct because unrestricted SMTP user verification allows attackers to harvest usernames for further attacks such as phishing or brute force.

Option A involves authentication, not enumeration.

Option B affects confidentiality, not user discovery.

Option D is unrelated to SMTP enumeration.

CEH strongly recommends disabling or restricting these SMTP commands.

CEH reconnaissance and enumeration modules explain that LDAP services often support anonymous binding by default unless explicitly disabled. Anonymous bind allows unauthenticated users to query certain directory attributes, which can lead to disclosure of usernames, organizational hierarchy, and email addresses—critical information for password attacks, phishing campaigns, and privilege escalation planning. In the scenario described, the tester obtained directory data without providing any credentials, demonstrating that anonymous bind permissions were enabled. LDAPS requires TLS encryption and authentication, which contradicts the observed access. Kerberos authentication mandates valid credentials. LDAP via RADIUS is used for authentication integration, not for information disclosure. Since the query was successful with no authentication and no access controls triggered, this aligns exactly with CEH’s description of anonymous LDAP binding.

The correct answer is C. Preparation.

The activity described occurs before credential abuse, lateral movement, persistence, or internal expansion. The adversary is gathering intelligence, mapping exposed services, preparing exploit frameworks, and testing malware against defensive tools. These actions represent the pre-attack preparation stage of an Advanced Persistent Threat.

APT activity is characterized by defined objectives, long-term probing, advanced resources, specialized skills and methods, and a high tolerance for remaining undetected . The scenario clearly describes these characteristics: the attacker spends months gathering intelligence, building tools, testing malware, and preparing a coordinated attack plan.

Option A. Persistence is incorrect because persistence occurs after initial access, when the attacker establishes a way to maintain access to the compromised environment.

Option B. Expansion is incorrect because expansion involves moving deeper into the environment, escalating privileges, or spreading laterally after compromise.

Option D. Initial Intrusion is incorrect because initial intrusion refers to the first successful compromise of the target environment. The scenario specifically states that these activities occurred before credential abuse or lateral movement.

Therefore, the best answer is C. Preparation.

The scenario describes a host-level monitoring agent installed on a single workstation that records local system events such as file access, configuration changes, and unauthorized process execution. These are classic indicators of Host-Based Intrusion Detection System (HIDS) functionality. A HIDS runs on an endpoint (server or workstation) and monitors activity on that host, including operating system logs, file integrity, registry/config changes, system calls, application logs, and process behavior. Because it has direct visibility into what is happening locally, it can detect suspicious activity that may not be obvious from network traffic alone.

The clue that “attackers often attempt to disable or evade this type of monitoring to avoid being detected at the host level” also aligns strongly with HIDS. Adversaries commonly try to stop endpoint agents, tamper with logs, or evade detection by living-off-the-land techniques precisely because host-based sensors can catch actions like privilege escalation attempts, persistence mechanisms, malicious process launches, or unauthorized modifications to critical files and configurations.

Why the other options are not the best match:

A Network-Based Firewall (A) is a perimeter or network control that filters traffic based on rules (IPs, ports, protocols). It does not typically record detailed local file/process/configuration events on a single workstation.

A Host-Based Firewall (B) resides on the endpoint but primarily controls inbound/outbound network connections at that host. While it can log connection attempts, it is not chiefly designed to track file access, configuration integrity, or process execution.

A Network-Based IDS (C) analyzes traffic on the network segment (via taps/SPAN) to identify suspicious patterns. It does not require installing an agent on a single workstation and lacks direct visibility into local file and process events.

Therefore, the security system Olivia is demonstrating is D. Host-Based Intrusion Detection System.

The correct answer is D. Date and time received by the originator’s email servers.

Email header tracing reveals hop-by-hop routing information, including mail servers, IP addresses, timestamps, and authentication-related details. CEH-aligned email footprinting material states that tracing an email using the header can reveal the destination address, sender’s IP address, sender’s mail server, time and date information, and authentication system information of the sender’s mail server .

The question asks for the exact moment the email was processed by the sender’s system. In an email header, this is best determined by examining the earliest relevant Received header added by the sender’s or originator’s mail infrastructure. That timestamp shows when the originator’s email server received or processed the message before forwarding it onward.

Option A. Sender’s mail server is incorrect because it identifies the system involved but does not by itself provide the processing time.

Option B. Date and time of message sent is less precise because the Date: header may be generated by the mail client and can be inaccurate or user-controlled.

Option C. Authentication system used by sender’s mail server is incorrect because SPF, DKIM, DMARC, or similar authentication details help validate sender authenticity, not the exact processing time.

Option D. Date and time received by the originator’s email servers is correct because it corresponds to the first trusted server-side timestamp in the message path.

Therefore, the best answer is D. Date and time received by the originator’s email servers.

The attack described is spear phishing because it is a targeted phishing attempt crafted for a specific individual using personal and organizational context. In CEH social engineering coverage, spear phishing differs from generic phishing by its customization: the attacker addresses the victim by name, references the victim’s job function, and tailors the message to create credibility and urgency. Here, the email is addressed specifically to Clara and mentions her role in the accounts team, which increases the likelihood she will trust the message and comply.

The message uses classic phishing psychological triggers emphasized in CEH materials: urgency and fear. By claiming a “critical system vulnerability” and threatening account suspension, the attacker pressures Clara to act quickly and ignore verification steps. The inclusion of a link to a login page that “resembles the company’s internal portal” indicates credential harvesting, where the attacker’s goal is to capture usernames and passwords or other authentication tokens. The subtle misspelling in the sender’s domain is a common indicator of lookalike or typosquatting domains used to mimic legitimate corporate email addresses and bypass casual inspection.

The other options do not match as well. Impersonation is a broader category, but spear phishing is the specific technique using an email lure with personalization. Quid pro quo involves offering a benefit or service in exchange for information, which is not present. Vishing is voice-based phishing via phone calls, not email. Recommended defenses in CEH guidance include verifying sender domains, using out-of-band confirmation with IT, enabling email security controls like SPF, DKIM, and DMARC, and enforcing phishing awareness training and MFA to reduce credential theft impact.

The correct answer is D. UNION SQL Injection because the key observation is that the application’s response shows data from another table merged into the same page results, meaning the injected payload successfully combined two result sets into a single output. In CEH-aligned SQL injection taxonomy, UNION-based SQL injection occurs when an attacker uses the SQL UNION (or UNION ALL) operator to append the results of a second SELECT query to the original query’s results. If the application prints query results to the page, UNION injection is especially powerful because it can directly exfiltrate database contents in-band through the normal web response.

The scenario describes input into a numeric parameter in the customer dashboard (commonly an id value in a query such as selecting loan details). By manipulating this parameter, the attacker causes the back-end query to return not only the intended loan record(s) but also employee information from a different table. That is the hallmark of UNION SQL injection: retrieving unrelated columns/rows by crafting a second SELECT that matches the original query’s column count and compatible data types, then unioning it with the legitimate query so both datasets render together. Attackers often enumerate the number of columns (e.g., with ORDER BY tests) and then identify which columns are reflected in the response to place sensitive data where it will be displayed.

Why the other options do not match: Error-based SQL injection relies on database error messages to leak information, rather than cleanly merging results into the page. Blind SQL injection yields no direct data in the response and instead infers information via boolean conditions or time delays. Second-order SQL injection happens when malicious input is stored first and executed later in a different context; the prompt describes immediate, in-response merging of data.

Therefore, the behavior most directly indicates UNION SQL injection.

CEH describes SQL injection testing as a core part of web application assessment. One of the first and safest validation techniques is using a tautology-based SQL injection payload, such as ' OR ' 1 ' = ' 1. If the application concatenates user input directly into SQL queries, such an input will cause the query to always evaluate as true, often returning additional records such as multiple user profiles. This confirms the presence of SQL injection without causing destructive effects like dropping tables. Testing XSS does not validate SQL injection, brute-forcing credentials is unrelated, and directory traversal attacks target file path manipulation rather than backend queries. CEH emphasizes avoiding destructive queries and starting with non-intrusive injection payloads that reveal improper input sanitization, making ' OR ' 1 ' = ' 1 the correct technique for confirming SQL injection vulnerabilities in URL parameters.

The correct answer is C because banner grabbing is used for identification during reconnaissance, scanning, and enumeration. Banner grabbing collects information returned by a service when a connection is made to an open port. This banner may disclose the application name, service type, operating system, software version, web server details, mail server details, or firmware/vendor information. CEH scanning methodology associates banner grabbing and OS fingerprinting with identifying the operating system and services running on target machines. The material also defines banner grabbing as an enumeration technique used to provide information about a computer system, generally for operating system identification or fingerprinting. It is not sniffing, because sniffing captures network traffic. It is not cracking, because cracking attempts to break passwords or protections. It is also not exploitation, although the information discovered may later help select an exploit. Therefore, the main purpose of banner grabbing is identification.

CEH incident response material explains that LLMNR and NBT-NS poisoning is a common credential-harvesting technique in internal networks. These legacy name-resolution protocols operate via broadcast queries. Attackers can listen for these broadcasts and respond faster than legitimate DNS/hosts entries, impersonating the requested resource. Once the victim system attempts to authenticate, it sends NTLM hashes to the attacker-controlled machine. Tools like Responder and Inveigh automate this process, enabling attackers to collect challenge-response hashes for offline cracking. CEH highlights that this method is passive from the victim’s viewpoint and difficult to detect unless monitoring tools watch for anomalous LLMNR/NBT-NS responses. Options A, B, and D refer to other components of password cracking, but none describe the mechanism of capturing hashes via poisoned name resolution. The attacker’s technique directly aligns with exploiting the name-resolution protocol to intercept authentication attempts.

According to the CEH Sniffing and Network Protocol Attacks module, covert channels represent one of the most sophisticated and difficult-to-detect data interception techniques. These channels hide malicious communication within legitimate protocol behavior, making them extremely challenging for traditional IDS/IPS and packet inspection tools to identify.

Industrial and legacy protocols such as Modbus, widely used in OT and legacy enterprise environments, lack encryption and authentication by design. CEH documentation highlights that attackers can manipulate unused or poorly validated Modbus fields to covertly transmit or intercept data while appearing as normal control traffic.

Option D is correct because covert channels over trusted legacy protocols blend seamlessly with legitimate traffic and bypass many security controls.

Option A is not a sniffing technique but a data-hiding method.

Option B describes exploitation, not sniffing.

Option C is a theoretical evasion method but is more detectable through reassembly.

CEH emphasizes covert channels as one of the most formidable sniffing challenges.

CEH materials explain that modern web applications deploy multiple layers of security—HTTPS, secure cookies, HttpOnly flags, and strict session regeneration—to defend against standard hijacking methods such as token theft through XSS or fixation. When these protections are properly implemented, attackers must compromise the underlying trust relationship between the client and server to successfully intercept or manipulate session tokens. One of the most advanced techniques described in CEH is compromising a trusted certificate authority or injecting a forged certificate into the victim’s trust store. This enables the attacker to perform a transparent MITM attack despite HTTPS protections. Because the victim’s browser trusts the forged certificate, encrypted traffic—including session tokens—is exposed to the attacker without generating browser warnings or IDS alerts. Timing side-channel attacks are not considered session hijacking methods; XSS is mitigated by secure flags; and session fixation is ineffective when session regeneration occurs. Therefore, compromising a trusted certificate authority to enable an undetectable MITM attack is the most viable method.

The correct classification is Potentially Unwanted Applications (PUAs). In CEH malware taxonomy, PUAs refer to software that is not strictly malicious in the traditional sense but exhibits undesirable behavior such as displaying intrusive advertisements, modifying browser settings, collecting user data, degrading system performance, or bundling with other freeware without clear user awareness. In this scenario, the toolbar and optimization tool were bundled with a legitimate utility installer and presented with vague descriptions—an extremely common PUA distribution method known as software bundling.

The symptoms described—pop-up ads, homepage modification, sluggish performance, and background data transfers—are consistent with adware or browser hijackers, which fall under the broader PUA classification. Importantly, the question specifies there is no immediate file encryption (which would suggest ransomware) and no self-replication (which would suggest a worm). Botnet agents typically establish command-and-control communication and are designed for coordinated malicious activity such as DDoS or spam campaigns; while unexplained traffic may raise suspicion, the described behavior aligns more closely with adware-style monetization rather than structured botnet activity. Logic bombs are dormant code triggered by specific conditions, which is not indicated here.

From a defensive perspective, CEH recommends secure software acquisition policies, user awareness training, disabling unnecessary bundled installations, implementing endpoint protection with PUA detection enabled, and enforcing application allowlisting to prevent unauthorized or bundled software from executing within the enterprise environment.

CEH v13 stresses the importance of passive reconnaissance when the goal is to avoid any interaction with the target’s systems. Job postings frequently reveal detailed information such as internal technologies, OS platforms, security tools, IDS brands, virtualization environments, scripting languages, and cloud services. CEH explicitly notes job ads as one of the richest passive intelligence sources because organizations inadvertently disclose their tech stack, often mentioning required experience with specific network components, databases, protocols, or internal tools. Options B and D involve direct interaction, violating the passive reconnaissance requirement. WHOIS lookups (Option C) provide DNS registrar information but do not reveal internal network details. Job postings, social media recruitment materials, and HR documentation are discussed in CEH as critical OSINT resources used during the footprinting phase to gather actionable intelligence while maintaining complete stealth. Thus, analyzing job postings is the correct method.

According to CEH v13 Security Operations and Incident Response, the first step in incident handling is identification and analysis, not immediate containment or remediation. The observed sequence—failed logins followed by abnormal outbound traffic—suggests a potential compromise, but the exact nature, scope, and impact are still unknown.

Option C aligns precisely with CEH v13’s incident response lifecycle. Real-time monitoring and detailed log analysis allow the analyst to determine whether the activity represents credential stuffing, brute-force compromise, malware-based exfiltration, or a false positive. This step preserves evidence, establishes timelines, and helps identify indicators of compromise (IOCs).

Immediately disconnecting the server (Option B) may be necessary later, but doing so prematurely can destroy volatile forensic evidence, disrupt business operations, and alert the attacker. Auditing outbound traffic alone (Option A) is too narrow and skips proper correlation of authentication logs, system logs, and process activity. Forcing credential changes (Option D) without understanding the attack vector may fail to stop malware-based persistence.

CEH v13 emphasizes that containment actions must be informed by analysis, otherwise organizations risk responding to symptoms rather than root causes. Therefore, the correct initial action is to observe, analyze, and identify, making Option C the correct answer.

DHCP starvation is a network-level attack in which an attacker sends a massive number of DHCPDISCOVER requests, each appearing to originate from a different MAC address. CEH courseware explains that DHCP servers assign IP leases based on unique MAC addresses, and when the lease pool is exhausted, legitimate clients are unable to obtain valid IP configurations. This disrupts network connectivity and can serve as a precursor to deploying a rogue DHCP server, enabling further attacks such as traffic redirection or credential interception. DHCP starvation is different from ARP spoofing, which manipulates MAC–IP mappings, or DNS poisoning, which corrupts domain resolution. Rogue DHCP relay attacks involve forwarding DHCP packets to unauthorized servers, not depleting leases. The scenario described—rapid MAC address spoofing and exhaustion of DHCP leases—matches the precise definition of DHCP starvation as documented in CEH materials.

Fragmentation is a well-known firewall and IDS evasion technique covered in CEH materials. The attacker breaks a malicious packet into smaller IP fragments so that simple filtering devices, especially those relying mainly on basic header checks or stateless rules, may fail to reconstruct the original payload and therefore miss the malicious content. To counter this, defenses must track packet state and perform reassembly or validation of fragmented traffic so the security control can evaluate the complete communication stream rather than isolated fragments.

Stateful Packet Inspection is the control most aligned with this requirement. A stateful inspection firewall maintains a state table of active connections and monitors traffic as part of an ongoing session. Because it tracks session context, it can handle fragmented packets more effectively by correlating fragments to the original flow and applying policy after reconstructing or normalizing traffic. In CEH-aligned descriptions, this directly reduces the effectiveness of fragmentation-based evasion, overlapping with the concept of traffic normalization that removes ambiguity attackers try to exploit.

Deep Packet Inspection examines payload beyond headers, but the key success factor in stopping fragmentation evasion is state tracking and reassembly, which is characteristic of stateful inspection and state-aware security devices. Signature-based and anomaly-based detection can help detect malicious patterns or unusual behavior, but without reliable reassembly and session context, fragmented payloads may not match signatures and may appear benign in isolation. Therefore, the most likely measure used to identify and block fragmented packets in this scenario is Stateful Packet Inspection.

CEH materials describe this attack pattern as Living-off-the-Land (LotL), where attackers abuse legitimate tools to avoid detection. Because these binaries are normally trusted, traditional antivirus solutions may not flag them.

CEH recommends file integrity monitoring (FIM), which tracks cryptographic hashes of sensitive executables and alerts administrators when unauthorized modifications occur.

Option D is correct.

Options A and B support resilience but do not detect tampering.

Option C alone is insufficient against LotL attacks.

TCP 139 and UDP 137 and 138 correspond to NetBIOS over TCP/IP services that are closely associated with Windows file and printer sharing and legacy SMB browsing. In CEH methodology, these ports are high-value enumeration targets because NetBIOS name service and datagram service can disclose hostnames, domain or workgroup names, logged-in users, and shared resource details, often before any strong authentication occurs. UDP 137 is used for NetBIOS Name Service, which supports name registration and lookup. UDP 138 supports NetBIOS Datagram Service, commonly tied to browsing and announcement traffic. TCP 139 supports NetBIOS Session Service, historically used to establish sessions for SMB traffic and to query share and user-related information when configurations are weak.

In real environments, misconfigurations such as permissive share settings, legacy protocols, or anonymous and guest-access allowances can allow an attacker to enumerate user accounts, groups, and policies indirectly through browsing data, share lists, and RPC-related exposure that frequently accompanies SMB environments. CEH training emphasizes prioritizing enumeration against Windows networking services because the information gained can rapidly support follow-on attacks such as password spraying, targeted phishing, lateral movement, and privilege escalation planning.

The other choices include TCP 21 FTP, TCP 23 Telnet, and TCP 25 SMTP, which may expose banners or allow limited user enumeration in specific configurations, but they are not the primary ports associated with classic Windows user and group enumeration. UDP 133 is not a standard enumeration target in this context. Therefore, TCP 139 with UDP 137 and 138 is the best priority set for username and group-related enumeration.

Passive reconnaissance involves gathering information without directly interacting with the target. WHOIS, search engines, and social media are all passive techniques highlighted in CEH v13 Reconnaissance.

Nmap scanning, however, actively probes target systems and generates traffic that can be logged and detected. This makes it an active reconnaissance technique.

Therefore, Option D is least useful in a passive phase.

The described action is classic web server footprinting through banner grabbing. In CEH reconnaissance methodology, banner grabbing is used to identify a target’s service details by eliciting and analyzing standard protocol responses. When Sofia sends a simple HTTP request such as GET / HTTP/1.0, the server often responds with HTTP headers that may include fields like Server and sometimes X-Powered-By, which can reveal the web server product and version, and occasionally information that hints at the underlying operating system or framework. This disclosure is valuable to attackers because it enables targeted exploitation: once the exact server and version are known, an attacker can correlate that information with known vulnerabilities, misconfigurations, and exploit code.

This is not information gathering from robots.txt, which is a web file used to suggest crawler behavior and sometimes reveals hidden paths but does not inherently expose server software versions. It is also not directory brute forcing, which involves systematically guessing directories and files to find hidden endpoints. Vulnerability scanning is broader and typically involves automated checks to detect vulnerabilities; while banner information can be an input to scanning, the technique shown here is specifically identification through response headers.

CEH-aligned mitigation includes disabling or minimizing server signature information, removing unnecessary headers, keeping server software patched, and using secure configurations and reverse proxies to reduce information leakage during reconnaissance.

The best answer is Block all unnecessary ports, ICMP traffic, and unnecessary protocols such as NetBIOS and SMB. CEH web server hardening guidance emphasizes reducing the attack surface of internet-facing servers by disabling or filtering unnecessary services and protocols that are not required for web operation. In the scenario, Apache was compromised through an outdated vulnerability, but the answer options ask for the best hardening strategy among the listed choices. Option C reflects standard server-hardening practice by minimizing exposed network services and blocking protocols that are irrelevant or risky on a web server. A dedicated machine can support separation of roles, but it does not directly address service exposure. A risk assessment is useful for prioritization, not as the immediate control itself. Eliminating unnecessary files within jar files is not a standard Apache-specific hardening measure. CEH materials consistently recommend hardening web servers by closing unnecessary ports, disabling superfluous protocols, limiting reachable services, and reducing the overall attack surface in addition to patching. Among the available options, blocking unnecessary ports and protocols is the most appropriate security recommendation.

CEH’s SQL Injection coverage distinguishes between classic (error-based), union-based, boolean-based blind, and time-based blind SQL injection. Time-based blind SQL injection is used when the application does not return database errors or query results to the attacker (no visible output), but the attacker can infer execution behavior by measuring response delays.

A time-based payload intentionally triggers a database delay function (for example, SLEEP(), WAITFOR DELAY, pg_sleep() depending on DBMS). If the injection is successful, the page response time increases predictably, confirming that attacker-controlled SQL is being executed.

Option C is the correct time-based blind probe because it uses conditional logic (IF(1=1, SLEEP(5), 0)) to cause a measurable delay only when the injected condition evaluates true. CEH teaches that this technique is particularly effective against hardened applications that suppress errors and sanitize outputs, because timing becomes the side-channel for confirmation.

Option A and Option D are UNION-based payload patterns intended to extract data via returned result sets, which time-based blind scenarios typically do not provide. Option B is a classic authentication-bypass/boolean test; it can indicate injection but does not specifically validate time-based blind behavior when output is not observable.

CEH mitigation guidance includes parameterized queries, strict input validation, least-privilege DB accounts, WAF tuning, and centralized logging to detect anomalous query timing patterns.

CEH v13 identifies ARP spoofing/poisoning as a primary MitM technique in local networks. In such attacks, a single IP address maps to multiple MAC addresses, indicating ARP table manipulation.

This anomaly allows attackers to intercept traffic between victims and gateways. Increased traffic or DNS activity may occur but are not definitive indicators. Thus, IP-to-MAC inconsistencies are the most reliable confirmation of MitM activity.

CEH v13 follows the Incident Response Lifecycle, which prioritizes identification and analysis before containment, unless there is immediate risk of catastrophic damage. In this scenario, the attacker has escalated privileges, but the organization still needs to understand what actions are being taken, what systems are affected, and whether lateral movement is occurring.

Option C aligns with CEH v13 best practices. Real-time monitoring and documentation allow analysts to:

Identify attacker techniques and tools

Preserve volatile evidence

Understand scope and impact

Implement targeted containment

Immediately powering down the server (Option B) may destroy volatile forensic evidence and disrupt services unnecessarily. Engaging forensic teams (Option A) is important but premature without initial analysis. Running vulnerability scans (Option D) does not address the active threat.

CEH v13 stresses that informed containment is more effective than reactive shutdowns. Therefore, Option C is correct.

An HTTP Flood attack is an Application Layer (Layer 7) DDoS attack, as defined in CEH v13. In this attack, the adversary sends a massive number of seemingly legitimate HTTP GET or POST requests to exhaust server resources such as CPU, memory, and application threads.

CEH v13 emphasizes that HTTP floods are difficult to detect because they mimic normal user behavior and often bypass traditional network-layer defenses.

Other attacks operate at lower layers:

ICMP, UDP, and SYN floods target network and transport layers.

CEH v13 emphasizes that IoT devices must implement secure firmware update mechanisms that enforce authenticity, integrity, and version control. A critical lapse occurs when devices allow rollback to older firmware versions or accept updates without cryptographic validation. This opens the door to “firmware downgrade attacks,” where attackers intentionally install outdated but vulnerable firmware to reintroduce exploitable weaknesses. CEH identifies this as part of insecure update design, one of the most dangerous IoT vulnerabilities because firmware governs device behavior, network communication, and trust boundaries. Without signature verification, integrity checking, and anti-rollback enforcement, attackers can load malicious or deprecated firmware to escalate privileges or pivot deeper into a network. Options B and C represent different categories of IoT weaknesses, and D refers to supply-chain issues, none of which match the described rollback exploitation. Therefore, the vulnerability demonstrated is the absence of secure update mechanisms.

CEH clearly distinguishes between active and passive reconnaissance. Passive methods involve gathering publicly available data without directly interacting with the target’s infrastructure, thus avoiding detection. Tools such as Netcraft, DNSdumpster, VirusTotal, Certificate Transparency logs, and search engine indexing are recommended by CEH for discovering subdomains through public metadata, cached DNS records, WHOIS data, SSL certificate entries, and third-party enumeration databases. These platforms provide insights into externally accessible assets without sending packets or queries to the target organization. Brute-force enumeration is active and violates the rules of engagement. Attempting credential guessing or requesting internal DNS data are unauthorized and clearly active reconnaissance activities. Passive OSINT-based subdomain enumeration is a core CEH technique used to uncover hidden infrastructure safely and legally. It is especially crucial in red team operations where stealth is a priority.

The correct answer is B. Green Hat Hacker.

A Green Hat Hacker is a beginner or newcomer who is learning hacking techniques and building practical skills. The profile in the scenario describes someone new to cybersecurity, actively learning from online communities, and experimenting with basic tools.

CEH-aligned hacker classification material describes a Neophyte, also called a n00b, newbie, or Green Hat Hacker, as someone who is new to hacking or phreaking and has little or no knowledge or experience with technology and hacking .

Option A. Blue Hat Hacker is incorrect because a blue hat hacker is commonly associated with external bug testing before a system launch.

Option C. Gray Hat Hacker is incorrect because gray hats may violate rules or permissions while not necessarily having malicious intent.

Option D. Red Hat Hacker is incorrect because red hats are generally associated with aggressive action against malicious hackers or high-value targets.

Therefore, the best answer is B. Green Hat Hacker.

CEH v13 highlights the importance of route tracing during internal reconnaissance to identify key infrastructure devices such as distribution switches, firewalls, and core routers. When a single IP address consistently appears as the penultimate hop across multiple network paths, this typically indicates that the device serves as a core router responsible for inter-VLAN or inter-subnet routing. Core routers aggregate traffic from various segments before forwarding to endpoint subnets, explaining why it appears before diverse destinations. CEH emphasizes recognizing core infrastructure because compromising such devices provides attackers with significant visibility and potential control over network-wide communications. DNS poisoning would affect name resolution, not hop patterns. Loopback misconfigurations would affect single hosts, not multiple segments. A transparent proxy would appear only for traffic routed through application-layer inspection, not all traceroute tests. The consistency across subnets strongly points to a centralized routing device.

The scenario points directly to information gathering from the robots.txt file. A robots.txt file is typically located at the root of a website (e.g., and is intended to instruct search engine crawlers which paths should or should not be indexed. During web reconnaissance, testers often review robots.txt because it can unintentionally disclose sensitive directories, administrative panels, staging paths, backup locations, or restricted areas that the organization hoped would remain obscure. The scenario explicitly says Sofia found “a crawler directive at the server’s root” that “allows unintended indexing of restricted areas,” and that this “reveals internal paths.” That is exactly the kind of leakage that can come from misconfigured or overly revealing crawler directives.

This is considered an early-stage reconnaissance / information gathering technique because it does not require exploitation. It leverages publicly accessible configuration hints to map the application’s hidden structure. Even when robots.txt is used correctly, the listed disallowed entries can still serve as a roadmap of interesting targets; if configured incorrectly (for example, allowing indexing or exposing sensitive paths), it can increase exposure by helping those paths surface in search results or be discovered faster by attackers.

Why the other options are less accurate:

Vulnerability Scanning (A) implies using scanners to identify known flaws; here, the tester is manually/strategically inspecting a crawler directive for exposed paths.

Web Server Footprinting/Banner Grabbing (C) focuses on identifying server type/version and technologies via headers or responses, not discovering hidden paths from crawler directives.

Directory Brute Forcing (D) uses wordlists to guess directories; Sofia’s discovery comes from a disclosed list of paths, not brute-force guessing.

Therefore, the technique is B. Information Gathering from robots.txt File.

This is a textbook case of Intranet DNS Poisoning, often combined with ARP spoofing, as described in CEH v13 Network Sniffing and MITM Attacks. The attacker positions themselves inside the local network, intercepts DNS requests, and responds faster than the legitimate DNS server.

ARP spoofing enables the attacker to perform a Man-in-the-Middle attack, allowing sniffing and modification of DNS traffic. CEH v13 notes that faster rogue responses are a strong indicator of local DNS poisoning.

CEH v13 emphasizes that after identifying vulnerabilities during scanning, testers must validate findings to determine real impact and eliminate false positives. This requires safe, controlled exploitation using approved tools such as Metasploit, Nikto, or custom proof-of-concept scripts. Misconfigurations labeled as medium-risk may still provide privilege escalation, data exposure, or footholds for further attacks. CEH methodology reinforces that exploitation should always follow the scope and rules of engagement and should avoid disruptive activities like brute-forcing or DoS attacks unless explicitly authorized. Ignoring the vulnerabilities is never acceptable in a professional assessment. Verifying the issue helps the organization prioritize remediation using evidence-based results. Therefore, the correct next step is to verify the vulnerability through controlled exploitation.

This scenario clearly describes the need for Time-Based Blind SQL Injection, an advanced SQL injection technique covered in the CEH v13 Web Application Hacking module. Blind SQL injection is used when an application does not return database errors or visible output, making traditional techniques ineffective.

According to CEH v13, Time-Based Blind SQL Injection is particularly useful when:

The backend database type is unknown

Error messages are suppressed

UNION queries fail

No direct data is returned in responses

In this technique, attackers inject SQL statements that deliberately introduce time delays using database-specific functions such as SLEEP(), WAITFOR DELAY, or BENCHMARK(). The ethical hacker then observes the application’s response time to determine whether the injected condition is true or false.

For example:

' OR IF(1=1, SLEEP(5), 0) --

If the application response is delayed, it confirms that the injected SQL statement was executed successfully. CEH v13 categorizes this method as behavioral-based inference, where the attacker extracts information one bit at a time by analyzing timing differences.

Other options are incorrect because:

Content-Based Blind SQL Injection relies on visible differences in responses, which the question states are unavailable.

Union-Based SQL Injection requires knowing column count and data types.

Error-Based SQL Injection depends on database error messages being displayed.

CEH v13 emphasizes Time-Based Blind SQL Injection as a last-resort yet highly effective technique when dealing with hardened applications that suppress output, making it a frequent exam-tested concept.

The correct answer is C, Parameter tampering. In web application hacking, hidden fields are HTML form fields used to pass values back to the server, but they are only hidden from normal browser display, not from the user or attacker. CEH web application material explains that hidden fields are embedded in HTML forms to maintain values sent back to the server, and attacks challenge the assumption that hidden fields cannot be viewed or modified by examining the HTML source and changing the request before it reaches the server. This directly matches parameter tampering because the attacker modifies client-side parameters such as form fields, cookies, query strings, or URL parameters to alter application behavior. CEH material also describes parameter/form tampering as manipulating parameters during client-server communication, including URL values and web page form fields. SQL injection targets database queries, XSS injects script into pages, and CSRF tricks authenticated users into submitting unwanted requests. Hidden-field manipulation is therefore a form of parameter tampering.

The correct answer is B, It replaces legitimate programs. A rootkit is malicious software used after compromise to hide the attacker’s presence, maintain privileged access, and avoid detection. CEH-aligned material describes rootkits as tools that obscure system compromise by replacing or substituting administrator utilities with modified versions that hide malicious activity. Linux rootkit material also states that rootkits contain replacement executables for critical operating system components, used to hide evidence and provide backdoor access. Therefore, among the options, replacing legitimate programs is the best match. Option A describes a backdoor concept more generally. Option C describes a vulnerability/exploitation condition, not a rootkit’s purpose. Option D may describe one possible backdoor behavior, but it is not the primary rootkit objective. Rootkits commonly hide files, processes, registry entries, logs, and malicious services, making detection and removal difficult.

The correct answer is B. Rogue AP because the scenario describes an unauthorized access point that has been physically connected to the internal wired network and is providing network access on the corporate VLAN without approval or inventory records. In CEH-aligned wireless security concepts, a rogue access point is any AP that is installed on an organization’s network without authorization, creating an unmanaged entry point that bypasses standard security controls. The key indicators here are: it is “previously unknown,” “neither provisioned by IT nor listed in the asset inventory,” and it is “physically connected to the hospital’s internal switch.”

The fact that the device is issuing IP addresses suggests it may be running a DHCP service or bridging into the internal network in a way that places clients directly onto the corporate VLAN. This can allow attackers to gain internal access from nearby wireless range and can also cause network instability if its DHCP responses conflict with the legitimate DHCP infrastructure. Additionally, the device “relaying internal traffic and providing remote connectivity back to an external host” points to an attacker using it as a covert foothold—effectively an unauthorized wireless bridge into the internal network and a channel for command-and-control or remote access.

Why not the other options: a misconfigured AP implies a legitimate AP deployed by IT but configured insecurely (weak encryption, default credentials, poor segmentation). A honeypot AP is typically deployed deliberately (often by defenders) to attract attackers for detection and research, not stealthy backhaul to an external host. An evil twin AP is a spoofed wireless AP that impersonates a legitimate SSID to lure victims; it does not necessarily require being physically plugged into the internal switch, and the defining trait is impersonation of a real AP/SSID. The defining trait here is unauthorized installation on the wired network, which is most directly a rogue access point.

The correct answer is C. Reconnaissance. In CEH methodology, reconnaissance is the initial information-gathering phase where an ethical hacker collects details about the target before deeper testing begins. CEH-aligned material defines reconnaissance as gathering information about a target using active or passive means, and it commonly includes discovering network ranges, live hosts, open ports, operating system details, services, and organizational information. Active reconnaissance involves direct interaction with the target, such as sending probes, scans, or packets, which can provide accurate information but may be detected. Passive reconnaissance collects information without directly contacting the target, often using public sources such as websites, social media, WHOIS, DNS records, and search engines. Obfuscation is related to hiding activity, exploitation refers to using a vulnerability to gain access, and denial of service focuses on disrupting availability. Therefore, the step known for active and passive information gathering is Reconnaissance.

The correct answer is A. IMDS Attack.

The scenario describes an attacker executing code from inside a cloud instance and retrieving temporary credentials associated with the instance role. This is characteristic of an Instance Metadata Service (IMDS) attack. Cloud platforms expose metadata services to instances so applications can retrieve configuration and role credentials. If an attacker gains code execution on the instance, they may query IMDS and steal temporary credentials.

A cloud security reference explains that when an EC2 instance is associated with an instance profile, temporary security credentials are automatically provided to the instance through the Instance Metadata Service (IMDS) . In the scenario, the tester abuses this behavior after gaining code execution through the vulnerable web application.

Option B. CPDoS Attack is incorrect because Cache Poisoned Denial-of-Service targets caching behavior to cause service denial.

Option C. Cloud Snooper Attack is incorrect because Cloud Snooper refers to bypassing firewall controls and command-and-control through cloud infrastructure paths.

Option D. Wrapping Attack is incorrect because wrapping attacks commonly target SOAP/XML signatures or request manipulation, not cloud instance metadata credentials.

Therefore, the best answer is A. IMDS Attack.

CEH courseware categorizes hackers based on intent, authorization, and affiliation. State-sponsored hackers are defined as individuals or teams who conduct cyber operations on behalf of a government to advance national interests. These operations often include espionage, cyber warfare, intelligence gathering, and covert offensive actions. Unlike organized hackers or cybercriminal groups, whose motivations may include financial gain or ideological activism, state-sponsored units follow strategic directives issued by government agencies. CEH materials explain that such groups operate with access to advanced tools, long-term funding, and classified intelligence, enabling them to execute highly sophisticated and covert operations targeting foreign governments, corporations, or critical infrastructure. Hacktivists pursue political or social causes, while gray-hat hackers operate without explicit permission but without malicious intent. Only state-sponsored hackers match the scenario where cyber experts are formally trained, resourced, and authorized by a national government to conduct operations that remain undetected. Therefore, the correct classification is state-sponsored hackers.

The correct answer is D. Expansion because the scenario emphasizes that, after the initial foothold, the attacker harvests credentials and moves laterally to compromise additional systems—routers, printers, and file servers—thereby broadening control across the internal environment. In CEH-aligned APT lifecycle descriptions, this stage is commonly associated with internal reconnaissance, privilege/credential access, lateral movement, and widening the foothold to increase resilience and reach. The attacker is no longer limited to the original compromised endpoint; instead, they are deliberately spreading to other networked assets to build operational advantage.

The sequence in the prompt is important. Initial Intrusion (A) already occurred via spear-phishing delivering the first payload to the manager’s laptop. The question asks what phase is being simulated at this point, after access is gained and the attacker is actively moving through the network. Persistence (B) refers to establishing mechanisms to maintain access (e.g., backdoors, scheduled tasks, services, persistence in credentials/accounts) so the attacker can survive reboots, password changes, or cleanup attempts. While an attacker might establish persistence during expansion, the defining action here is lateral movement and compromise of multiple internal systems, which is more directly expansion than persistence.

Search & Exfiltration (C) would involve identifying and collecting target data (in this case, sensitive research data) and transferring it out of the environment. The prompt explicitly states Alex has not yet targeted sensitive research data, which rules out the search/exfiltration phase as the primary activity being simulated right now.

Therefore, the phase of the APT lifecycle best matching credential harvesting followed by lateral movement and compromise of multiple internal devices/servers to build a broader foothold is Expansion.

CEH v13 describes relay attacks as credential forwarding techniques where attackers trick systems into authenticating to malicious servers, capturing hashes, and relaying them to privileged services. The described scenario aligns exactly with the PetitPotam attack, a known MS-EFSRPC abuse method that forces Windows domain controllers to perform NTLM authentication to attacker-controlled hosts. CEH discusses how relay attacks combined with Active Directory Certificate Services (AD CS) misconfigurations can allow attackers to request privileged certificates, effectively gaining domain administrator privileges without cracking hashes or accessing LSASS. CRIME (Option B) targets TLS compression and is unrelated. Browser token theft (Option C) applies to web sessions, not domain controllers. Session donation (Option D) is not part of Windows authentication hijacking. Thus, the scenario clearly represents a PetitPotam NTLM relay attack.

The correct answer is A. Confidentiality because the scenario describes sensitive information being transmitted in clear text, meaning the contents can be read by any unauthorized party who is able to intercept the traffic. In information security, confidentiality is the principle that ensures information is accessible only to authorized individuals, entities, or processes. When communications are sent without adequate protection—such as encryption—attackers performing network interception (for example, through man-in-the-middle positioning, packet sniffing on compromised routers, malicious Wi-Fi, or upstream monitoring) can directly view the document contents. That is a direct failure of confidentiality controls.

The prompt’s key phrase is that “anyone intercepting the traffic can read the contents.” This is not describing altered messages or forged emails; it is describing unauthorized disclosure. Confidentiality is typically protected using mechanisms such as encryption in transit (e.g., TLS for SMTP submission and server-to-server transport where possible, S/MIME, PGP), secure key management, and policy enforcement at email gateways. In legal environments, confidentiality is particularly critical because client communications and legal documents often contain privileged or regulated information. Clear-text transmission exposes the firm to compliance violations, reputational harm, and potential legal consequences.

Why the other options are not correct: Integrity concerns whether the message or document is altered in transit (tampering, modification, insertion). The scenario does not mention changes—only unauthorized reading. Non-repudiation ensures parties cannot deny sending or receiving a message (often supported by digital signatures and logging). The issue here is not proof-of-origin but exposure. Availability relates to whether systems and data remain accessible when needed (uptime, resilience, DoS). Nothing indicates service disruption.

Therefore, transmitting sensitive legal documents in clear text violates the fundamental security principle of confidentiality.

The correct answer is C, Bollards. Bollards are physical security controls designed to prevent vehicles from entering restricted areas or crashing into buildings, entrances, sensitive facilities, or pedestrian zones. They are commonly installed outside government buildings, data centers, banks, airports, and other critical infrastructure locations to mitigate vehicle-borne threats and unauthorized vehicle access. Depending on the security requirement, bollards may be fixed, removable, retractable, or reinforced to withstand high-impact collisions.

In CEH physical security concepts, organizations use preventive physical controls to protect personnel, equipment, and facilities from unauthorized access and physical attacks. Bollards are considered perimeter security controls because they create a physical barrier between vehicles and protected assets. A receptionist provides administrative access control but cannot physically stop a vehicle. A mantrap is an access-control vestibule used to restrict and verify personnel entry. A turnstile controls pedestrian movement and helps prevent tailgating. Since the question specifically asks about stopping vehicles from crashing through building doors, bollards are the most appropriate and effective security feature.

Answer: C

In CEH v13 DNS Enumeration, DNS cache snooping determines whether a DNS resolver has a record cached. When +norecurse is used and the response is NOERROR with no answer, it means the server is authoritative but does not have the record cached.

CEH v13 explains that this suggests no internal client has recently queried the domain, making option D correct.

The correct answer is A. Footprinting through Social Networking Sites.

The scenario describes the collection of intelligence from platforms where employees publish professional profiles, technical competencies, workplace relationships, project references, and organizational terminology. This is a classic example of footprinting through social networking sites.

CEH reconnaissance material identifies Footprinting through Social Networking Sites as a specific footprinting methodology . It also explains that social networking platforms can provide information such as personal details, work details, technology-related information, employee lists, activities, interests, and the nature of business . This directly matches the scenario’s use of employee profiles, skills, conversations, and terminology to infer internal structure and technologies.

Option B. Footprinting through Internet Research Services is incorrect because that usually refers to using online lookup services, business intelligence sites, public directories, or specialized research platforms rather than employee social networking activity.

Option C. Footprinting through Social Engineering is incorrect because the scenario does not involve manipulating or deceiving people into revealing information. The information is collected passively from publicly available profiles and discussions.

Option D. Footprinting through Search Engines is incorrect because the scenario does not primarily describe Google/Bing search operators or cached search results. It focuses on social networking platforms.

Therefore, the best answer is A. Footprinting through Social Networking Sites.

The correct answer is B because credential stuffing uses previously leaked or stolen username-password pairs against other services, relying on the common user behavior of reusing passwords across multiple platforms. In CEH authentication and password-attack concepts, weak password practices and compromised credentials are major causes of unauthorized access. The CEH-aligned material notes that weak password policies allow attackers to bypass weak credentials, and credentials exposed through insecure channels can lead to compromise. Credential stuffing differs from brute force because the attacker is not trying every possible password combination. It also differs from a dictionary attack because the attacker is not testing dictionary words; instead, they are testing known leaked credentials. Replay attacks reuse captured authentication data or session tokens, but the question specifically mentions weak password reuse across services using leaked credentials. Therefore, the best and most precise answer is credential stuffing.

This task describes passive reconnaissance using advanced search operators, a technique covered in CEH as search engine reconnaissance or Google dorking. The objective is to find potentially exposed documents on hidden services while avoiding direct interaction with forums or services. The most important element in the query is restricting results to hidden service domains using the site:onion operator. Any option that does not include site:onion is less suitable because it will return results from the public web rather than from .onion resources.

Option A is the strongest fit because it combines three high-value filters: filetype:pdf to focus on document artifacts that are commonly leaked or shared, intitle: " admin access " to target titles suggesting privileged access or administrative information, and site:onion to restrict the scope to hidden services. In CEH reporting and threat intelligence workflows, targeting high-signal keywords such as admin access, credentials, password list, or vpn access in document metadata is a practical way to identify likely leak sources without active engagement.

Option B lacks site:onion, so it fails the hidden-service requirement. Option C includes site:onion but the phrase secure login is more generic and may return many benign pages, reducing precision. Option D includes site:onion and filetype targeting, but user accounts is broader and less indicative of immediate access data than admin access. Therefore, A best supports efficient passive discovery of high-risk documents relevant to credential exposure on hidden services.

The correct answer is D, Rules of engagement. In CEH pre-engagement concepts, the rules of engagement document defines the authorized boundaries of a penetration test before any testing begins. It specifies what testing techniques are permitted, which systems or networks may be tested, when testing may occur, what actions are prohibited, whom to contact during emergencies, and how incidents such as service disruption should be handled. It also helps protect the penetration tester by documenting client approval and limiting liability when the tester acts within the agreed boundaries. A project scope may list targets, IP ranges, applications, or business units included in testing, but it does not fully cover operational permissions and liability terms by itself. A nondisclosure agreement protects confidential information discovered during the engagement. A service-level agreement defines service expectations such as uptime, response time, or support obligations. Therefore, the document that best matches allowed testing, timing, and tester liability limits is the Rules of engagement.

The ntpq utility provides detailed NTP peer information, synchronization states, offsets, delays, and strata. CEH specifically lists ntpq as the tool for querying NTP daemon status and enumerating peer relationships, making it essential for reconnaissance and lateral movement mapping.

Ethical hacking, as defined throughout CEH courseware, is the authorized and legitimate process of identifying vulnerabilities, weaknesses, and misconfigurations in information systems. The primary objective is to strengthen security by discovering issues before malicious actors can exploit them. Ethical hackers follow strict legal guidelines, obtain written permission, and operate within a defined scope to ensure their activities contribute positively to the organization’s security posture. Unlike malicious hacking, the intent is not to steal data, cause harm, or disrupt operations. Ethical hackers use the same tools, techniques, and methodologies that attackers use, but with the purpose of remediation and risk reduction. CEH emphasizes that ethical hacking supports defense-in-depth strategies by enabling organizations to harden their environments and proactively mitigate threats. Therefore, identifying and fixing vulnerabilities is the central mission of ethical hacking.

CEH v13 defines a white hat hacker as a security professional with explicit authorization to perform penetration testing, vulnerability assessments, and exploitation attempts within legal and contractual boundaries. Their objective is to strengthen security, not compromise it. White hats follow structured methodologies, document findings, and provide remediation recommendations. A black hat (Option A) acts maliciously and without permission. A grey hat (Option B) operates without authorization but without harmful intent, which is not compliant with corporate penetration testing procedures. Script kiddies (Option C) rely on pre-built tools without deep knowledge and are not employed for legitimate engagements. Therefore, the individual described is a white hat, operating under legal and ethical guidelines with organizational consent.

The described bypass is most consistent with using an in-line comment technique. Many simplistic SQL injection filters look for specific “blocked” keywords such as SELECT, UNION, OR, or DROP as contiguous strings. If the tester breaks a keyword apart by inserting tokens the database will ignore—most commonly comment delimiters—the filter may fail to match the forbidden keyword, while the SQL parser still reconstructs the intended meaning. For example, inserting comment markers inside a keyword can cause the application-layer filter to miss the pattern, yet the database can still process the statement depending on the DBMS and parsing rules. This is why comment-based obfuscation is a common SQLi evasion approach against weak signature filters.

The scenario’s wording “broken apart with unexpected symbols” maps well to comment markers such as /**/ (or other DBMS-specific comment forms). These characters look “unexpected” to a naïve filter, but to the SQL engine they are treated as comments/whitespace and effectively ignored during parsing, allowing the attacker’s intended keyword to be interpreted correctly.

Why the other options are less aligned:

String concatenation (A) is an obfuscation approach where attackers build keywords/strings using concatenation operators or functions (DBMS-specific). The scenario emphasizes splitting keywords with symbols that the DB interprets correctly as separators/ignored content, which more directly matches comment insertion.

Hex encoding (B) encodes parts of a payload (strings, sometimes function names) in hexadecimal form. That is a different technique than splitting keywords with inserted symbols.

Null byte (D) is historically used to terminate strings in certain contexts (more common in older file/path handling bugs) and is not the primary technique for bypassing keyword filters in modern SQL parsing.

Therefore, the SQL injection evasion technique is C. In-line Comment.

The correct answer is D. ADB Exploitation via TCP 5555.

The scenario describes Android devices accepting remote debugging connections over the network without USB. The high-numbered port commonly associated with Android Debug Bridge over TCP is 5555. When ADB is exposed over TCP, an attacker may interact with the device remotely, issue commands, install packages, forward ports, capture screenshots, and enumerate applications depending on device state and authorization controls.

CEH-aligned mobile testing material identifies ADB, or Android Debug Bridge, as the mechanism used to connect to Android devices for testing and control operations . The scenario’s description of wireless remote debugging and command execution aligns with exposed ADB over TCP.

Option A. Device Administration API Abuse is incorrect because the Device Administration API provides enterprise-style management controls such as policy enforcement or remote wipe, not open remote debugging over TCP 5555.

Option B. FRP Bypass is incorrect because Factory Reset Protection bypass concerns bypassing Google account protection after reset.

Option C. Android Rooting is incorrect because rooting grants privileged control locally, but the scenario specifically points to exposed remote debugging over the network.

Option D. ADB Exploitation via TCP 5555 is correct because the devices are accepting ADB-style remote control over the wireless network.

Therefore, the best answer is D. ADB Exploitation via TCP 5555.

The correct answer is D. Reconnaissance.

The scenario describes an early-stage information-gathering activity. The team is not exploiting the application, maintaining access, or actively compromising accounts. Instead, they are mapping exposed endpoints, directories, parameters, scripts, backend behavior, response differences, and error-handling patterns to understand the application before later testing.

CEH methodology describes reconnaissance as the preparatory phase where an attacker or tester gathers as much information as possible about a target before launching subsequent phases . EC-Council material also describes footprinting as building a blueprint or profile of an organization or target in a methodological manner, including discovering systems, services, access points, and mapping the network .

Option A. Maintaining Access is incorrect because there is no persistence or continued unauthorized access.

Option B. Scanning is less accurate because although some observation and endpoint checking may occur, the broader activity is structural information gathering at the beginning of the engagement.

Option C. Gaining Access is incorrect because the team is not exploiting vulnerabilities or taking control of the application.

Option D. Reconnaissance is correct because the activity focuses on collecting and organizing information to support later testing phases.

Therefore, the best answer is D. Reconnaissance.

Local File Inclusion vulnerabilities arise when a web application incorporates user-supplied input into file-handling functions without proper sanitization. CEH courseware emphasizes that attackers can leverage directory traversal sequences (such as ../../) to escape the intended directory structure and access sensitive local files. An LFI payload commonly targets system files like /etc/passwd on Linux to extract user information or escalate the attack further.

The correct answer is B. NTP Enumeration because the indicators and the data obtained match enumeration of the Network Time Protocol (NTP) service, which commonly runs on UDP port 123. In CEH-aligned reconnaissance and enumeration concepts, attackers often enumerate exposed services to learn configuration and internal details that can assist with follow-on attacks. When NTP is reachable from untrusted networks and is misconfigured (or supports certain query modes), it can leak information about the time server’s peers, synchronization status, and operational metrics such as offset and delay—exactly the attributes described in the scenario.

The prompt also notes that Joe can gather internal hostnames and client IP addresses connected to the time server. This aligns with how NTP can reveal associated systems and relationships: time servers often have multiple internal clients, upstream peers, or configured associations. Queries that expose peer/association information can unintentionally disclose internal naming conventions, IP address ranges, and network structure—valuable intelligence for an attacker conducting mapping and target selection. In addition, time infrastructure is frequently centralized, so enumerating it can provide a hub-like view of the environment.

Why the other options are incorrect: DNS zone transfer enumeration is associated with DNS AXFR and typically yields DNS records such as subdomains and MX/CNAME entries—not NTP peers/offsets/delays and not UDP 123. VoIP enumeration targets telephony protocols and services (e.g., SIP) on different ports and would not center on time synchronization metrics. NetBIOS enumeration involves ports 137–139 and returns NetBIOS name and session information, not NTP operational data.

Therefore, the technique used to obtain peer, offset, delay, and connected client details from a UDP/123 time server is NTP enumeration.

DNS interrogation is a core passive and semi-active reconnaissance technique described in CEH v13 Reconnaissance Techniques. It allows ethical hackers to gather publicly available information about a target’s domain infrastructure.

Through DNS queries, testers can retrieve:

Subdomains (via zone transfers, brute force, or DNS records)

Mail server IP addresses (via MX records)

Server IP addresses, which can then be mapped to approximate geographic locations

However, DNS does not store authentication credentials such as usernames and passwords. That information resides in authentication systems like Active Directory, LDAP, or application databases, not DNS.

Therefore, Option A is the only choice that cannot be obtained via DNS interrogation. CEH v13 clearly distinguishes between naming infrastructure data and credential-based information, reinforcing why DNS enumeration cannot reveal user credentials.

Thus, Option A is correct.

CEH documentation explains that WPA-TKIP was a transitional security protocol and does not use AES encryption, relying instead on RC4-based mechanisms.

The lack of AES-based encryption makes WPA-TKIP vulnerable to injection and replay attacks.

Option C is correct.

Options A applies to WEP.

Option B affects authentication, not TKIP weakness.

Option D is not the primary TKIP flaw.

CEH recommends WPA2/WPA3 with AES.

The correct answer is C. VeraCrypt.

VeraCrypt is the best match because it supports encrypted containers, mounted encrypted volumes, strong encryption algorithms such as AES, and hidden volumes. CEH-aligned cryptography material lists VeraCrypt among tools used for encrypting files, folders, and protective storage services . The same reference identifies AES as a block cipher supporting key lengths of 128, 192, or 256 bits .

Option A. FileVault is incorrect because FileVault is Apple’s full-disk encryption solution for macOS and does not best match encrypted containers and hidden-volume requirements.

Option B. Rohos Disk Encryption can create encrypted disks, but the combination of AES-256 support, portable encrypted containers, and hidden-volume capability most strongly identifies VeraCrypt.

Option D. BitLocker Drive Encryption is incorrect because BitLocker is primarily a Windows full-volume encryption solution. It does not provide VeraCrypt-style hidden encrypted containers.

Therefore, the best answer is C. VeraCrypt.

This scenario represents a Tautology-Based SQL Injection, a fundamental SQL injection technique covered under the Web Application Hacking module in the CEH v13 curriculum. The defining characteristic of this attack is the injection of a condition that always evaluates to TRUE, thereby bypassing authentication or authorization controls.

In the given example, the injected input 1 OR ' T ' = ' T ' ; -- manipulates the logical condition of the SQL query. A typical vulnerable login query may resemble:

SELECT * FROM users WHERE user_id = 1 AND password = ' input ' ;

When the attacker submits the injected payload, the resulting SQL statement becomes:

SELECT * FROM users WHERE user_id = 1 OR ' T ' = ' T ' ; -- ' ;

The expression ' T ' = ' T ' is a tautology, meaning it always evaluates to TRUE regardless of context. As a result, the database returns records without properly validating the user’s credentials, granting unauthorized access.

According to EC-Council CEH v13, tautology-based SQL injection is classified as a Boolean-based injection technique where attackers exploit improper input validation to alter the logical flow of SQL queries. This attack does not depend on database error messages (as in Error-Based SQL Injection), does not extract data using UNION statements (Union-Based SQL Injection), and does not rely on response delays (Time-Based Blind SQL Injection).

CEH v13 emphasizes that such attacks are especially effective against login forms and authentication mechanisms when developers fail to implement input sanitization, parameterized queries, or prepared statements. This attack is one of the most common and exam-tested SQL injection types because it clearly demonstrates how flawed logic can compromise application security without advanced techniques.

Understanding tautology-based SQL injection is critical for ethical hackers, as it forms the foundation for identifying and mitigating more complex SQL injection variants.

The technique being used is Error Message Analysis, because the tester is intentionally supplying a special character payload and then interpreting the application’s returned database or SQL parsing error to infer the presence of an injection point. In CEH-aligned SQL injection methodology, one of the earliest indicators of SQL injection is when crafted input causes the application to generate a database error, such as syntax errors, unclosed quotation marks, type conversion failures, or context-related messages that reveal how the input is being embedded into a query. A long series of single quotes is a classic trigger: if user input is concatenated into a SQL statement without proper sanitization or parameterization, the quotes can break the query structure and force the database engine or ORM layer to throw an error that exposes the query context.

The scenario explicitly states the response is an error message indicating the application cannot handle the input “in the current SQL context.” That means the application is leaking information through error responses, which CEH highlights as both a detection opportunity for testers and a security weakness because detailed errors can guide attackers toward successful payload construction.

This is not primarily “Detecting SQL Modification,” which focuses on confirming changes in query logic or results, often using boolean-based techniques. It is not “Function Testing,” which validates application functions rather than probing input handling at the SQL layer. While the input resembles fuzzing, fuzz testing is broader and does not specifically depend on interpreting SQL error messages as the detection signal. Here, the decisive evidence is the SQL-context error returned, making Error Message Analysis the correct technique.

The behavior described most closely matches an insider attack, because the actor is a temporary contractor who has physical proximity and implicit access to internal areas where employees work and handle sensitive information. In CEH guidance, an “insider” is not limited to permanent employees; it includes contractors, vendors, interns, and any trusted or semi-trusted individuals who can enter facilities or access internal environments. The attack combines two common insider-facilitated techniques: shoulder surfing and dumpster diving. Recording employees entering passwords is a form of shoulder surfing, where credentials are harvested by observing or capturing authentication entry through direct viewing or recording devices. Finding sensitive documents in a trash bin indicates dumpster diving, where attackers recover confidential information from improperly disposed materials.

These actions are typically feasible because the attacker is already inside the perimeter and can exploit weak operational security practices, such as lack of clean-desk enforcement, inadequate shredding policies, and insufficient physical monitoring of visitor or contractor activity. CEH materials emphasize that insider threats are particularly dangerous because they bypass many external perimeter controls and can blend into normal workplace behavior.

The other options do not fit. A distribution attack generally refers to compromise introduced through supply chain or third-party distribution channels, not on-site observation and trash retrieval. A passive attack is too generic and does not capture the key element of an authorized or trusted presence enabling the compromise. “Cisco-in attack” is not a standard CEH attack category for this scenario. Therefore, the most accurate classification is an insider attack.

Comprehensive Explanation from CEH v13 Courseware:

CEH v13 identifies XML Signature Wrapping (XSW) attacks, also known simply as Wrapping attacks, as a major threat against SOAP-based web services. These attacks exploit weak XML parsing and insufficient validation of signed message components. SOAP messages often include digitally signed sections, but if the server validates the signature without confirming the correct position or structure of the signed elements, attackers can duplicate, move, or wrap signed content inside a modified XML envelope. This allows an attacker to inject malicious payloads while still presenting a valid signature. CEH details how this can lead to unauthorized execution, privilege escalation, or bypassing authentication controls in SOAP APIs. Cloud snooping, cryptanalysis, and IMDS abuse do not involve message duplication or signature misplacement. The scenario precisely matches CEH’s definition of a Wrapping Attack in SOAP/XML security.

MAC flooding is a Layer 2 attack described in CEH v13 Network and Perimeter Hacking, where attackers overwhelm a switch’s CAM table with fake MAC addresses. Once the table is full, the switch behaves like a hub, forwarding traffic to all ports.

The most definitive indicator of MAC flooding is numerous MAC addresses learned on a single switch port, which is abnormal behavior in a properly segmented network. CEH v13 identifies this condition as a key forensic indicator of CAM table exhaustion.

ARP anomalies may occur, but they are more commonly associated with ARP spoofing attacks. IP-to-MAC inconsistencies indicate MITM attacks, not MAC flooding.

Thus, option C is the clearest confirmation.

The Certified Ethical Hacker (CEH) Cloud Computing and Data Protection module emphasizes the importance of resilient backup strategies to protect against data tampering, ransomware, and unauthorized modification.

The 3-2-1 backup model is a widely recommended best practice referenced in CEH materials. It requires maintaining:

3 copies of data

Stored on 2 different media types

With 1 copy stored offsite

This approach ensures that even if cloud backups are compromised or altered, clean and uncompromised versions remain available. CEH documentation highlights this model as a core defense against data integrity attacks in cloud environments.

Option D directly mitigates the risk of backup tampering.

Options A, B, and C address unrelated security concerns and do not protect backup integrity.

Blowfish is the only option that matches all the technical characteristics described. In CEH cryptography concepts, symmetric algorithms are commonly distinguished by their structure (block cipher versus stream cipher), block size, and supported key lengths. The question states the algorithm encrypts data in 64-bit blocks and supports a variable key size ranging from 32 bits up to 448 bits, and it was introduced as a replacement for DES. Blowfish fits precisely: it is a symmetric block cipher with a 64-bit block size and a configurable key length from 32 to 448 bits, designed to be fast in software and positioned historically as an alternative to older ciphers such as DES.

The other choices do not align with these identifying properties. RC4 is a stream cipher and does not operate on fixed-size blocks, so it cannot match the 64-bit block requirement. AES is a block cipher but uses a 128-bit block size with fixed key sizes of 128, 192, or 256 bits, not 32 to 448 bits. Twofish, while related historically as a successor-era design, also uses a 128-bit block size and fixed key sizes up to 256 bits, so it does not match either.

From a CEH perspective, the mention of variable key sizes also hints at risk evaluation: shorter keys in any cipher can be brute-forced, so secure deployments require strong key length selection and proper key management. Additionally, Blowfish’s 64-bit block size can be a concern in large-volume encryption scenarios due to block collision risks, which is why modern systems often prefer 128-bit block ciphers for new designs.

The Certified Ethical Hacker (CEH) Cloud Computing module emphasizes that serverless environments rely heavily on granular permission models. Attacks involving compromised APIs often succeed because functions are granted excessive privileges.

Option D is correct because enforcing function-level permissions and the principle of least privilege directly limits what a compromised function can execute. CEH documentation states this is the primary defense against serverless abuse.

Option A is beneficial but reactive.

Option B focuses on SaaS governance rather than FaaS execution control.

Option C provides visibility but does not directly prevent privilege misuse.

CEH highlights identity and access management (IAM) as critical in serverless security.

The correct answer is D, ciphertext-only attack, because the attackers possess only encrypted data and have neither the encryption key nor any confirmed samples of the original plaintext. In CEH-aligned cryptography concepts, cryptanalytic attacks are categorized by what information and capabilities the attacker has. A ciphertext-only attack is the most constrained model: the attacker attempts to infer the plaintext or key by analyzing ciphertext alone, often leveraging statistical properties, repetitions, formatting assumptions, and structural patterns that may leak information when encryption is misused.

The scenario highlights that the attacker “examines encrypted outputs in bulk” to detect “structural or statistical patterns.” That wording maps directly to ciphertext-only analysis: looking for patterns caused by weak modes of operation, poor IV/nonce handling, deterministic encryption, repeated blocks (common in ECB mode), predictable headers, or consistent record templates. With block ciphers, large datasets increase the chance that repeated plaintext blocks produce repeated ciphertext blocks if the system uses an unsafe mode or reuses IVs, allowing an attacker to correlate records, identify fields, or sometimes recover content when combined with protocol or file-format knowledge.

The other options require more attacker capability than the prompt provides. Known-plaintext attacks require some plaintext-ciphertext pairs. Chosen-plaintext attacks require the ability to encrypt attacker-chosen inputs. Chosen-ciphertext attacks require a decryption oracle or the ability to submit ciphertext for decryption. Since none of those are present here, Emma should evaluate ciphertext-only exposure and specifically validate the cipher mode, IV/nonce uniqueness, padding behavior, and whether encryption is semantically secure for stored patient records.

yes do please

The CEH Footprinting and Reconnaissance module highlights Google Alerts as a key passive reconnaissance tool for monitoring changes in web content, news, and online mentions.

Option B is correct.

Option A is active engagement.

Option C aids anonymity but not monitoring.

Option D is illegal and unethical.

CEH strongly promotes automated alerting for competitive intelligence.

The correct answer is D. Signature Recognition.

The monitoring system is detecting traffic because it matches known attack patterns stored in a threat database. When the payload sequence is slightly changed, the alert no longer triggers. This is the classic behavior of signature-based detection.

CEH-aligned IDS material explains that signature recognition means that, for every known hacker technique, engineers code a detection pattern into the system. It describes this as simple pattern matching, such as examining packets for a known malicious pattern .

Option A. Protocol Anomaly Detection is incorrect because protocol anomaly detection identifies deviations from expected protocol behavior, not just known exploit strings.

Option B. Anomaly Detection is incorrect because anomaly detection compares behavior against a baseline of normal activity. The scenario describes matching known attack payloads.

Option C. Stateful Protocol Analysis is incorrect because stateful protocol analysis evaluates protocol state and expected protocol behavior across sessions.

Option D. Signature Recognition is correct because detection depends on matching known patterns, and small changes to the exploit sequence can evade detection.

Therefore, the best answer is D. Signature Recognition.

The correct answer is B, Lateral movement. In CEH security operations and incident response concepts, audit logs are essential for tracing user activity, source IP addresses, logon/logoff events, system changes, and other important security events. CEH-related material states that audit logs are vital for backtracking an incident and finding the root cause; when accounting or logging information is insufficient, incident investigation becomes extremely difficult. Lateral movement is especially difficult to detect without centralized logging because the attacker’s activity is spread across multiple internal hosts. Detecting it requires correlating events such as authentication attempts, remote service execution, SMB access, PowerShell use, privilege changes, and connections between endpoints. If each system keeps logs locally, defenders may miss the full attack path, especially if the attacker clears or tampers with local logs. CEH hacking methodology also notes that attackers can compromise connected intermediate systems and use compromised systems to launch attacks against others. Recon, delivery, and initial access may still appear in perimeter, email, proxy, or firewall logs, but lateral movement depends heavily on cross-host audit correlation.

WPA2-PSK networks authenticate users using a pre-shared key derived from a passphrase. After capturing the 4-way handshake, CEH teaches that the standard and most effective method to recover the key is to perform an offline dictionary attack, where wordlist entries are hashed and compared against the captured handshake values. Offline cracking avoids detection and is significantly faster than brute-force attempts.

Credential stuffing is the best match because the scenario highlights automated login attempts across many accounts with an unusually high success rate, occurring in the aftermath of a breach. In CEH-aligned system hacking concepts, credential stuffing is the automated testing of known username and password pairs—typically harvested from prior breaches—against a different service. Because many users reuse passwords across sites, attackers often achieve a higher-than-normal success rate compared to guessing-based attacks. This “high success rate” across numerous accounts is a key indicator that the attacker is not randomly guessing, but replaying valid credentials at scale using bots or automation frameworks.

Password spraying differs in that the attacker tries a small set of common passwords (or one password) across many accounts to avoid lockouts. Spraying generally yields a lower success rate and is driven by guessing rather than replaying known credential pairs. A brute force attack is even noisier and typically involves repeated guessing for a single account or small set of accounts; it is both slower and far less likely to produce a high success rate across many users in a short period. Phishing attacks can lead to account takeovers, but the pattern described would more often show targeted victims and varied sources rather than broad, automated, multi-account authentication bursts with consistently successful logins.

CEH defensive guidance emphasizes layered controls: enforce MFA, monitor for abnormal login velocity and credential reuse indicators, deploy bot detection and rate limiting, use breached-password checks, implement adaptive authentication, and tune lockout and detection policies to disrupt automated credential replay without enabling denial-of-service against legitimate users.

CEH v13 defines a white hat hacker as a security professional who performs authorized assessments to identify vulnerabilities and strengthen an organization’s defenses. The defining characteristic of white hat activity is the presence of formal permission—typically through a signed rules-of-engagement, scope of work, and explicit authorization from the organization. CEH emphasizes that white hats adhere to legal boundaries, follow ethical guidelines, and document findings to support remediation. They may use the same tools and methodologies as malicious hackers, but the intent and authorization distinguish them. In contrast, black hats operate without permission and with malicious intent. Grey hats act without authorization but may not have malicious motivations, making them inappropriate in a formal penetration testing engagement. Script kiddies lack professional skill and rely on pre-made tools without understanding the underlying techniques. Therefore, the hacker described is a white hat—an ethical professional performing sanctioned testing.

The behavior described most closely matches Agent Smith, an Android malware family known for replacing or hijacking legitimate applications and monetizing that access through ad fraud and data abuse. The strongest clues are the installation from a third-party marketplace, the silent replacement of already installed apps, and the use of those altered applications to push excessive advertisements while collecting information. In CEH mobile platform discussions, third-party app ecosystems are repeatedly identified as high-risk distribution paths for malicious or trojanized software because the apps may avoid the stricter vetting associated with official marketplaces. Pegasus is generally associated with advanced spyware capabilities and covert surveillance, not ad-fraud-driven replacement of popular apps. GoldPickaxe is tied to more targeted mobile credential and identity theft campaigns, while Mamo is not the fitting malware profile here. This question is testing recognition of a well-known Android malware pattern: malicious code embedded in an apparently useful application that later abuses the trust and visibility of legitimate apps already on the phone. CEH mobile security principles stress that unofficial app sources significantly increase the risk of this kind of compromise.

The correct answer is B, Security Incident and Event Monitoring (commonly referred to as SIEM – Security Information and Event Management). SIEM solutions collect event logs from multiple sources such as servers, firewalls, routers, switches, endpoints, security devices, and applications. They then normalize, correlate, analyze, and store these logs to identify suspicious activities and security incidents. A major function of SIEM technology is to generate alerts when predefined rules, behavioral anomalies, or threat indicators are detected.

In CEH v13 Security Operations and Incident Response topics, SIEM systems play a critical role in centralized log management, event correlation, threat detection, compliance reporting, and incident investigation. By correlating events across multiple systems, SIEM tools can identify attacks that may not be visible when examining individual logs separately. Examples include detecting brute-force attacks, privilege escalation attempts, malware infections, lateral movement, and data exfiltration activities.

The other options are incorrect because an Intrusion Prevention System focuses on blocking attacks, a Network Sniffer captures packets, and a Vulnerability Scanner identifies weaknesses rather than correlating security logs. Therefore, the best answer is Security Incident and Event Monitoring (SIEM).

The correct answer is D because the root cause of the breach was an unpatched, outdated Apache HTTP Server vulnerable to remote code execution. According to CEH principles under Security Operations and Incident Response, vulnerability management and risk assessment are critical components of defensive security strategy. An extensive risk assessment enables the organization to identify vulnerable assets, prioritize patching based on severity and business impact, and implement a structured remediation plan.

Risk assessment is part of the vulnerability management lifecycle, which includes asset identification, vulnerability scanning, risk evaluation, prioritization, patch management, and verification. By determining which systems are most exposed and critical, the organization can apply patches and security updates systematically, reducing the attack surface. Since the breach occurred due to a known vulnerability, proper patch management and regular security updates would have prevented exploitation.

Options A, B, and C represent hardening or segmentation techniques but do not directly address the core issue of outdated software vulnerabilities. Blocking ports and using dedicated machines are good security practices; however, they do not eliminate the risk of exploitation if the web server software itself remains unpatched. Therefore, implementing a comprehensive risk assessment process followed by prioritized patch management aligns directly with CEH-recommended best practices for preventing similar future incidents.

The correct answer is Credentialed Scanning. CEH vulnerability assessment guidance explains that credentialed scans use authorized login access on the target system so the scanner can inspect the machine from the inside with a much higher level of accuracy and detail. That is why credentialed scanning can identify installed updates, local policy settings, configuration inconsistencies, file permissions, registry issues, and patch gaps that are not always visible from an external network perspective. The question specifically mentions granular host-level findings that required direct system-level inspection, which is a strong indicator that valid credentials were used to query the target systems. Non-credentialed scanning, by contrast, relies on remote observation and network-visible characteristics, so it generally cannot provide the same depth of internal host information. Automated scanning is too broad a label, and application scanning is limited to application-layer targets rather than host operating-system posture. CEH materials consistently note that credentialed scans produce more accurate vulnerability results and reduce false positives because the scanner can verify software versions, patch states, and security settings directly on the target machine rather than merely inferring them from banners or exposed services.

TCP NULL scanning is a stealth scanning technique covered in CEH v13 Reconnaissance and Network Scanning. In a NULL scan, all TCP flags are set to zero. According to RFC 793 and CEH documentation, closed ports must respond with a TCP RST (Reset) packet.

If the port is open, the target typically does not respond, making this technique useful for firewall evasion. Therefore:

RST response = Closed port

No response = Open or filtered port

Other options do not apply to NULL scans:

SYN/ACK is associated with SYN scans.

ICMP errors may indicate filtering, not port state.

Untethered jailbreaking is the only option that matches all key characteristics described: the device can reboot normally without needing a computer, and the jailbreak remains active after the restart with kernel-level modifications still in effect. In CEH-aligned mobile security concepts, the main difference among jailbreak types is what happens after a reboot.

A tethered jailbreak requires a computer to boot the device at all. If the phone restarts without being connected to a computer, it will not complete the boot process. That contradicts the scenario, which explicitly says the device can fully restart without requiring a computer. A semi-tethered jailbreak allows the phone to reboot without a computer, but it boots into a non-jailbroken state, meaning elevated privileges and kernel patching are not active until re-enabled through a tool. A semi-untethered jailbreak is similar in that it can boot normally without a computer, but the jailbreak does not persist automatically; it typically requires re-activating the jailbreak after each reboot to regain kernel patching and privileged access.

The scenario states the restart occurs while still “maintaining a patched kernel” and continuing access to protected filesystem data, which indicates persistence across reboot. That persistence is the defining feature of an untethered jailbreak. From a defensive and assessment perspective, this is considered higher risk because it provides continuous post-reboot privileged access, increasing the window for data access, tampering, and persistence mechanisms compared with reboot-reset jailbreak states.

The correct answer is B. NetBIOS Enumeration because the ports and services described map directly to NetBIOS over TCP/IP (NBT) and the actions align with querying NetBIOS name table and session services. In Windows networking (especially older systems), NetBIOS provides naming and session-layer services that can reveal valuable host and user information. Specifically, UDP 137 is used for the NetBIOS Name Service (NBNS), UDP 138 for NetBIOS Datagram Service, and TCP 139 for NetBIOS Session Service. Observing activity on UDP 137/138 and an open TCP 139 strongly indicates that NetBIOS services are reachable and can be interrogated.

The scenario states Jake “uses a utility to query the name table and session services,” which is a hallmark of NetBIOS enumeration. NetBIOS name table queries can disclose machine names, domain/workgroup names, and sometimes logged-in usernames (depending on configuration and what names are registered). Session/service enumeration can reveal information about active sessions and available resources. The fact that Jake obtains machine names, usernames, and shared folders without authentication is consistent with weakly configured legacy Windows networking where NetBIOS/SMB information disclosure is possible through null/unauthenticated queries.

Why not the other options: NFS enumeration targets UNIX/Linux file sharing and is unrelated to ports 137–139. SNMP enumeration uses UDP 161/162 and relies on SNMP communities, not NetBIOS naming/session queries. SMB enumeration is closely related and often overlaps operationally, but the question emphasizes “query the name table and session services” and explicitly references the classic NetBIOS port set (137/138/139), making NetBIOS enumeration the most precise classification for this behavior.

In practice, defenders mitigate this exposure by disabling NetBIOS where unnecessary, restricting these ports at network boundaries, enforcing SMB hardening, and limiting anonymous/null session information disclosure.

The correct answer is B, Buffer overflow. In CEH vulnerability and exploitation concepts, a buffer overflow occurs when a program writes more data into a fixed-size memory buffer than it was designed to hold. The excess data can overwrite adjacent memory, corrupt control data, crash the application, or allow attacker-controlled code execution. CEH-related material describes buffer overflow as writing too much data into an application’s allocated buffer, potentially overwriting adjacent memory, executing code, or crashing the system. It also explains that buffer overflow attacks rely on lack of boundary testing and, in stack-based cases, may overwrite a return pointer so execution flow switches to malicious code. XSS injects malicious scripts into web pages, CSRF tricks an authenticated user into performing unwanted actions, and SQL injection manipulates database queries. These do not primarily exploit memory corruption. Therefore, the vulnerability associated with memory corruption is buffer overflow.

CEH v13 emphasizes that well-secured applications use HTTPS, secure cookies, and session regeneration to defend against common session hijacking techniques. In such hardened environments, traditional attacks like session fixation or simple XSS-based token theft often fail because session IDs change at login and secure flags prevent exposure. The remaining viable approach is session token prediction, an advanced attack that analyzes statistical patterns, entropy weaknesses, or timing issues in session ID generation algorithms. CEH discusses that weak pseudorandom number generators (PRNGs) or predictable sequences can allow attackers to compute a valid session ID without intercepting traffic. This method bypasses cookie security and does not rely on manipulating user input, making it suitable for environments with strong defenses. MITM attacks (Option A) require certificate compromise, which is impractical. Session fixation (Option B) fails because the application regenerates tokens. XSS (Option D) is ineffective when secure flags prevent JavaScript access to cookies. Thus, token prediction is the correct answer.

According to the CEH System Hacking and Web Application Security modules, Man-in-the-Browser (MitB) attacks are among the most sophisticated and difficult session-hijacking techniques to detect. In MitB attacks, malware operates inside the victim’s browser, allowing attackers to intercept, modify, or inject transactions after authentication has occurred.

CEH documentation highlights that MitB attacks bypass:

Multi-factor authentication

Encrypted cookies

HTTPS/TLS protections

Because the malicious activity occurs at the browser level, security controls perceive transactions as legitimate.

Option B is correct.

Option A (XSS) is detectable via content security policies.

Option C is mitigated by regenerating session IDs.

Option D is ineffective against encrypted sessions.

CEH emphasizes MitB attacks as a critical threat to online banking systems.

The correct answer is B. Botnet Agents because the behavior described matches a command-and-control (C2) driven malware model where multiple compromised systems (“bots” or “zombies”) communicate with a remote controller and can be issued coordinated commands. In CEH-aligned malware concepts, a botnet is a collection of infected endpoints under centralized or distributed control. The malicious component installed on each infected workstation is commonly referred to as a bot/bot agent, which “checks in” to a C2 server to receive instructions and execute tasks silently in the background.

Several details strongly indicate botnet agent behavior: the payload is delivered via a disguised email attachment (a common initial infection vector), compromised machines silently communicate outbound to a remote server, and—most importantly—Daniel confirms multiple infected endpoints can receive synchronized commands and carry out actions simultaneously. The example of “sending bursts of outbound traffic on demand” aligns with typical botnet capabilities such as orchestrated DDoS traffic generation, mass scanning, spam sending, credential stuffing, or distributed task execution. The sustained observation “over the following week” also fits a botnet model where infected hosts maintain persistence and periodically beacon to C2 for updates and instructions.

Why the other options do not fit: Spyware primarily focuses on covertly collecting information (keystrokes, screenshots, browsing data) rather than executing synchronized commands across many machines. Scareware relies on alarming messages to trick users into paying or installing unwanted software; it does not describe silent C2 coordination. PUAs are typically unwanted but not necessarily malicious, often installed via bundling and usually lack structured C2 for coordinated remote command execution.

Therefore, the malicious component being simulated is best identified as botnet agents operating under C2 control.

CEH training emphasizes that mobile applications frequently mishandle local storage, leaving sensitive data such as tokens, passwords, API keys, or personal information unencrypted within SQLite databases, shared preferences, or flat-file storage. When encryption is absent or improperly implemented, attackers can directly access this data through filesystem extraction, Android Debug Bridge (ADB) access, physical device access, or rooted environments. CEH identifies “Insecure Data Storage” as one of the most critical mobile vulnerabilities because it bypasses server-side defenses entirely. Since the vulnerability specifically concerns data at rest, the most direct and effective exploitation method is to retrieve the locally stored unencrypted data. SQL injection (Option B) evaluates backend security, not device storage. XSS (Option C) is a web attack and unrelated to local encryption. Brute-forcing credentials (Option D) is unnecessary when sensitive information is already stored insecurely. Therefore, accessing local storage is the correct exploitation method.

The behavior described most closely matches an Eclipse attack. In an eclipse attack, an adversary isolates a victim node by controlling its peer connections so that the node communicates only with attacker-controlled (or attacker-influenced) peers. Once isolated, the attacker can feed the victim a manipulated view of the blockchain—such as withholding blocks, delaying transactions, or presenting an alternative chain history. This can enable downstream impacts like double-spending against merchants who rely on that node’s view for confirmation.

The scenario’s strongest indicators are:

The node “received blocks only from a small, fixed set of peers for several hours,” suggesting abnormal peer diversity and potential isolation.

The attacker “controlled which peers that node communicated with,” which is essentially the definition of eclipsing a node.

The node “accepted a conflicting history” and the attacker supplied “a private chain until they were ready to reveal it,” consistent with feeding the victim a tailored chain view and then releasing/realigning it to profit from reversed payments.

Why the other options are less fitting:

A Finney attack (A) involves a miner pre-mining a block containing a spend, making a payment to a merchant, and then releasing the pre-mined block to invalidate the merchant’s transaction—this doesn’t require isolating a specific node’s peers for hours.

A DeFi sandwich attack (B) is a mempool/MEV tactic on decentralized exchanges involving front-running and back-running, unrelated to isolating node peer connections or feeding a private chain.

A 51% attack (C) involves controlling a majority of network hash power/stake to rewrite history at network scale. The scenario emphasizes isolation of a particular merchant-related node via peer control rather than majority network control.

Therefore, the attack is best identified as D. Eclipse Attack.

CEH’s social engineering principles highlight psychological manipulation techniques such as authority, urgency, trust exploitation, and impersonation. In this scenario, the attacker leverages “perceived authority,” a powerful influence tactic where the social engineer poses as someone with legitimate power or sanctioned access—such as a technician, auditor, or vendor representative. CEH emphasizes that referencing real employee names, using technical terminology, and impersonating trusted third-party partners increases believability and reduces verification resistance. The receptionist’s acceptance of the attacker’s presence without verifying credentials matches classical authority-based exploitation. Leaked credentials, physical security logs, and network segmentation issues do not relate to human-layer social engineering. The situation clearly reflects the manipulation of trust and authority as described in CEH’s psychological attack vectors.

The correct answer is LLMNR/NBT-NS Poisoning. CEH system hacking coverage explains that when a Windows host cannot resolve a name through normal DNS, it may fall back to Link-Local Multicast Name Resolution or NetBIOS Name Service. An attacker on the local network can answer those broadcasts and falsely claim to be the requested resource. If the victim then attempts authentication, NTLM or NTLMv2 challenge-response data can be captured and later cracked offline. That is exactly what this question describes: a non-existent host lookup, a quick malicious response, capture of NTLMv2 hashes, and later credential cracking. Kerberoasting targets service tickets in Active Directory, not broadcast name resolution. Pass-the-Ticket involves Kerberos tickets, and Internal Monologue abuse is a different authentication abuse pattern. CEH materials specifically connect LLMNR/NBT-NS poisoning with tools such as Responder and highlight that these protocols can be abused to collect hashes for lateral movement or privilege escalation. The scenario’s sequence of name-resolution spoofing followed by hash capture is the defining signature of an LLMNR/NBT-NS poisoning attack.

Information Leakage is the most accurate threat category because the scenario centers on sensitive data becoming publicly accessible through unintended disclosure. In CEH coverage, information leakage refers to the exposure of confidential or internal details to unauthorized parties through oversharing, misconfiguration, poor operational security, or improper handling of information. Here, the data is already visible on public forums, meaning an attacker does not need to exploit a vulnerability in a system directly at first; they can simply collect and correlate exposed details such as employee names, email formats, internal hostnames, software versions, configuration snippets, IP ranges, or screenshots.

This aligns strongly with reconnaissance and OSINT techniques emphasized in CEH: adversaries routinely harvest publicly available information to build an attack plan, identify privileged targets, guess usernames, craft phishing lures, locate externally exposed services, or tailor further exploitation using revealed versions and settings. While social engineering can be a follow-on step, the core issue described is not persuading users to reveal information interactively. Instead, the organization’s risk stems from information already leaked due to careless online behavior.

Corporate espionage is a motive rather than a specific technique category, and system and network attacks describe active exploitation and intrusion attempts, which come after the intelligence-gathering stage. Therefore, to simulate the adversary’s method of gathering what has been exposed, Michael should focus on information leakage: identifying what is publicly disclosed, how it can be aggregated, and what attack paths it enables, then recommending containment and policy and awareness controls.

This question focuses on API Security, Webhooks abuse, and Webshell mitigation, all of which are addressed in the CEH v13 Web Application Hacking and Security Operations modules. The most appropriate corrective action is Option D, as it directly addresses the root causes and persistence mechanisms of the compromise.

According to CEH v13, attackers frequently exploit improper input validation in APIs and insecure webhook implementations to inject malicious payloads or gain remote command execution. Webhooks, when not properly validated, can accept malicious requests that trigger backend processes, making them a common vector for API abuse.

Input validation on all API endpoints is critical to prevent injection attacks, including command injection and SQL injection. CEH v13 explicitly emphasizes validating request parameters, headers, and payload structures to prevent malicious manipulation.

Reviewing webhook payloads ensures that only trusted sources can trigger automated actions, preventing attackers from abusing webhook functionality. This includes validating signatures, enforcing authentication, and restricting allowed payload formats.

Finally, regular scanning for webshells is essential because webshells provide persistent backdoor access. CEH v13 identifies webshell detection as a key defensive measure during incident response and post-exploitation containment.

Other options are incomplete:

A WAF alone cannot detect all webshells.

IP blocking is ineffective against spoofed or cloud-based attacks.

MFA and server hardening are valuable but do not directly address webhook abuse or existing webshells.

Therefore, Option D provides the most comprehensive, CEH v13–aligned mitigation strategy.

The correct answer is D, Split DNS. Split DNS, also called split-horizon DNS, uses separate DNS views or servers for internal and external name resolution. In this configuration, the DNS server in the DMZ provides public-facing records for external users, while the internal DNS server provides private records for internal hosts and services. This prevents sensitive internal hostnames, IP addresses, and infrastructure details from being exposed to the public. CEH networking topics describe DNS as the system that translates hostnames to IP addresses and vice versa, making DNS records valuable during footprinting and enumeration. CEH perimeter-security material also explains that a DMZ is a buffer area between the internal private network and the external public network, used for services that must be reachable externally. DNSSEC is used to protect DNS integrity cryptographically, DynDNS maps changing IP addresses to names, and “DNS Scheme” is not the standard term. Therefore, this configuration is Split DNS.

The correct answer is C, Fast flux. Fast flux is a DNS-based evasion technique commonly associated with botnets, malware hosting, phishing infrastructure, and command-and-control resilience. In fast flux, one domain name is mapped to many rapidly changing IP addresses, often with very short DNS TTL values. This causes clients resolving the same domain to receive different destination hosts over time, making takedown, blocking, and attribution harder. CEH DNS fundamentals explain that DNS translates human-readable names into IP addresses and that DNS responses may contain address mappings that are cached according to Time-to-Live values. The described behavior—rapidly rotating IP addresses for the same domain—matches fast flux, not DNS tunneling, which hides data inside DNS queries; not DNS poisoning, which inserts false DNS records; and not zone transfer, which copies DNS zone records between servers. Therefore, the technique being used is fast flux.

The correct answer is A, Static Network Address Translation. Static NAT creates a fixed one-to-one mapping between a public IP address and a specific private/internal IP address. This is the correct choice when an internal server must be reachable from outside the network using the same public address every time, which is commonly called server publishing or exposing a service through a firewall/router. CEH networking material explains that NAT is used at network borders and that basic NAT provides one-to-one mapping where each internal private IP maps to a unique public address; return traffic is translated back to the corresponding internal host. NAT also hides internal addressing while rerouting externally addressed packets to the proper internal system. Port Address Translation or NAT overload is different because many internal hosts share one public IP using ports/session IDs, so it does not guarantee one public IP always maps to one internal machine. Therefore, static NAT is the best answer.

CEH v13 explains that cryptographic consistency is essential for secure session management. Variable token lengths can leak information about encryption methods, key sizes, or user privilege levels, making sessions vulnerable to cryptanalysis or targeted attacks.

The most effective mitigation is implementing uniform encryption strength across all roles, ensuring consistent key sizes, algorithms, and token formats. While MFA improves authentication and key rotation improves lifecycle management, neither directly resolves cryptographic inconsistency.

CEH v13 stresses that encryption should be role-agnostic and standardized. Therefore, Option C is correct.

The correct answer is D. Integrity. In the CIA triad, integrity refers to protecting information from unauthorized alteration, modification, or revision, whether the data is stored at rest or moving across a network. CEH-aligned material explains that integrity ensures data received is exactly the same as the data originally sent, and any addition, deletion, or alteration means integrity has been compromised. The question states that an attack altered the contents of two critical files, which directly indicates unauthorized modification of data. This is an integrity violation because the trustworthiness, accuracy, and reliability of those files can no longer be guaranteed. Availability is incorrect because availability concerns whether systems or data are accessible when needed. Authentication is incorrect because it verifies the identity of a user, device, or process. Confidentiality is also incorrect because confidentiality focuses on secrecy and preventing unauthorized disclosure, not file modification. Therefore, an attack that changes critical file contents is best described as an integrity attack.

CEH v13 highlights the Idle Scan as one of the stealthiest reconnaissance methods available, designed specifically to avoid detection by IDS and security monitoring tools. Idle scanning leverages a “zombie host”—a system with a predictable IPID sequence—to route all probe packets through it. Since no packets ever originate directly from the attacker’s IP, IDS systems are unable to attribute the port scan to the attacker. CEH emphasizes that this technique creates zero direct traffic between the attacker and the target, making it extremely evasive and ideal for highly monitored networks. FIN scans (Option A) are somewhat stealthy but still originate from the attacker and are detectable. TCP Connect scans (Option C) are the most detectable because they complete full connections. ICMP Echo scans (Option D) are easily logged and flagged by IDS. Idle scanning is uniquely suited for bypassing advanced detection systems while still identifying open ports and live hosts.

The correct answer is A because the description matches promiscuous mode. In normal operation, a network interface card processes frames addressed to its own MAC address, broadcast frames, or relevant multicast frames, while ignoring frames not intended for it. In promiscuous mode, the NIC passes all received frames up to the operating system or packet-capture tool for inspection. CEH sniffing concepts describe this as a key requirement for sniffers: the NIC is placed into promiscuous mode so it can listen to all data transmitted on its segment, even when the traffic is not addressed to that NIC. CEH-aligned material also states that a sniffer needs the card to run in promiscuous mode so the NIC grabs frames regardless of address. Port forwarding redirects traffic between ports or hosts, WEM is not the described network-interface behavior, and multicast mode only handles multicast traffic.

According to the Certified Ethical Hacker (CEH) Reconnaissance and Footprinting module, DNS cache snooping is a passive information-gathering technique used to determine whether a specific DNS record exists in a server’s cache. Attackers commonly use the dig +norecurse option to prevent the DNS server from querying other DNS servers, thereby revealing only cached results.

When a DNS server responds with NOERROR but does not return an answer, it indicates that the domain name itself is valid, but the requested record is not present in the DNS cache. CEH documentation explains that this situation usually occurs when no internal client has recently queried that domain, so the DNS server has no cached entry for it.

Option A is incorrect because a cached record would return a valid answer section.

Option B is incorrect because NOERROR explicitly means the DNS query was processed successfully.

Option D is incorrect because an expired or non-existent domain would typically return NXDOMAIN, not NOERROR.

CEH materials highlight that attackers use DNS cache snooping to infer user behavior, internal browsing habits, and potential target systems within an organization—making option C the correct conclusion.

The correct answer is C, Supply chain risk. A Java application commonly depends on third-party libraries, frameworks, packages, and modules. When those dependencies are outdated and have known CVEs, the application inherits the weakness even if the organization’s own custom code is secure. CEH web application security material describes this as using components with known vulnerabilities: third-party components may themselves be vulnerable, and if vulnerable components are used, the new application becomes vulnerable. CEH-aligned OWASP coverage also explains that libraries, frameworks, and software modules often run with high privileges, and exploitation of a vulnerable component can lead to serious impacts such as data loss, server takeover, or undermining application defenses. CSRF tricks authenticated users into submitting unwanted requests, XSS injects malicious scripts, and DoS targets availability. The key risk here is dependency exposure through the software supply chain.

WPA with TKIP suffers from vulnerabilities inherited from WEP, particularly the use of weak Initialization Vectors (IVs). CEH v13 explains that these weaknesses allow attackers to perform packet injection and partial decryption attacks.

Although WPA improved upon WEP, TKIP was designed as a temporary solution and still relies on predictable IV behavior. This makes Option C correct.

Lack of AES (Option A) explains why WPA is weaker than WPA2 but does not directly describe the exploit mechanism. Weak passwords (Option D) affect authentication, not packet injection. GTK predictability (Option B) is relevant but not the primary cause here.

CEH v13 explicitly states that IV reuse and predictability in TKIP enable practical attacks. Therefore, Option C is correct.

The correct answer is B. Distributed Reflection Denial-of-Service (DRDoS) because the scenario describes the two defining elements of DRDoS: reflection and amplification at scale using third-party systems. Maria “forges requests” (i.e., spoofs the victim’s IP address as the source) to “multiple open services across the internet.” Those services then send their replies to the spoofed source—the victim—so the victim receives a large volume of unsolicited responses. This is reflection: the attacker does not attack the victim directly; instead, the attacker reflects traffic off other servers. The “multiplying the amount of traffic” indicates amplification: many protocols/services respond with packets significantly larger than the request, so the attacker’s small outbound traffic results in a much larger inbound flood against the target.

The mention of “multiple open services” and being overwhelmed by a “flood of responses” is classic DRDoS behavior. From a defender’s perspective, DRDoS attacks are difficult because the traffic often appears to come from legitimate servers, and the victim is receiving replies to requests it never sent. Mitigations include source address validation (BCP 38 anti-spoofing), rate limiting, filtering/ACLs for abused UDP services, and upstream scrubbing/CDN or DDoS protection.

Why the other options are less accurate: Smurf is a specific reflection/amplification attack using ICMP to a broadcast address (now largely mitigated by disabling directed broadcasts). Botnet describes the attacker’s infrastructure (many compromised machines) but not the reflection/amplification mechanism; a botnet can be used to launch many types of DDoS attacks. NTP amplification is one specific DRDoS variant using misconfigured NTP servers (UDP/123). The question describes the broader technique across “multiple open services” rather than naming NTP specifically, so the best match is the general category DRDoS.

Therefore, Maria is demonstrating a Distributed Reflection Denial-of-Service (DRDoS) attack.

A logic bomb is malware or malicious code that is deliberately planted within a system and configured to execute when a specific condition is met, such as a particular date and time, a user action, or the presence or absence of a file. CEH materials describe logic bombs as condition-based triggers that can remain dormant for extended periods, producing minimal indicators until the trigger occurs. The most decisive clue in this scenario is the “scheduled task set to a specific date,” followed by abnormal behavior that appears only after that date passes. This is a textbook trigger mechanism used to activate malicious actions while avoiding early detection.

The “odd email from an unfamiliar source” suggests an initial delivery or social engineering vector, but the core behavior is the delayed activation. The later “faint increase in network activity only after the scheduled date passed” aligns with a logic bomb executing a payload such as beaconing, data exfiltration, or enabling remote access. The “unusual code traces on a dormant workstation” further supports the idea of implanted code that was inactive until triggered.

Fileless malware emphasizes execution in memory using legitimate tools such as PowerShell or WMI and is defined more by its living-off-the-land technique than by a date-based trigger. An APT describes a broader campaign style involving long-term, multi-stage intrusion, not a single defining trigger artifact. Ransomware is characterized by encryption and extortion behavior, which is not described. Therefore, the threat is best characterized as a logic bomb.

Outdated encryption protocols such as SSL 3.0 and TLS 1.0 contain numerous cryptographic weaknesses, making them susceptible to downgrade attacks, cipher-suite vulnerabilities, and interception. CEH explains that weak SSL/TLS configurations expose encrypted traffic to man-in-the-middle attacks because attackers can exploit vulnerabilities such as BEAST, POODLE, or weak ciphers to decrypt or manipulate data in transit. These flaws compromise confidentiality and integrity, allowing attackers to observe login credentials, session identifiers, or sensitive information. XSS and SQL injection exploit entirely different web vulnerabilities unrelated to encryption strength. Brute-forcing SSL handshakes is computationally infeasible and not relevant. Therefore, a MitM attack targeting the outdated protocol is the most effective exploitation method.

This scenario describes SNMP Enumeration, a technique covered under CEH v13 Reconnaissance and Enumeration. Simple Network Management Protocol (SNMP) operates over UDP port 161 and is widely used for monitoring and managing network devices. A common and critical weakness arises when organizations leave default or publicly known community strings such as public (read-only) or private (read-write) unchanged.

CEH v13 explains that when an SNMP agent is configured with default community strings, it allows unauthenticated or weakly authenticated queries, enabling attackers to retrieve extensive system information. This includes installed software, running processes, system descriptions, network interfaces, and routing tables. The ability to perform bulk data queries using SNMP GET and WALK commands makes enumeration highly effective and fast.

Option B correctly identifies the root cause: misconfigured SNMP agents permitting anonymous or default access. The other options are incorrect because SNMP does not rely on FTP, registry access, or trap logging for enumeration. Traps (Option D) are unsolicited notifications sent to managers and are not used for querying system details.

CEH v13 strongly recommends disabling SNMP when not required, changing default community strings, restricting SNMP access via ACLs, and using SNMPv3, which supports authentication and encryption. Therefore, Option B is the correct and CEH-aligned answer.

The best answer is BPDU Guard on edge ports. CEH network defense material explains that BPDU Guard is used on access or edge ports where end-user devices are expected, not switches. If a device connected to such a port begins sending Bridge Protocol Data Units, the switch treats that as an abnormal condition and can shut the port down or place it in an error-disabled state. This prevents unauthorized or misconfigured devices from participating in spanning-tree and influencing root bridge election or topology decisions. That matches the scenario, where a newly connected device introduced a more favorable bridge priority and triggered spanning-tree recalculations. Root Guard is also related to protecting spanning-tree hierarchy, but it is typically applied where you want to prevent a downstream switch from becoming root while still allowing BPDU participation under controlled conditions. CEH exam framing usually expects BPDU Guard when the threat originates from an end-host-facing access port in a conference room or office edge location. Because the goal is to stop unauthorized edge-connected devices from affecting spanning-tree at all, enabling BPDU Guard on edge ports is the most appropriate control.

This technique is known as Boolean-Based Blind SQL Injection, as defined in CEH v13 Web Application Hacking. When applications suppress database errors and return generic responses, attackers use conditional statements to infer database behavior.

By comparing responses to true (1=1) and false (1=2) conditions, the attacker deduces whether injected SQL is being executed successfully.

CEH v13 distinguishes this from:

Error-based SQLi (visible DB errors)

UNION-based SQLi (data extraction)

Time-based SQLi (response delays)

Boolean-based blind SQL injection relies solely on content differences, making option C correct.

The correct answer is D. Set Passwords for Apps to Restrict Others from Accessing Them.

The device already has an operating system passcode, but the weakness appears after the phone is unlocked. The financial application opens directly to sensitive dashboards without requiring any additional application-level authentication. The most direct mitigation is to require a separate password, PIN, biometric prompt, or reauthentication control for sensitive corporate applications.

CEH mobile/BYOD material explains that BYOD introduces security and control challenges because personally owned smartphones and tablets access organizational resources. Mobile Device Management solutions commonly enforce policies such as passcodes, remote locking, remote wipe, root/jailbreak detection, application deployment, monitoring, and policy enforcement .

Option A. Use Encryption Mechanism to Store Data is important for protecting data at rest, especially if the device is lost, but it does not stop access after the phone is already unlocked.

Option B. Set a Strong Passcode on the Device and Change It Relatively Often is already partially implemented because the OS requires a passcode. The issue is lack of app-level verification.

Option C. Maintain a Clear Separation between Business and Personal Data is useful for BYOD governance, but it does not directly prevent an unlocked device from opening sensitive dashboards.

Option D. Set Passwords for Apps to Restrict Others from Accessing Them is correct because it directly mitigates unauthorized access to corporate apps after device unlock.

Therefore, the best answer is D. Set Passwords for Apps to Restrict Others from Accessing Them.

In CEH v13 Reconnaissance and Enumeration, NetBIOS name suffixes are used to identify the role of systems within a Windows network. The < 1B > NetBIOS suffix is particularly significant because it uniquely identifies the Domain Master Browser, which in modern Windows environments corresponds to the Primary Domain Controller (PDC).

When an nbtscan is performed, multiple systems may respond with NetBIOS names, but only one system per domain will register the < 1B > suffix. This is because the PDC is responsible for maintaining the master browse list and coordinating authentication services across the domain.

Option C is correct because the < 1B > entry is explicitly defined in CEH documentation as belonging to the domain controller.

Option A is incorrect because the local system does not advertise < 1B > .

Option B is incorrect because DHCP servers use different identifiers and do not register < 1B > .

Option D is incorrect because NetBIOS must be enabled for < 1B > to appear at all.

CEH v13 highlights identifying < 1B > during enumeration as a high-value discovery, since domain controllers are prime targets during privilege escalation and lateral movement phases.

CEH teaches that unrestricted file upload vulnerabilities are among the most dangerous in web applications because they allow attackers to bypass extension checks and upload malicious executable files. When the server fails to validate MIME types, file extensions, or execution permissions, an attacker can upload a web shell disguised as a harmless file, such as “image.php.jpg,” which may pass superficial validation and still be executed by the server’s interpreter. Once executed, the shell provides the attacker with command execution capabilities, allowing full control over the system. CEH emphasizes that web shells can enable privilege escalation, database compromise, lateral movement, or full server takeover. Unlike SQL injection or XSS, file upload exploitation directly affects server-side execution, making it significantly more severe. Unrestricted upload flaws are commonly tested in CEH labs with tools like Burp Suite to alter content-type headers or bypass client-side filters. This is a high-impact vulnerability requiring strict validation and sandboxing controls.

The correct answer is D, Hardware, Software, and Sniffing. In CEH system hacking and password attack concepts, password retrieval during an authorized assessment can involve multiple categories, not just one method. Keylogging may be performed through hardware devices or software applications that capture user keystrokes, and CEH material specifically identifies keylogging as using hardware or software to capture what a user types. CEH material also describes keyloggers as either hardware or software and explains that they monitor keyboard activity and related user actions. Sniffing is another password retrieval method because packets captured on a LAN may expose sensitive information and credentials such as Telnet, FTP, SMTP, or rlogin passwords. Therefore, software-only is incomplete, hardware-only is too narrow, and hardware/software keyloggers exclude network sniffing. The broadest and most accurate answer is hardware, software, and sniffing.

The correct answer is C. Identify and evaluate current practices. In CEH-aligned security assessment concepts, a security audit/review is used to verify whether security policies and procedures are in place and being followed. If documented policies do not exist, the ethical hacker or auditor should not stop the audit or create policies during testing, because policy creation is a management/governance responsibility, not an assessor’s role. Instead, the assessor should identify the organization’s current practices, actual controls, informal procedures, and operational behavior, then evaluate them against accepted standards, baselines, legal requirements, and security best practices. CEH material also emphasizes that information security policies are a fundamental component of the security infrastructure and define requirements, rules, and controls for protecting organizational resources. The absence of policies should be documented as a finding, but the review can still continue by assessing what is currently being done in practice. Increasing testing does not address the governance gap. Thus, the best course is to identify and evaluate current practices.

The weakness described is a classic online password-guessing condition: the application permits unlimited authentication attempts without any throttling, lockout, or challenge mechanism. In CEH guidance, this exposure enables brute-force attacks and automated credential stuffing, where attackers rapidly test many passwords or reused credential pairs until successful. A practical and commonly recommended control at the web application layer is adding CAPTCHA challenges to the login workflow, especially after a small number of failed attempts or when anomalous behavior is detected. CAPTCHA increases the cost of automation by forcing human interaction, directly disrupting high-speed scripted guessing against the admin portal.

While implementing MFA is an excellent additional safeguard and is strongly encouraged for privileged access, the question asks for the best countermeasure to address the specific issue of unlimited rapid attempts. CAPTCHA is a direct mitigation for automated login abuse, and CEH commonly pairs it with rate limiting, progressive delays, and account lockout policies. Periodic password changes do not prevent an attacker from guessing a password today, and CEH materials note that forced rotation can even reduce security if it drives predictable password patterns. Strong password hashing such as bcrypt, scrypt, or Argon2 is critical for protecting stored passwords if a database is compromised, but it does not stop online guessing against the login form itself. Therefore, the most fitting countermeasure for the identified vulnerability is using CAPTCHA challenges on login and registration pages, ideally combined with throttling and lockout for stronger defense in depth

The behavior described is a textbook indicator of time-based blind SQL injection. In CEH methodology for web application hacking, blind SQL injection is used when the application does not return database errors, query results, or verbose messages to the attacker. Instead of extracting data directly through displayed output, the attacker infers true or false outcomes by observing indirect side effects.

Here, the crafted input appends a conditional test about the database name’s first character. When the condition is true, the page response becomes “significantly longer,” which implies the injected payload triggers a database delay function or a time-consuming operation. This deliberate time difference becomes the communication channel: a longer response indicates “true,” while a normal response indicates “false.” By repeating such tests character-by-character, an attacker can enumerate sensitive values like database names, table names, and sometimes credentials—despite the application showing no errors or returned data.

This differs from Boolean-based blind SQL injection, where the inference is made through visible page content changes (for example, one response page looks different or contains different text when the condition is true). It also differs from UNION-based SQL injection, which relies on combining queries to return data in the application’s response, and error-based SQL injection, which depends on database error messages leaking information. Because the only observable signal here is response time, CEH classifies it specifically as time-based blind SQL injection. Defensive controls include parameterized queries, input validation, least-privilege database accounts, and WAF rules to detect time-delay functions and abnormal query patterns.

The scenario describes a program that appears legitimate (a software update installer that “functions normally”) while secretly placing additional malicious components onto the system, which later execute to establish remote access. That is the defining behavior of a dropper. A dropper’s primary role is to deliver (drop) malware payloads onto a host—writing files to disk or unpacking embedded components—often while disguising itself as a benign application. The malicious components may then be executed immediately or staged for later activation to reduce suspicion and increase persistence.

This differs from a downloader, which typically contains minimal payload and focuses on contacting a remote server to fetch malware after initial execution. In this case, the description emphasizes that “additional malware components are silently placed on the system,” implying the payload is being installed/deposited locally by the initial program rather than primarily downloaded. An injector focuses on injecting code into another running process (process injection) to evade detection or run under another process context; it does not inherently describe the act of placing additional components as separate hidden files. A wrapper is a technique where a malicious program is bound or “wrapped” with a legitimate one so that both run; while wrappers can be used in trojanized installers, the question emphasizes the behind-the-scenes placement of additional components for later activation, which is the classic dropper behavior.

The key indicators are: (1) user executes an installer that appears normal, (2) hidden malware components are deposited without the user’s knowledge, and (3) those components later activate for remote access. That chain matches a dropper’s purpose: stealthy malware delivery and staging.

Therefore, the correct answer is D. Dropper.

Ping of Death is a classic Denial-of-Service technique in which an attacker sends oversized or malformed IP packets that exceed the maximum allowed size when reassembled. In IP networks, the maximum packet size is 65,535 bytes. Historically, attackers exploited fragmentation by sending a series of IP fragments that, when reassembled by the target, resulted in a packet larger than the permitted limit or produced an invalid buffer condition. Vulnerable systems could crash, reboot, or become unstable because the network stack mishandled the reassembly process or failed to properly validate packet length and structure.

The scenario matches this behavior precisely: Sofia transmits “oversized, malformed packets” and the server “crashes intermittently due to processing failures.” That symptom is more consistent with a malformed-packet handling flaw than with pure traffic volume. An ICMP flood and an ACK flood are volumetric or resource-exhaustion attacks that overwhelm bandwidth or connection-handling capacity, typically degrading performance rather than directly causing crashes from malformed packet parsing. A Smurf attack is an amplification-based ICMP attack using broadcast addresses to multiply traffic toward a victim; again, it is about volume, not crafted malformed packets that trigger parsing failures.

CEH guidance highlights that PoD-style attacks exploit improper packet validation and reassembly logic. Modern systems are generally patched, but poorly maintained devices, legacy OS stacks, and some embedded implementations can still exhibit instability when exposed to malformed fragmentation and reassembly edge cases.

Password cracking is a core component of the system hacking phase. CEH materials highlight that once password hashes are obtained, attackers often perform offline cracking to avoid detection and bypass account lockout policies. Tools like Hashcat make use of hardware acceleration—specifically, GPU or multi-core CPU computing—to significantly increase cracking throughput. Hardware acceleration allows the system to perform thousands to millions of hash calculations simultaneously, dramatically improving cracking efficiency compared to traditional CPU-bound methods. While dumping SAM contents is part of credential extraction, it is not the optimization described in the scenario. Dictionary rules influence cracking strategy but not raw speed. NetBIOS spoofing is unrelated to password cracking. The emphasis here is on maximizing computational power to accelerate the hash-cracking process, aligning directly with CEH’s explanation of hardware-accelerated offline cracking techniques.

The correct answer is B. Design Flaws.

The issue is caused by a weakness in the workflow logic of the application. The platform depends on a multi-step identity verification sequence, but the server does not properly enforce completion of each required stage. This is not simply a missing patch or configuration issue; it is a logic/design weakness in how the authentication workflow was built.

CEH-aligned vulnerability material classifies Design Flaws as flaws involving encryption, data validation, logic flaws, and similar systemic weaknesses . CEH web application material also explains that business logic flaws can exist in how an application is designed to function and may be exploited through transaction tampering or incomplete validation of workflow behavior .

Option A. Poor Patch Management is incorrect because the weakness is not described as an unpatched known vulnerability.

Option C. Application Flaws is related, but the more precise classification is a design or business logic flaw because the workflow itself fails to enforce required verification stages.

Option D. Misconfigurations / Weak Configurations is incorrect because the problem is not caused by insecure server settings or default configuration.

Option B. Design Flaws is correct because the root weakness is flawed authentication workflow logic.

Therefore, the best answer is B. Design Flaws.

CEH v13 identifies URL parameters used in dynamic SQL queries as common injection points. When user-controlled values are passed directly into database queries without validation, attackers can manipulate query logic. Injecting a test payload such as 1 OR 1=1 into the userID parameter is a standard method to determine whether the application concatenates input into SQL statements. If the page displays all user orders instead of only the authenticated user ' s orders, this confirms SQL injection. CEH teaches that conditional tautologies are one of the safest and most reliable ways to probe SQL vulnerabilities, especially in GET parameters. JavaScript injection (Option A) tests XSS, not SQLi. Directory traversal (Option C) targets filesystem issues, not database logic. Brute-forcing user credentials (Option D) does not test query sanitization. Therefore, modifying the userID parameter with a SQL injection payload is the correct CEH-aligned method.

CEH v13 classifies this malware as fileless malware, which resides in memory and abuses legitimate system tools (Living-off-the-Land techniques). Traditional antivirus solutions are often ineffective.

CEH v13 recommends:

Script control (PowerShell Constrained Language Mode)

Application whitelisting

Monitoring parent-child process relationships

These measures directly target the malware’s execution method. Reboots and folder cleanup do not address in-memory persistence.

The defense described—keeping user inputs separate from the SQL statement and binding them as fixed values before execution—is the defining characteristic of parameterized queries (prepared statements). This is one of the most effective and widely recommended countermeasures against SQL injection because it prevents attacker input from being interpreted as SQL code.

In a vulnerable application, developers often build SQL statements by concatenating strings, such as " SELECT ... WHERE user= ' " + input + " ' " . In that pattern, malicious payloads can alter the query structure (adding conditions, UNIONs, comments, or stacked queries). With prepared statements, the SQL engine receives the query structure first (the template), and then receives the parameter values separately. The database treats the parameters strictly as data, not executable SQL. As a result, even if an attacker submits quotes, keywords, or operators, those characters remain part of the parameter value and cannot change the query’s logic.

The scenario specifically says inputs are “bound as fixed values,” which is direct language associated with parameter binding. That makes option D the best answer.

Why the other options are less accurate:

User input validation (A) is helpful but can be bypassed and is not as robust as parameterization; also the described mechanism is not validation but binding separation.

Restrict database access (B) is a defense-in-depth measure (least privilege) that reduces impact, but it does not inherently stop injection from occurring.

Encoding the single quote (C) is a legacy/insufficient approach; encoding or escaping can be error-prone and DBMS-specific, and it does not match the description of parameters being bound separately.

Therefore, the application is using D. Use parameterized queries or prepared statements.

Bluesnarfing is a Bluetooth attack described in CEH v13 Wireless Network Hacking, where attackers exploit misconfigured Bluetooth devices to access sensitive data such as contacts, messages, and files—often without user interaction.

One of the most critical enablers of Bluesnarfing is Bluetooth discoverable mode. When devices are discoverable, attackers can easily identify them and attempt unauthorized connections or exploit vulnerabilities in Bluetooth services.

Disabling discoverable mode significantly reduces the attack surface by preventing unauthorized devices from locating Bluetooth-enabled systems. CEH v13 explicitly recommends setting Bluetooth devices to non-discoverable mode when not pairing.

While firmware updates (Option B) are important, they do not immediately prevent discoverability-based attacks. Stronger PINs (Option C) help against pairing attacks but do not stop unauthorized queries. Network-level encryption (Option D) is inherent in Bluetooth protocols and does not mitigate discovery abuse.

CEH v13 highlights that visibility control is the most immediate and effective defense against Bluesnarfing. Therefore, Option A is the correct answer.

The scenario describes a Layer 7 (application-layer) denial-of-service pattern: Javier sends a wave of repetitive web requests that specifically overload backend scripts responsible for search queries and form submissions. This is characteristic of an HTTP GET/POST attack, where the attacker floods a web application with large volumes of HTTP requests—commonly GET requests for pages/resources and POST requests that trigger server-side processing (login, checkout, searches, form handlers). Because these requests can be syntactically valid and target costly operations, they can quickly exhaust CPU, memory, threads, database connections, or application worker pools, resulting in slow responses and timeouts for legitimate users—exactly what the customers experience here.

Why the other options don’t fit as well:

Slowloris (A) is also an application-layer technique, but it works differently: it holds many connections open by sending partial HTTP headers very slowly, aiming to exhaust the server’s concurrent connection capacity. The question emphasizes repetitive requests overloading backend scripts, not slow, incomplete requests holding sockets open.

UDP Flood (B) is a network/transport-layer volumetric attack that sends massive UDP packets to random or targeted ports, consuming bandwidth and host resources. It doesn’t specifically target web scripts handling search/forms.

Peer-to-Peer Attack (C) typically involves abusing P2P networks or reflection/amplification through distributed peers; it’s not described as direct repetitive web requests to application endpoints.

The key indicators are: (1) web requests (2) targeting script-driven functions like search and form submissions, and (3) resulting in user-facing slowness/timeouts due to overwhelmed application processing. These align most directly with D. HTTP GET/POST Attack.

The strongest indicator in this scenario is that multiple compromised hosts are “behaving like zombies,” communicating outbound to a single unfamiliar external IP over high ports, and “silently accept remote instructions” while performing “coordinated background tasks.” In CEH-aligned malware terminology, these are hallmark characteristics of a botnet: a collection of infected endpoints (bots/zombies) under centralized or semi-centralized command-and-control. Worm-like propagation explains how the compromise rapidly expanded across the internal network—using shared folders and stolen credentials for lateral spread—while the “backdoor component” provides persistent remote control functionality once a system is infected. The observed coordination across many hosts strongly suggests the attacker’s goal is not merely individual surveillance of a single machine, but scalable remote control of many machines at once.

Option A, data exfiltration, is plausible in many intrusions, but the question emphasizes orchestration and remote tasking across many endpoints rather than targeted theft from specific repositories. Option B is inconsistent because there is no mention of encryption, ransom notes, or disruption-focused behavior. Option D, a RAT, typically describes remote control of a host, but the scenario’s defining feature is the creation of many “zombies” with coordinated behavior—this aligns more precisely with building a botnet for command and control, which can later be used for data theft, DDoS, spam, or further intrusion operations.

CEH defensive guidance includes monitoring egress traffic anomalies, detecting C2 patterns, segmenting networks to limit worm spread, disabling unnecessary shares, enforcing strong credential hygiene, and using EDR to identify backdoors and lateral movement behaviors.

According to the Certified Ethical Hacker (CEH) attack methodology, once reconnaissance, footprinting, and website mirroring have been completed, the attacker proceeds cautiously to exploitation while maintaining stealth. CEH documentation emphasizes that low-noise, application-layer attacks are preferable when the objective is to minimize detection.

Option B, attempting SQL Injection, aligns directly with CEH’s Web Application Hacking module. SQL Injection is a server-side attack that can often be executed through normal-looking HTTP requests, making it less likely to trigger intrusion detection systems (IDS) or security alerts. CEH materials highlight SQL injection as a common and effective technique for extracting sensitive data such as usernames, passwords, and business-critical information without disrupting server operations.

Option A is incorrect because immediately modifying server configuration files after session hijacking significantly increases the risk of detection. CEH guidelines stress post-exploitation restraint, especially during red team operations.

Option C is not ideal at this stage because automated vulnerability scanners generate substantial traffic and are highly detectable. CEH explicitly notes that vulnerability scanning is noisy and often logged.

Option D is the least stealthy option. Brute-force attacks generate numerous failed authentication attempts, triggering security alerts and account lockouts. CEH classifies brute-force attacks as high-risk and easily detectable.

Therefore, SQL Injection represents the most effective and stealthy next step in accordance with CEH’s structured attack lifecycle.

The capability described—administrators instantly provisioning servers, storage, and compute through a web portal without needing the provider to manually intervene—is the NIST cloud characteristic called on-demand self-service. In NIST’s cloud computing model, on-demand self-service means a consumer can unilaterally provision computing capabilities (such as server time and network storage) as needed automatically, without requiring human interaction with each service provider.

The scenario explicitly highlights that the admins can scale resources “instantly” through a dashboard and that there is “no manual involvement from the cloud provider.” That is exactly what on-demand self-service captures: rapid provisioning driven by the customer through automated orchestration and APIs/portals.

Why the other options are not the best match:

Broad network access (D) means cloud capabilities are available over the network and accessed through standard mechanisms by heterogeneous platforms (mobile, laptops, workstations). While the dashboard is accessed over the network, broad access is about reachability and standard access mechanisms, not the self-provisioning behavior.

Resource pooling (C) refers to the provider’s multi-tenant model where physical/virtual resources are pooled and dynamically assigned; it explains how the provider can offer elasticity, but the user-facing “provision it yourself” aspect is on-demand self-service.

Measured service (B) refers to metering and monitoring resource usage for billing/optimization; it doesn’t explain instant self-provisioning.

Therefore, the characteristic is A. On-demand self-service.