312-50v13 Certified Ethical Hacker Exam (CEHv13) Questions and Answers

The correct answer is D because PowerShell script block logs provide the most direct visibility into PowerShell-based attacker activity. In CEH-style security operations and incident response, defenders must review logs that are closest to the suspicious activity being investigated. PowerShell is widely used for Windows automation, administration, and post-compromise actions; the CEH-related material notes that PowerShell can automate tasks on Microsoft Windows systems and can be used after compromising a Windows target. Script block logging records the actual PowerShell code blocks executed, including suspicious commands, encoded commands, download cradles, privilege escalation scripts, and in-memory execution attempts. DNS logs may show domain lookups, and firewall logs may show network connections, but neither reveals the PowerShell commands themselves. Syslog is generic and more common in Unix/Linux or centralized logging contexts. Since the attacker is abusing PowerShell heavily, PowerShell script block logs give investigators the strongest evidence of command content, execution behavior, and malicious intent. Therefore, option D is the best answer.

String concatenation is the best match because the technique described is breaking a recognizable SQL keyword or payload into separate pieces so a signature-based WAF rule does not see the full malicious token in one continuous pattern. In CEH-aligned web application testing, many WAF detections rely on matching known strings such as UNION SELECT, OR 1=1, and other classic patterns. If an attacker can cause the database parser to interpret the same meaning while the input appears different at the inspection layer, the WAF may fail to match its rule and the payload can reach the backend.

The prompt explicitly says you “split the query into multiple parts” to avoid detection as “a single signature.” That is the core idea of concatenation-based evasion: represent the same instruction through separated fragments that are recombined or tolerated by the SQL parser, depending on the database and application behavior. This differs from in-line comments, which would typically insert comment markers inside keywords to break signatures while preserving parsing, and differs from hex encoding, which replaces characters or strings with hexadecimal representations. A null byte technique is usually associated with string-termination tricks in older contexts and does not align with splitting SQL keywords for WAF bypass.

Defensively, CEH guidance emphasizes that relying on WAF signatures alone is insufficient. Strong prevention requires parameterized queries, strict server-side input validation, least-privilege database accounts, and monitoring for anomalous query patterns and error behaviors even when obvious signatures are not present.

This describes a rule-based or logic-based password attack, which CEH v13 classifies as a smart, targeted guessing technique. Attackers use known patterns—such as naming conventions, dates, or personal interests—to reduce the keyspace and increase success rates.

Option A accurately reflects this methodology. Option B is brute force, which is random and exhaustive. Option C is physical observation. Option D describes hybrid attacks without structured logic.

CEH v13 emphasizes that pattern-based attacks are highly effective when attackers possess prior intelligence. Therefore, Option A is correct.

The correct answer is D, Rules of engagement. In CEH pre-engagement concepts, the rules of engagement document defines the authorized boundaries of a penetration test before any testing begins. It specifies what testing techniques are permitted, which systems or networks may be tested, when testing may occur, what actions are prohibited, whom to contact during emergencies, and how incidents such as service disruption should be handled. It also helps protect the penetration tester by documenting client approval and limiting liability when the tester acts within the agreed boundaries. A project scope may list targets, IP ranges, applications, or business units included in testing, but it does not fully cover operational permissions and liability terms by itself. A nondisclosure agreement protects confidential information discovered during the engagement. A service-level agreement defines service expectations such as uptime, response time, or support obligations. Therefore, the document that best matches allowed testing, timing, and tester liability limits is the Rules of engagement.

The correct answer is D. ntpq -p [host].

The scenario requires querying the active NTP service to review its current associations and operational state. The ntpq utility is designed to query and monitor the NTP daemon. CEH-aligned NTP enumeration material states that ntpq is a command-line utility used to query the NTP server, monitor ntpd operations, and determine performance. It also states that the -p option prints a list of peers known to the server and summarizes their state .

Option A. ntptrace is incorrect because ntptrace follows the chain of NTP servers back to the primary time source. The scenario specifically says Kevin is not tracing the upstream hierarchy.

Option B. ntpq [-inp] [-c command] [host] [...] is a general syntax form for ntpq, but the most precise command for viewing peer associations and state is ntpq -p [host].

Option C. ntpdc is incorrect because although ntpdc can query ntpd, it is more associated with querying daemon state and requesting state changes. The question asks for the command to review current associations and operational status, which is most directly matched by ntpq -p.

Option D. ntpq -p [host] is correct because it directly queries the NTP service and prints peer association/status information.

Therefore, the best answer is D. ntpq -p [host].

The correct answer is D, Split DNS. Split DNS, also called split-horizon DNS, uses separate DNS views or servers for internal and external name resolution. In this configuration, the DNS server in the DMZ provides public-facing records for external users, while the internal DNS server provides private records for internal hosts and services. This prevents sensitive internal hostnames, IP addresses, and infrastructure details from being exposed to the public. CEH networking topics describe DNS as the system that translates hostnames to IP addresses and vice versa, making DNS records valuable during footprinting and enumeration. CEH perimeter-security material also explains that a DMZ is a buffer area between the internal private network and the external public network, used for services that must be reachable externally. DNSSEC is used to protect DNS integrity cryptographically, DynDNS maps changing IP addresses to names, and “DNS Scheme” is not the standard term. Therefore, this configuration is Split DNS.

The capabilities described match an enterprise Wireless Intrusion Prevention System (WIPS) tightly integrated with WLAN infrastructure: it uses access points as sensors (placing selected APs into passive scan/monitor mode), correlates and aggregates alarms from multiple controllers into a central engine for analysis and forensic retention, and can push automated countermeasures across the campus (such as coordinated channel scanning and remote configuration enforcement) when a device is classified as malicious. This is most consistent with Cisco Adaptive Wireless IPS.

Cisco’s adaptive WIPS model uses the existing Cisco wireless architecture (controllers and APs) to provide campus-wide monitoring and enforcement. The phrase “selected APs into a passive scan mode” is a strong indicator of adaptive sensor use—APs can be dedicated or time-sliced for scanning, and the system can coordinate coverage across channels. The centralized engine concept also aligns with enterprise WIPS deployments that collect events and alarms from multiple controllers for correlation and long-term storage, supporting incident investigation and compliance.

Why the other options are less fitting:

Fern WiFi Cracker (C) is an attack/assessment tool, not a production defensive platform, and it does not provide centralized alarm aggregation and automated enterprise countermeasures.

RFProtect (B) is a known wireless security/WIPS solution family, but the question’s feature set and wording (“adaptive,” APs used for passive scanning, controller-integrated countermeasures) most closely matches Cisco’s adaptive WIPS concept.

WatchGuard Wi-Fi Cloud WIPS (A) is a vendor-managed WIPS offering; while it can provide monitoring, the scenario stresses multi-controller aggregation into a central engine and coordinated campus countermeasures via WLAN infrastructure—again aligning best with Cisco’s controller/AP ecosystem.

Therefore, the best answer is D. Cisco Adaptive Wireless IPS.

The technique described is decoy scanning. In CEH network scanning methodology, decoy scanning is used to make IDS and logging systems attribute scan traffic to multiple apparent sources instead of the attacker’s true IP address. The attacker configures the scanner to generate additional probe packets that appear to originate from several spoofed decoy IP addresses, mixed with the real attacker’s probes. This creates ambiguity for defenders because IDS alerts and firewall logs show many potential “scanners,” complicating attribution and response actions such as blocking a single source.

A key detail in the prompt is that Lily “includes multiple spoofed IP addresses alongside her own” and still “receives accurate results.” That matches how decoy scanning works in tools like Nmap: the attacker’s real IP must remain in the mix so that replies from the target return to the attacker, enabling accurate interpretation of port states. The decoys mainly exist to confuse monitoring and incident response teams by polluting the log trail.

Option C, IP spoofing, is too general and, by itself, typically prevents the attacker from receiving responses because return traffic goes to the spoofed address. Decoy scanning is a specific, structured use of spoofing combined with the real source to preserve results. Option A refers to stealth flag scans, which reduce handshake visibility but do not involve multiple spoofed sources. Option B, source routing, attempts to control packet paths and is not the described behavior. Therefore, the correct answer is Decoy Scanning.

CEH v13 identifies Slowloris as a low-bandwidth yet highly effective application-layer DoS technique that works by opening many HTTP connections and sending headers very slowly, never completing the request. Because the server must maintain these half-open HTTP sessions, its connection pool becomes saturated, preventing it from servicing legitimate users. Slowloris is particularly dangerous because it does not rely on malformed packets, high traffic volume, or protocol abuses; instead, it mimics legitimate HTTP behavior, making it difficult for firewalls or IDS systems to distinguish malicious traffic. This aligns exactly with the described scenario, where thousands of legitimate-looking HTTP connections are gradually consuming server resources. Fragmentation attacks (Option B) target packet reconstruction, UDP floods (Option C) generate high-bandwidth noise, and SYN floods (Option D) impact the TCP handshake layer, not the HTTP header behavior. Slowloris’ unique use of slow HTTP headers directly matches the symptoms described.

IoT devices often suffer from weak or missing encryption protocols, creating opportunities for attackers to intercept sensitive information. CEH courseware highlights that when device-to-app communication occurs in plaintext, a man-in-the-middle attack becomes one of the most effective exploitation methods. By positioning themselves between the device and the mobile application, the attacker can observe all transmitted data, including configuration updates, authentication tokens, and personal information. Tools such as Wireshark, mitmproxy, and specialized IoT interception frameworks allow testers to capture packets, decode protocols, and reconstruct application logic. The CEH curriculum stresses the importance of evaluating IoT device communication channels, because many rely on unsecured HTTP or proprietary plaintext protocols. Brute-force attempts, SQL injection, or dictionary attacks do not directly target the device–app communication pathway and would not exploit the fundamental weakness present here: lack of encryption. A MitM attack directly takes advantage of this flaw and provides comprehensive visibility into all transmitted data, making it the most effective and CEH-aligned method of exploitation.

The correct answer is B, Buffer overflow. In CEH vulnerability and exploitation concepts, a buffer overflow occurs when a program writes more data into a fixed-size memory buffer than it was designed to hold. The excess data can overwrite adjacent memory, corrupt control data, crash the application, or allow attacker-controlled code execution. CEH-related material describes buffer overflow as writing too much data into an application’s allocated buffer, potentially overwriting adjacent memory, executing code, or crashing the system. It also explains that buffer overflow attacks rely on lack of boundary testing and, in stack-based cases, may overwrite a return pointer so execution flow switches to malicious code. XSS injects malicious scripts into web pages, CSRF tricks an authenticated user into performing unwanted actions, and SQL injection manipulates database queries. These do not primarily exploit memory corruption. Therefore, the vulnerability associated with memory corruption is buffer overflow.

This question relates to Malware Analysis, specifically PDF-based malware, as covered in the CEH v13 Malware Threats module. The presence of /JavaScript and /OpenAction keywords identified by pdfid strongly indicates potentially malicious behavior triggered when the PDF is opened.

CEH v13 recommends static analysis of PDF stream objects as the next step to understand embedded malicious logic. Tools such as PDFStreamDumper allow analysts to extract, decompress, and inspect object streams within a PDF file, revealing obfuscated JavaScript code or exploit payloads.

The /OpenAction keyword indicates that the embedded JavaScript executes automatically when the document is opened, a common technique used in PDF-based attacks to exploit reader vulnerabilities or download secondary payloads.

Other options are insufficient:

VirusTotal provides detection results but not behavioral insight.

PE Explorer is irrelevant because PDFs are not Portable Executable files.

Hashing only helps identify known malware, not analyze behavior.

CEH v13 emphasizes manual inspection of embedded scripts to determine intent, making PDFStreamDumper the correct next step.

The correct answer is C. Container orchestration because the described features—automated deployment, scaling, service discovery, and workload management across multiple nodes—are the defining functions of a container orchestration platform, and Kubernetes is the most widely used orchestration system for containers. In CEH-aligned cloud and container security discussions, orchestration refers to the automated coordination of containerized workloads so that applications remain available, scalable, and manageable without administrators manually placing or maintaining each container instance.

In Kubernetes, orchestration is achieved through the control plane and a set of components that continuously maintain the desired state of applications. For example, scheduling places pods onto nodes based on resource availability and constraints; controllers ensure that the correct number of replicas are running; services and DNS enable stable naming and service discovery; and autoscaling mechanisms adjust capacity according to demand. These combined behaviors allow the platform to keep critical services operating “smoothly” even as nodes change, workloads shift, or failures occur.

Why the other options are not the best match: Self-healing is a specific benefit of orchestration (Kubernetes restarts failed containers, reschedules pods, and replaces unhealthy instances), but it does not fully encompass the broader set of capabilities listed, such as deployment automation, scaling, and service discovery. Kube-controller-manager is a particular Kubernetes control-plane component that runs controller processes; it contributes to orchestration internally, but the question asks for the overarching capability responsible for the set of functions, which is container orchestration as a whole. Container vulnerabilities is not a Kubernetes capability; it is a security risk category (e.g., vulnerable images, misconfigurations, runtime exploits).

Therefore, the capability primarily responsible for automated deployment, scaling, service discovery, and multi-node workload management in Kubernetes is container orchestration.

The correct answer is A. Sending special characters to detect SQL modification behavior.

The scenario describes a black-box SQL injection discovery technique. The tester does not see the application source code or database query, so she submits SQL-significant characters and observes how the application responds. CEH-aligned SQL injection material explains that SQL injection involves injecting malicious SQL into existing queries and that vulnerability detection can involve injecting code into input fields and observing application responses or errors .

The important clue is that the application shows irregular behavior even without detailed error messages. That indicates the input may be modifying the backend SQL statement.

Option B is incorrect because truncation testing checks whether long or unexpected values are cut off, not whether SQL logic is affected.

Option C is too specific to identifier or database syntax handling and does not best match the general SQL injection probe described.

Option D is related, but it is narrower than the actual technique. The broader and more accurate black-box technique is sending special SQL-significant characters and observing behavior.

Therefore, the best answer is A. Sending special characters to detect SQL modification behavior.

The correct answer is B. CRIME Attack.

The scenario describes a compression-based side-channel attack against encrypted HTTPS traffic. The attacker observes differences in compressed response sizes and uses those differences to infer protected authentication values, such as cookies or session tokens.

CRIME, or Compression Ratio Info-leak Made Easy, abuses TLS/SPDY-level compression behavior. When attacker-controlled input is compressed together with secret values, response-size differences can reveal information about the secret. The CEH cryptography/session-hijacking context discusses attacks against SSL/TLS and secure communications, including man-in-the-middle positioning and cryptographic weaknesses affecting encrypted channels .

Option A. Forbidden Attack is incorrect because it is not the recognized compression side-channel attack described.

Option C. Man-in-the-Browser (MITB) Attack is incorrect because MITB requires malware inside the browser to intercept or modify browser transactions.

Option D. Man-in-the-Middle (MITM) Attack describes the attacker’s position, but not the specific compression-based technique.

Option B. CRIME Attack is correct because the attack extracts secrets by analyzing compressed encrypted response sizes.

Therefore, the best answer is B. CRIME Attack.

This scenario describes a Slowloris attack, a classic application-layer DoS attack covered in CEH v13 Network and Perimeter Hacking. Slowloris works by opening many HTTP connections and sending data very slowly, preventing the server from closing the connections.

Because the connections appear legitimate, the server keeps them open, eventually exhausting its connection pool. This causes legitimate users to experience timeouts and service unavailability—exactly as described.

ICMP and UDP floods consume bandwidth, which was ruled out. Fragmentation attacks target packet handling, not application-layer sessions.

CEH v13 highlights Slowloris as particularly dangerous because it requires minimal bandwidth and bypasses many traditional DoS defenses. Therefore, Option A is correct.

A wrapper is the most accurate choice because it describes a technique where a legitimate program is bundled together with a malicious payload so that, when the user launches what appears to be a normal installer or application, both the real software and the malware run. CEH materials commonly explain wrappers in the context of Trojanization: the attacker “wraps” a trusted executable or installer with an additional hidden component. This preserves normal functionality to avoid suspicion while still achieving covert execution of the malicious code. In the scenario, the PDF converter installs and works as expected, but a hidden executable runs silently and begins outbound communication—this is classic wrapper behavior designed to maintain user trust and reduce detection through normal user experience.

The other options do not fit as well. A downloader is malware whose primary purpose is to fetch additional payloads from the network; while outbound communication occurs here, the scenario emphasizes bundling and simultaneous execution with a legitimate installer, not primarily downloading. A packer is used to compress/obfuscate an executable to evade signature-based detection; it changes how a binary looks, but it does not inherently describe combining a legitimate installer with another payload. A dropper is designed to deliver and install malware onto a system, often extracting the payload; however, the hallmark detail here is that the legitimate application runs normally while the malicious component is hidden within the same package, which aligns more precisely with a wrapper/Trojanized installer.

Defensively, CEH recommends controls such as application allowlisting, verifying digital signatures and hashes, using trusted software repositories, endpoint detection and response, and monitoring unusual outbound connections after software installation

The correct answer is B. Testing String because the scenario describes a classic SQL injection detection approach where the tester submits special characters and malformed input strings—most notably single quotes ( ' )—to observe how the application processes them and whether it produces database error feedback. In SQL injection discovery, inserting a single quote (or multiple quotes) into a parameter commonly breaks the intended SQL syntax if the input is concatenated into a query without proper validation/escaping or parameterization. When this happens, the backend database often returns error messages that may disclose critical information such as the DBMS type (e.g., MySQL, Microsoft SQL Server, Oracle), query fragments, and sometimes references to table/column names. That is exactly what you observed: “system feedback that unexpectedly reveals the database type and internal query structure.”

This method is specifically called “testing strings” in CEH-style SQL injection identification: using quote characters, delimiters, comment markers, and other metacharacters to see whether the application is vulnerable and whether errors or abnormal behavior occur. The goal is not to fully exploit the injection immediately, but to confirm whether input is being interpreted as part of an SQL statement and to collect clues that help the tester model the backend query and proceed with safe, authorized validation steps.

Why the other options are less accurate: Function testing is a broader web-testing concept and is not the specific SQLi detection tactic shown. Dynamic testing generally refers to testing an application while it is running to observe behavior, but it does not name this specific SQLi discovery technique. Fuzz testing involves sending large volumes of random or semi-random unexpected inputs to trigger crashes or errors; while multiple quotes could be part of fuzzing, the described method is the targeted, well-known SQLi testing string approach used to elicit informative SQL errors.

Therefore, the method being employed is Testing String.

CEH v13 highlights HTML smuggling as a modern technique used to bypass perimeter defenses by leveraging browser-side execution. Instead of downloading a malware file directly—which firewalls and IDS can detect—an attacker embeds obfuscated JavaScript or HTML within an attachment. When the victim opens the file, the browser reconstructs the payload locally using APIs like Blob or URL.createObjectURL. This method avoids external network transfers during the payload creation stage, allowing it to bypass content filters, sandboxing, and inline inspection tools. CEH emphasizes that HTML smuggling is especially dangerous because it operates within the browser environment, which security appliances implicitly trust. Port forwarding (Option B) relates to tunneling traffic, not file reconstruction. XSS (Option C) requires injecting scripts into web pages, not delivering malware. HTTP header spoofing (Option D) manipulates request metadata, not payload construction. Therefore, HTML smuggling precisely matches the described behavior.

The Certified Ethical Hacker (CEH) Incident Response lifecycle begins with Identification, followed by containment, eradication, recovery, and lessons learned. CEH documentation stresses that understanding the scope and nature of an incident is critical before taking disruptive action.

Option A is the correct initial response because it focuses on real-time monitoring and log analysis, which are essential during the identification phase. CEH materials emphasize analyzing logs, authentication failures, and traffic anomalies to confirm whether an incident has occurred and determine the attacker’s techniques, persistence level, and impact.

Option B, while valuable, is more appropriate after initial identification. Conducting deep outbound traffic audits without first understanding the attack vector can delay containment decisions.

Option C is premature. CEH warns that changing credentials too early may alert the attacker and cause them to escalate or destroy evidence.

Option D represents a containment strategy, not an initial response. CEH guidelines advise against immediately disconnecting systems unless there is confirmed active data exfiltration that cannot be otherwise controlled, as this may disrupt business operations and erase volatile forensic evidence.

Therefore, the CEH-approved approach is to monitor, analyze, and identify the incident before moving to containment and eradication.

The correct answer is D. This message shows classic social engineering and smishing indicators: it arrives by mobile text, claims urgency with a “vital transaction,” impersonates a trusted organization, and asks Bob to contact a free public email address. A legitimate bank or financial institution would normally use an official corporate domain, not a generic @yahoo.com mailbox. Option A is weak because not knowing Scott alone does not prove fraud; the stronger evidence is the suspicious sender identity and unofficial contact channel. Option B is incorrect because the message only claims to represent a respectable organization; attackers often impersonate trusted brands. Option C is unsafe because replying to the provided address validates Bob as a target and may continue the scam. CEH social engineering guidance emphasizes verifying requests through trusted, independent channels and recognizing phishing/smishing attempts that exploit urgency, authority, and user trust. Therefore, the best answer is D.

The correct answer is A. Service Version Discovery because the objective is to identify the software release/version running on internet-facing services by analyzing network responses and application output—without authenticating or establishing full sessions. In CEH-aligned reconnaissance methodology, service/version discovery (often called version detection or banner grabbing) focuses on determining what service is running (e.g., HTTP server, SSH daemon, SMTP server) and which version/build it is (e.g., Apache/Nginx version, OpenSSH version, application framework release). This information directly supports “prioritizing patch baselines” because patch urgency depends heavily on exact product versions: knowing the version helps map exposure to known vulnerabilities and identify outdated builds.

The prompt’s wording “analyze network-level responses and capture application output” is consistent with techniques such as banner grabbing, protocol negotiation, and response fingerprinting. Many services disclose identifying strings in headers, greetings, error pages, TLS certificates, or protocol handshakes. Even when banners are minimized, subtle differences in responses can still indicate versions or at least narrow the product family. This is typically done externally and does not require credentials, matching the constraint “without logging in or establishing full sessions.”

Why the other options are less accurate: Port scanning identifies which ports are open and which services may be present, but it does not necessarily determine precise software releases. OS discovery (OS fingerprinting) aims to infer the operating system and sometimes kernel family from packet characteristics; it is helpful but the task emphasizes “software release” and “application output,” which aligns more with service version detection than OS detection. Vulnerability scanning goes further by testing for known weaknesses and misconfigurations; while it may include version detection, the question asks for the technique that best fits the stated objective—determining the underlying service/software release from network/application responses—making service version discovery the most direct match.

Therefore, the technique is Service Version Discovery.

The correct answer is Information warfare. CEH introductory security coverage explains that information warfare involves coordinated use of information systems, influence operations, disruption, deception, and attacks on digital infrastructure to affect perception, decision-making, and institutional stability. The question includes manipulation of digital media, disruption of communications, and degradation of critical systems, all aimed at weakening a target without traditional military confrontation. That broad strategic combination goes beyond cyber espionage, which focuses on covert intelligence collection, and beyond hacktivism, which is typically ideologically motivated digital protest or disruption. Cyberterrorism can involve fear and critical infrastructure attacks, but the scenario is framed more comprehensively around coordinated influence and infrastructure effects as part of a broader conflict model. CEH materials use information warfare to describe conflict conducted through control, corruption, disruption, or weaponization of information and information systems. Because the activities target both perception and operational capability at a national scale, the most accurate classification is Information Warfare.

The correct answer is Search Engine Phishing. CEH social engineering material explains that search engine phishing involves creating fraudulent websites and manipulating search visibility so that victims discover and visit the malicious site through search results rather than through a direct email or message lure. In this scenario, patients searching for the clinic’s appointment system are led to a fake portal that closely resembles the official one and is positioned prominently in search engine results. That is the defining pattern of search engine phishing. Pharming would involve silently redirecting users to a fraudulent site through DNS or host-resolution manipulation, but the question specifically states that internal DNS servers were not altered and that users voluntarily navigated there through search results. Spear phishing would require targeted communications sent directly to victims, and whaling is aimed at high-profile executives. CEH guidance emphasizes that search engine phishing can be especially effective because users believe they are independently finding the legitimate service. Since the attacker relied on a cloned portal and manipulated search visibility rather than direct messaging or DNS tampering, Search Engine Phishing is the best answer.

CEH v13 defines passive reconnaissance as information gathering without directly interacting with the target’s systems. Activities such as reviewing archived websites, social media, forums, and public records are all passive and legal.

Running an intensive port scan, however, is an active reconnaissance technique. According to CEH v13, port scanning directly interacts with target systems and can trigger IDS/IPS alerts, logs, and even legal consequences if done without authorization.

Therefore, option B violates the principles of passive reconnaissance and is the riskiest choice.

Google Hacking, also known as Google Dorking, is a passive reconnaissance technique covered in CEH v13 Reconnaissance Techniques. It involves using advanced search operators to uncover sensitive information that has been inadvertently indexed by search engines.

CEH v13 explains that Google Hacking can reveal exposed files, directories, configuration files, backups, login portals, error messages, and sensitive documents. This information often resides on the Deep Web, meaning it is not easily accessible through normal browsing but is still indexed by search engines.

Option D correctly reflects this capability. Google Hacking does not analyze source code directly (Option A), map internal networks (Option C), or primarily detect phishing sites (Option B), although it may indirectly assist with those tasks.

Because Google Hacking relies solely on publicly available data and does not interact directly with target systems, it fits perfectly within passive footprinting, making it legally and ethically appropriate when authorized.

CEH v13 emphasizes Google Hacking as a powerful method to identify unintended data exposure. Therefore, Option D is the correct justification.

Cloud-based DDoS mitigation services provide upstream traffic scrubbing, detecting and filtering high-volume attacks such as DNS amplification and HTTP floods before the traffic reaches the victim’s network. These services use distributed infrastructures capable of handling multi-vector attacks that surpass the capacity of traditional on-premises firewalls and IDS. Traffic scrubbing centers distinguish legitimate traffic from malicious traffic, allowing normal operations to continue without service disruption.

According to the Certified Ethical Hacker (CEH) IoT, OT, and SCADA Security module, side-channel attacks exploit indirect information leaks such as power consumption, electromagnetic emissions, timing variations, or thermal output rather than software vulnerabilities.

Option A is correct because monitoring hardware-level anomalies is the primary method for detecting side-channel exploitation. CEH materials emphasize that these attacks bypass traditional security controls.

Option B relates to cryptographic weaknesses, not side-channel analysis.

Option C addresses interface misuse, not covert data leakage.

CEH highlights that SCADA systems are especially vulnerable due to legacy hardware and limited monitoring capabilities.

The method described—sending TCP packets with no flags set—is a NULL scan. In TCP header terminology, a NULL packet has all control flags cleared (no SYN, ACK, FIN, RST, PSH, URG). The scanner then interprets the target’s response behavior to infer port state. Traditionally, for many TCP/IP stacks, a closed port responds with RST, while an open port may respond with no reply (silence) because the packet does not correspond to any valid state in the TCP state machine. This behavior can vary by OS and filtering devices, but the defining characteristic is the “no flags” probe.

The scenario also highlights stealth: compared to a TCP connect scan, which completes a full three-way handshake and is easily logged, NULL scans can be less conspicuous because they avoid a normal connection setup. Some intrusion detection systems focus heavily on repeated SYN handshakes or completed connections; unusual flag scans may slip through weak detection, though modern IDS/IPS can still detect them.

Why the other options are incorrect:

TCP Connect Scan (A) uses the operating system’s connect() call to establish a full TCP connection; it is not a “no flags” technique and is generally noisier.

FIN Scan (B) sends packets with the FIN flag set; it is a different “stealth” scan type, but not “no flags.”

ACK Scan (D) sends packets with the ACK flag set and is typically used to map firewall rules (filtered vs unfiltered), not to determine open vs closed ports in the same way, and again it is not “no flags.”

Therefore, the scanning method is C. NULL Scan.

The correct answer is D. Ciphertext-Only Attack.

A ciphertext-only attack occurs when the attacker has access only to encrypted data and does not have the corresponding plaintext or the ability to choose plaintext/ciphertext pairs. That exactly matches the scenario: the attacker has encrypted database backups but no keys and no known plaintext records.

CEH-aligned cryptography material defines a ciphertext-only attack as a cryptographic attack where the cryptanalyst has access to ciphertext but does not have access to the corresponding plaintext. The attacker attempts to recover plaintext or infer the key from encrypted output alone .

Option A. Chosen-Ciphertext Attack is incorrect because the attacker would need to choose ciphertexts and observe their decrypted plaintexts.

Option B. Known-Plaintext Attack is incorrect because the attacker would need both plaintext and corresponding ciphertext.

Option C. Chosen-Plaintext Attack is incorrect because the attacker would need the ability to choose plaintexts and obtain their ciphertexts.

Option D. Ciphertext-Only Attack is correct because the attacker only possesses encrypted data.

Therefore, the best answer is D. Ciphertext-Only Attack.

The best answer is BPDU Guard on edge ports. CEH network defense material explains that BPDU Guard is used on access or edge ports where end-user devices are expected, not switches. If a device connected to such a port begins sending Bridge Protocol Data Units, the switch treats that as an abnormal condition and can shut the port down or place it in an error-disabled state. This prevents unauthorized or misconfigured devices from participating in spanning-tree and influencing root bridge election or topology decisions. That matches the scenario, where a newly connected device introduced a more favorable bridge priority and triggered spanning-tree recalculations. Root Guard is also related to protecting spanning-tree hierarchy, but it is typically applied where you want to prevent a downstream switch from becoming root while still allowing BPDU participation under controlled conditions. CEH exam framing usually expects BPDU Guard when the threat originates from an end-host-facing access port in a conference room or office edge location. Because the goal is to stop unauthorized edge-connected devices from affecting spanning-tree at all, enabling BPDU Guard on edge ports is the most appropriate control.

CEH v13 states that vulnerabilities with a CVSS score ≥ 9.0 are critical and require immediate containment. When remote code execution is possible, the system may already be compromised.

The recommended response is to isolate the affected system, preventing lateral movement, then perform a forensic audit before applying patches. Immediate patching without isolation may alert attackers or destroy evidence.

Thus, option D aligns with CEH incident response best practices.

The correct answer is B. In CEH ethical hacking and penetration-testing guidance, testers must operate strictly within the authorized scope, agreement, and reporting procedures. When sensitive data such as credit card numbers and PII is unexpectedly discovered, the tester should not copy, move, examine further, or continue testing as though it were a normal finding. CEH-aligned guidance specifically warns that when illegal or highly sensitive material is encountered, it should not be copied to the tester’s own device, and the tester must follow team guidance and remain within the engagement agreement. Continuing the test could increase exposure, disturb evidence, or violate PCI-DSS and privacy handling requirements. Making a local copy is especially wrong because it creates another unauthorized location for regulated data. Contacting the employee directly is also improper because escalation should go through the approved client point of contact or management. Therefore, the best course of action is to stop the test immediately and contact management.

The described activity is most consistent with a Remote Access Trojan (RAT). A RAT is designed to provide an attacker with remote, covert, and persistent control over a compromised system. The scenario explicitly states that after the attachment is opened, the attacker gains “full access to the workstation” and then monitors emails, keystrokes, and local files over an extended period without alerting the user. That combination—remote control plus long-term stealthy monitoring—fits a RAT’s typical capabilities, which often include keylogging, file browsing/exfiltration, screen capture, command execution, and maintaining persistence.

Although spyware can also monitor keystrokes and user activity, spyware is typically described as focusing on surveillance and data collection rather than providing broad interactive remote administration. The scenario emphasizes “full access” and ongoing control, which is more characteristic of a RAT than spyware alone. In many real-world cases, RATs include spyware-like features; however, when the question asks which malware type best matches full remote control and stealth monitoring, RAT is the strongest match.

Why the other options are less suitable:

Botnet (B) refers to a network of infected systems (bots) controlled as a group, often for DDoS, spam, or distributed operations. The scenario focuses on a single workstation being remotely controlled and monitored.

Adware (C) focuses on delivering advertisements and tracking for marketing purposes; it does not align with covert full access and credential monitoring.

Spyware (D) overlaps on surveillance, but it does not inherently imply comprehensive remote administration and control the way a RAT does.

Therefore, the most likely malware type is A. Remote Access Trojan (RAT).

According to the CEH Sniffing and Network Protocol Attacks module, covert channels represent one of the most sophisticated and difficult-to-detect data interception techniques. These channels hide malicious communication within legitimate protocol behavior, making them extremely challenging for traditional IDS/IPS and packet inspection tools to identify.

Industrial and legacy protocols such as Modbus, widely used in OT and legacy enterprise environments, lack encryption and authentication by design. CEH documentation highlights that attackers can manipulate unused or poorly validated Modbus fields to covertly transmit or intercept data while appearing as normal control traffic.

Option D is correct because covert channels over trusted legacy protocols blend seamlessly with legitimate traffic and bypass many security controls.

Option A is not a sniffing technique but a data-hiding method.

Option B describes exploitation, not sniffing.

Option C is a theoretical evasion method but is more detectable through reassembly.

CEH emphasizes covert channels as one of the most formidable sniffing challenges.

This scenario describes Linear Cryptanalysis, a technique detailed in CEH v13 Cryptography. Linear cryptanalysis involves finding linear approximations that relate plaintext bits, ciphertext bits, and key bits using XOR operations. By analyzing a large number of known plaintext–ciphertext pairs, attackers can identify statistical biases that reveal information about the secret key.

CEH v13 explains that linear cryptanalysis differs from differential cryptanalysis in its approach. While differential cryptanalysis studies how differences in plaintext affect differences in ciphertext, linear cryptanalysis focuses on linear relationships and probability distributions.

The mention of XOR combinations and statistical analysis of plaintext–ciphertext pairs directly aligns with linear cryptanalysis. Brute-force attacks attempt all keys without analysis. Differential cryptanalysis focuses on input differences, not linear equations. Side-channel attacks exploit physical characteristics such as power consumption or timing.

Modern block ciphers like AES are designed to resist linear cryptanalysis by ensuring that linear approximations occur with probabilities close to random. CEH v13 highlights linear cryptanalysis as a foundational attack method used to evaluate cipher strength.

Therefore, Option C is correct.

The correct answer is D. Spearphone Attack.

A Spearphone Attack uses motion sensor data, such as accelerometer readings, to infer or reconstruct speech played through a smartphone’s loudspeaker. The attack is notable because it does not require direct microphone access. Instead, it abuses sensor readings produced by speaker vibrations and acoustic coupling inside the device.

The scenario states that no microphone or camera permission change occurred, but an installed application continuously read motion sensor output while the loudspeaker was active. The collected measurements were then used to reconstruct acoustic characteristics. These details precisely match Spearphone.

CEH-aligned mobile security material highlights that mobile devices can be attacked through malware, insecure applications, and application/OS abuse, and that mobile malware is commonly used to steal personal or sensitive data from devices .

Option A. Camfecting is incorrect because camfecting involves unauthorized camera activation or camera spying.

Option B. StormBreaker Abuse is incorrect because StormBreaker is associated with phishing/social-engineering frameworks that may capture device data, but the scenario specifically involves motion-sensor acoustic reconstruction.

Option C. Android Camera Hijack Attack is incorrect because no camera misuse is described.

Option D. Spearphone Attack is correct because the attack reconstructs speech from motion sensor readings while the loudspeaker is active.

Therefore, the best answer is D. Spearphone Attack.

The scenario describes a Layer 7 (application-layer) denial-of-service pattern: Javier sends a wave of repetitive web requests that specifically overload backend scripts responsible for search queries and form submissions. This is characteristic of an HTTP GET/POST attack, where the attacker floods a web application with large volumes of HTTP requests—commonly GET requests for pages/resources and POST requests that trigger server-side processing (login, checkout, searches, form handlers). Because these requests can be syntactically valid and target costly operations, they can quickly exhaust CPU, memory, threads, database connections, or application worker pools, resulting in slow responses and timeouts for legitimate users—exactly what the customers experience here.

Why the other options don’t fit as well:

Slowloris (A) is also an application-layer technique, but it works differently: it holds many connections open by sending partial HTTP headers very slowly, aiming to exhaust the server’s concurrent connection capacity. The question emphasizes repetitive requests overloading backend scripts, not slow, incomplete requests holding sockets open.

UDP Flood (B) is a network/transport-layer volumetric attack that sends massive UDP packets to random or targeted ports, consuming bandwidth and host resources. It doesn’t specifically target web scripts handling search/forms.

Peer-to-Peer Attack (C) typically involves abusing P2P networks or reflection/amplification through distributed peers; it’s not described as direct repetitive web requests to application endpoints.

The key indicators are: (1) web requests (2) targeting script-driven functions like search and form submissions, and (3) resulting in user-facing slowness/timeouts due to overwhelmed application processing. These align most directly with D. HTTP GET/POST Attack.

The correct answer is D, Least privilege. In Linux, sudo temporarily grants elevated/root-level privileges to execute administrative commands. The CEH-aligned principle of least privilege requires that users, services, and processes receive only the minimum permissions needed to perform their authorized tasks. Allowing passwordless sudo for multiple commands weakens this control because a normal user can execute privileged actions without reauthentication, increasing the risk of accidental misuse, insider abuse, credential compromise, or privilege escalation. CEH materials emphasize least privilege as an authorization control and also note that sudo provides temporary root privileges. Zero trust is broader and focuses on continuous verification, defense in depth uses layered controls, and CIA refers to confidentiality, integrity, and availability. The specific misconfiguration here is excessive privilege assignment, so the violated security principle is least privilege. A secure configuration should tightly scope sudo permissions to only required commands and users, require authentication where appropriate, and log privileged actions.

CEH materials explain that modern web applications deploy multiple layers of security—HTTPS, secure cookies, HttpOnly flags, and strict session regeneration—to defend against standard hijacking methods such as token theft through XSS or fixation. When these protections are properly implemented, attackers must compromise the underlying trust relationship between the client and server to successfully intercept or manipulate session tokens. One of the most advanced techniques described in CEH is compromising a trusted certificate authority or injecting a forged certificate into the victim’s trust store. This enables the attacker to perform a transparent MITM attack despite HTTPS protections. Because the victim’s browser trusts the forged certificate, encrypted traffic—including session tokens—is exposed to the attacker without generating browser warnings or IDS alerts. Timing side-channel attacks are not considered session hijacking methods; XSS is mitigated by secure flags; and session fixation is ineffective when session regeneration occurs. Therefore, compromising a trusted certificate authority to enable an undetectable MITM attack is the most viable method.

The correct answer is A. Honey trap. In CEH social engineering concepts, a honey trap is a technique in which an attacker creates a fake attractive identity, often on social media or dating platforms, to build emotional trust with a target. The attacker then uses that trust to extract sensitive personal, corporate, or security-related information.

In this scenario, Steve created a fake social media profile and used an appealing profile picture and description to attract Stella. Once Stella accepted the request and began communicating with him, Steve gradually asked questions about her company and collected important organizational information. This matches the honey trap method because the attacker used attraction, trust, and manipulation to obtain confidential information.

Option B, diversion theft, involves redirecting deliveries or information to the wrong location. Option C, piggybacking, means gaining physical access by following an authorized person. Option D, baiting, uses an enticing object or offer, such as infected USB media, to lure victims. Therefore, the best answer is Honey trap.

The activity described is passive session hijacking because Sarah is only observing and capturing session-related information without altering, injecting, or disrupting the live client server communication. In CEH coverage of session hijacking, the key distinction is whether the attacker merely eavesdrops to obtain session identifiers or actively takes control of the session in real time. Passive hijacking focuses on sniffing traffic to collect authentication material such as session IDs, cookies, bearer tokens, or other credentials transmitted in cleartext or exposed through weak transport protections. The prompt explicitly says she “quietly collects session data” and does so “without interfering,” which is the hallmark of passive hijacking.

This is commonly feasible when applications use unencrypted HTTP, weak TLS configurations, or when tokens are exposed in ways that can be captured on the network. Once obtained, the attacker can replay or reuse the stolen token to impersonate the victim, which matches Sarah’s plan to later use the captured tokens to demonstrate risk in a controlled environment. CEH emphasizes that session tokens effectively become the user’s identity after authentication; if an attacker can steal them, they can often bypass login entirely.

Option B, active session hijacking, would involve manipulating the connection, injecting packets, desynchronizing the client, or taking over the session live. Option A, session fixation, involves forcing a victim to use a session ID chosen by the attacker, not sniffing. Option C, man-in-the-browser, requires malware within the browser to intercept or modify transactions, which is not described. Therefore, Passive Session Hijacking is correct.

When partial root access exists, preventing further privilege abuse is the immediate priority. CEH v13 explains that Mobile Application Management (MAM) enforces granular access control, application isolation, and permission enforcement—even on compromised devices.

Secure coding (Option A) and testing (Option C) are preventative measures but do not contain an active compromise. Certificate pinning (Option B) protects communications, not application control.

MAM solutions allow administrators to revoke access, enforce policies, and isolate apps, limiting attacker capabilities post-compromise. Therefore, Option D is correct.

Time-based blind SQL injection is used when applications suppress error messages and do not display query results. According to CEH v13, attackers rely on response time delays to infer whether injected SQL statements are executed.

The BENCHMARK() function forces the database to perform a CPU-intensive operation repeatedly, causing a noticeable delay if the injected condition is executed successfully. Option D explicitly introduces such a delay and is a textbook time-based blind SQL injection payload.

Options A, B, and C are used for union-based or boolean-based SQL injection and rely on visible output or content changes, which are ineffective in blind scenarios.

CEH v13 clearly states that time-delay functions such as SLEEP(), WAITFOR DELAY, and BENCHMARK() are the primary indicators for time-based blind SQL injection testing. Hence, Option D is correct.

In CEH’s web application and mobile security modules, improper session management is defined as a failure to enforce session expiration, token invalidation, or secure session lifecycle controls. When an application does not invalidate a session token after logout, attackers can exploit this by performing a replay attack: reusing previously captured session identifiers to impersonate the user and gain unauthorized access. CEH teaches that replaying a live token is the simplest and most direct exploitation method because it does not require guessing or stealing new tokens—the attacker simply reuses a valid one that should have been invalidated. CSRF relies on exploiting a user’s active session and is not required when the attacker already possesses a reusable token. Brute-forcing session tokens is computationally expensive and unnecessary. SQL injection is unrelated to session lifecycle flaws unless token storage is directly exposed. Therefore, a replay attack is the correct exploitation method.

The correct answer is IMDS Attack. CEH cloud security material explains that cloud instances often obtain temporary credentials from an Instance Metadata Service, commonly called IMDS, which supplies identity and role-based access details to workloads running on the virtual machine. If an attacker gains code execution on the instance, even through a separate web application flaw, the attacker may query the metadata endpoint locally and retrieve temporary credentials associated with the instance role. That is precisely what happens in this scenario: the tester runs a script on the VM, extracts temporary role credentials, and then uses them to enumerate storage and other services within the same cloud account. Wrapping attacks target SOAP message manipulation, while cloud snooper and CP DoS do not match the behavior of harvesting role credentials from local cloud metadata. CEH emphasizes that overprivileged instance roles and exposed metadata access can allow attackers to pivot from a single compromised workload into broader cloud service access. Because the key step is retrieving temporary credentials from the instance metadata service, the best match is IMDS Attack.

The behavior described most closely matches an Eclipse attack. In an eclipse attack, an adversary isolates a victim node by controlling its peer connections so that the node communicates only with attacker-controlled (or attacker-influenced) peers. Once isolated, the attacker can feed the victim a manipulated view of the blockchain—such as withholding blocks, delaying transactions, or presenting an alternative chain history. This can enable downstream impacts like double-spending against merchants who rely on that node’s view for confirmation.

The scenario’s strongest indicators are:

The node “received blocks only from a small, fixed set of peers for several hours,” suggesting abnormal peer diversity and potential isolation.

The attacker “controlled which peers that node communicated with,” which is essentially the definition of eclipsing a node.

The node “accepted a conflicting history” and the attacker supplied “a private chain until they were ready to reveal it,” consistent with feeding the victim a tailored chain view and then releasing/realigning it to profit from reversed payments.

Why the other options are less fitting:

A Finney attack (A) involves a miner pre-mining a block containing a spend, making a payment to a merchant, and then releasing the pre-mined block to invalidate the merchant’s transaction—this doesn’t require isolating a specific node’s peers for hours.

A DeFi sandwich attack (B) is a mempool/MEV tactic on decentralized exchanges involving front-running and back-running, unrelated to isolating node peer connections or feeding a private chain.

A 51% attack (C) involves controlling a majority of network hash power/stake to rewrite history at network scale. The scenario emphasizes isolation of a particular merchant-related node via peer control rather than majority network control.

Therefore, the attack is best identified as D. Eclipse Attack.

CEH v13 emphasizes that well-secured applications use HTTPS, secure cookies, and session regeneration to defend against common session hijacking techniques. In such hardened environments, traditional attacks like session fixation or simple XSS-based token theft often fail because session IDs change at login and secure flags prevent exposure. The remaining viable approach is session token prediction, an advanced attack that analyzes statistical patterns, entropy weaknesses, or timing issues in session ID generation algorithms. CEH discusses that weak pseudorandom number generators (PRNGs) or predictable sequences can allow attackers to compute a valid session ID without intercepting traffic. This method bypasses cookie security and does not rely on manipulating user input, making it suitable for environments with strong defenses. MITM attacks (Option A) require certificate compromise, which is impractical. Session fixation (Option B) fails because the application regenerates tokens. XSS (Option D) is ineffective when secure flags prevent JavaScript access to cookies. Thus, token prediction is the correct answer.

The correct answer is C. Impersonation.

The scenario’s central action is that the assessor pretends to be a third-party IT technician to gain trust and physical access. CEH-aligned social engineering material defines impersonation as a technique where the social engineer pretends to be someone or something he or she is not, such as an employee, valid user, repairman, executive, help desk person, or IT security expert. This can result in physical access to restricted areas and disclosure of sensitive information, including credentials .

Option A. Shoulder Surfing is incorrect because shoulder surfing specifically involves looking over a user’s shoulder to observe credentials or sensitive activity. Although the assessor observes the environment, the primary technique used to gain access is impersonation.

Option B. Eavesdropping is incorrect because eavesdropping involves covertly listening to conversations or communications.

Option D. Dumpster Diving is incorrect because dumpster diving involves searching through trash or discarded materials for useful information. Sticky notes and printouts are mentioned, but the defining technique is the assumed identity of an IT technician.

Therefore, the best answer is C. Impersonation.

The correct answer is A. Enumerating IAM Roles.

The scenario describes a tester who is examining identity entities, attached policies, permission boundaries, and levels of access across cloud resources. These are all functions of Identity and Access Management (IAM). In the CEH cloud security context, cloud security management includes Governance, Risk Management, and Compliance (GRC), Identity and Access Management (IAM), and Patch and Configuration Management, which are used to control secure access to cloud resources .

Enumerating IAM roles is the best match because IAM roles define what identities can do, which policies are attached, and what privileges can be assumed or exercised. A cloud assessment reference also lists IAM checks such as identifying IAM users and roles using aws iam list-users and aws iam list-roles, and reviewing permissions using aws iam get-policy .

Option B. Enumerating S3 Buckets is incorrect because S3 enumeration focuses on storage buckets, permissions on buckets, public exposure, encryption, and logging. It does not primarily identify identity-policy relationships.

Option C. Enumerating EC2 Instances is incorrect because EC2 enumeration focuses on virtual machines, instance metadata, AMIs, regions, security groups, and running compute resources. It does not directly map to querying identity entities and attached policies.

Option D. Enumerating Serverless Resources is incorrect because serverless enumeration focuses on functions, triggers, event sources, and execution configurations. Although serverless functions may use roles, the question’s main focus is identity entities and their permissions, which makes IAM role enumeration the most precise answer.

Therefore, the best answer is A. Enumerating IAM Roles.

The described technique is HTTP tunneling because Ethan is encapsulating his traffic inside standard web requests on port 80 to blend with normal browsing activity and bypass perimeter defenses that only perform basic port/protocol filtering. HTTP tunneling leverages the fact that many organizations allow outbound (and sometimes inbound) HTTP/HTTPS traffic through firewalls for business needs. If a firewall is not doing deep inspection (such as application-layer proxying, WAF inspection, or strict egress controls), encapsulated traffic can traverse allowed ports while carrying non-HTTP payloads inside the HTTP structure.

The scenario’s core clues are: (1) “encapsulates his traffic inside standard web requests,” (2) uses port 80, and (3) success depends on the firewall “not performing deep application inspection.” These are exactly the conditions where HTTP tunneling is effective: the traffic appears as ordinary HTTP sessions, so the firewall treats it as permitted web traffic even though the content is being used as a carrier for another protocol or command channel.

Why the other options don’t fit:

DNS tunneling (D) also encapsulates traffic, but it uses DNS queries/responses (typically UDP/TCP 53), not HTTP requests on port 80.

Tiny fragments (C) is an evasion method that breaks packets into very small fragments to confuse filtering/IDS reassembly; the scenario is about encapsulation in web requests, not fragmentation.

Source routing (B) attempts to influence packet path using IP options; it is not described here and is commonly blocked/ignored in modern networks.

Therefore, the firewall evasion technique is A. HTTP Tunneling.

According to CEH v13 Web Application and Server Security, regular patching and updates are the most effective way to reduce server attack surfaces. Vulnerabilities in web servers, proxies, and supporting services are frequently exploited if patches are delayed.

While architectural choices and directory placement influence organization, they do not mitigate known vulnerabilities. Changing IP addresses does not prevent exploitation, and moving directories does not address underlying software flaws.

CEH v13 consistently emphasizes patch management as a primary defensive control. Therefore, Option C is correct.

The scenario describes a host-level monitoring agent installed on a single workstation that records local system events such as file access, configuration changes, and unauthorized process execution. These are classic indicators of Host-Based Intrusion Detection System (HIDS) functionality. A HIDS runs on an endpoint (server or workstation) and monitors activity on that host, including operating system logs, file integrity, registry/config changes, system calls, application logs, and process behavior. Because it has direct visibility into what is happening locally, it can detect suspicious activity that may not be obvious from network traffic alone.

The clue that “attackers often attempt to disable or evade this type of monitoring to avoid being detected at the host level” also aligns strongly with HIDS. Adversaries commonly try to stop endpoint agents, tamper with logs, or evade detection by living-off-the-land techniques precisely because host-based sensors can catch actions like privilege escalation attempts, persistence mechanisms, malicious process launches, or unauthorized modifications to critical files and configurations.

Why the other options are not the best match:

A Network-Based Firewall (A) is a perimeter or network control that filters traffic based on rules (IPs, ports, protocols). It does not typically record detailed local file/process/configuration events on a single workstation.

A Host-Based Firewall (B) resides on the endpoint but primarily controls inbound/outbound network connections at that host. While it can log connection attempts, it is not chiefly designed to track file access, configuration integrity, or process execution.

A Network-Based IDS (C) analyzes traffic on the network segment (via taps/SPAN) to identify suspicious patterns. It does not require installing an agent on a single workstation and lacks direct visibility into local file and process events.

Therefore, the security system Olivia is demonstrating is D. Host-Based Intrusion Detection System.

The behavior described is a textbook indicator of time-based blind SQL injection. In CEH methodology for web application hacking, blind SQL injection is used when the application does not return database errors, query results, or verbose messages to the attacker. Instead of extracting data directly through displayed output, the attacker infers true or false outcomes by observing indirect side effects.

Here, the crafted input appends a conditional test about the database name’s first character. When the condition is true, the page response becomes “significantly longer,” which implies the injected payload triggers a database delay function or a time-consuming operation. This deliberate time difference becomes the communication channel: a longer response indicates “true,” while a normal response indicates “false.” By repeating such tests character-by-character, an attacker can enumerate sensitive values like database names, table names, and sometimes credentials—despite the application showing no errors or returned data.

This differs from Boolean-based blind SQL injection, where the inference is made through visible page content changes (for example, one response page looks different or contains different text when the condition is true). It also differs from UNION-based SQL injection, which relies on combining queries to return data in the application’s response, and error-based SQL injection, which depends on database error messages leaking information. Because the only observable signal here is response time, CEH classifies it specifically as time-based blind SQL injection. Defensive controls include parameterized queries, input validation, least-privilege database accounts, and WAF rules to detect time-delay functions and abnormal query patterns.

The best answer is Block all unnecessary ports, ICMP traffic, and unnecessary protocols such as NetBIOS and SMB. CEH web server hardening guidance emphasizes reducing the attack surface of internet-facing servers by disabling or filtering unnecessary services and protocols that are not required for web operation. In the scenario, Apache was compromised through an outdated vulnerability, but the answer options ask for the best hardening strategy among the listed choices. Option C reflects standard server-hardening practice by minimizing exposed network services and blocking protocols that are irrelevant or risky on a web server. A dedicated machine can support separation of roles, but it does not directly address service exposure. A risk assessment is useful for prioritization, not as the immediate control itself. Eliminating unnecessary files within jar files is not a standard Apache-specific hardening measure. CEH materials consistently recommend hardening web servers by closing unnecessary ports, disabling superfluous protocols, limiting reachable services, and reducing the overall attack surface in addition to patching. Among the available options, blocking unnecessary ports and protocols is the most appropriate security recommendation.

The correct answer is B because an API without request-rate limiting allows automated clients, bots, or scripts to repeatedly request large volumes of data from application endpoints. In CEH web application hacking concepts, web applications expose services to clients through front-end and back-end processing, and APIs are often used as direct interfaces to application data. When no rate limit, throttling, pagination control, quota enforcement, or anomaly detection exists, an attacker can enumerate records, harvest user profiles, pull product data, extract pricing information, or scrape sensitive business data at scale. This weakness is not XSS because no client-side script injection is described. It is not SQL injection because there is no malicious database query input. It is not CSRF because the attacker is not forcing a victim’s browser to submit authenticated requests. The missing control specifically enables repeated automated API access, making data scraping the best answer. Rate limiting should be enforced server-side, not only in client code.

CEH v13 explains that fingerprinting is a core reconnaissance technique used to identify software versions, server types, and configurations by analyzing how systems respond to crafted or abnormal input. When testers send malformed HTTP verbs, unusual headers, or atypical URI structures, the server’s specific response codes, banners, and error messages reveal distinctive behavioral patterns. These patterns allow tools like httprint, Nmap NSE scripts, and custom probes to match the responses to known server profiles. This technique is part of active reconnaissance, enabling attackers to determine vulnerabilities associated with specific versions. Phishing (Option B) is unrelated to protocol analysis. Session fixation (Option C) manipulates session identifiers, not HTTP response patterns. Persistent XSS (Option D) relies on web application vulnerabilities, not server fingerprinting. Thus, the tester is performing HTTP-based server fingerprinting.

The CEH Cloud Security module highlights identity and access management (IAM) failures as a major source of cloud breaches. Ensuring timely de-provisioning of user accounts when employees leave is a core security control.

Option C is correct.

Options A and B detect issues but don’t prevent access persistence.

Option D is unrelated to access control.

CEH stresses joiner–mover–leaver (JML) processes.

The correct answer is B. High-Interaction Honeypot.

The environment contains realistic systems, real services, identity structures, databases, and internal hosts. Attackers are allowed to interact with the environment for an extended period, escalate privileges, move laterally, and perform deeper activities while all actions are recorded. This is the defining behavior of a high-interaction honeypot.

CEH-aligned honeypot material explains that high-interaction honeypots consist of highly controlled networks running various services, where attackers can connect, attempt deeper compromise, and have their activities recorded for analysis. It also states that these environments often use real applications and services, making the honeypot harder for attackers to detect .

Option A. Low-Interaction Honeypot is incorrect because low-interaction honeypots emulate limited services and do not allow deep compromise.

Option C. Pure Honeypot is less accurate here because the scenario emphasizes a controlled research VLAN designed for interaction and instrumentation, not a normal production system passively monitored as a pure honeypot.

Option D. Medium-Interaction Honeypot is incorrect because the attackers are interacting with realistic internal services and performing extended post-compromise activity, which goes beyond medium interaction.

Therefore, the best answer is B. High-Interaction Honeypot.

WPA2-PSK networks authenticate users using a pre-shared key derived from a passphrase. After capturing the 4-way handshake, CEH teaches that the standard and most effective method to recover the key is to perform an offline dictionary attack, where wordlist entries are hashed and compared against the captured handshake values. Offline cracking avoids detection and is significantly faster than brute-force attempts.

The correct answer is Nikto. CEH web server security coverage identifies Nikto as a specialized open-source web server vulnerability scanner designed to assess HTTP and HTTPS services for dangerous files, insecure default content, outdated server versions, and version-specific problems. The scenario mentions examination of server headers, detection of installed web server software, checks for outdated components, identification of dangerous files and misconfigurations, SSL support, and exportable reporting. Those characteristics align closely with Nikto’s typical use in CEH-style web server assessments. OpenVAS, Nessus, and Qualys VM are broad vulnerability management platforms with much wider enterprise coverage, but the question describes a focused HTTP-server scanner rather than a full-spectrum infrastructure scanner. CEH materials frequently present Nikto in the context of web server enumeration and vulnerability discovery after the tester has identified the target web platform. It is especially useful for quickly checking internet-facing servers for known risky files, weak configurations, and outdated software. Because the assessment is centered on the specific exposure of web servers and matches the recognized feature set of Nikto, option D is the best answer.

The objective is to conduct passive reconnaissance for potentially exposed administrative documents on .onion sites, using advanced search operators. The query should therefore (1) restrict results to the hidden-network domain space, (2) focus on document formats likely to contain internal material, and (3) use a title/header hint that aligns with management or administration content.

Option C is the best match because it combines:

site:onion to constrain results to .onion resources (the target environment of concern),

filetype:pdf to focus on a common format for internal documents (policies, reports, procedures, administrative exports), and

intitle: " admin access " to search for pages/files whose title/header metadata indicates administrative relevance. Using intitle aligns with the requirement to look for files “with headers suggesting management-related content,” because titles are a practical proxy for document headers and indexing metadata.

By comparison, A does not include site:onion, so it is not scoped to hidden services, and it targets “credentials” rather than administrative documents. B includes site:onion and filetype:pdf, but the title focus is “secure login,” which is more likely to find authentication pages or generic security guidance rather than administrative document exposure. D is also plausible (docx + user accounts), but “user accounts” tends to point to account lists or HR-style docs rather than broader administrative access documentation, and PDFs are frequently used for formal administrative documentation and may be more commonly indexed.

Thus, C best satisfies the passive, targeted reconnaissance requirement for admin-related documents on .onion sites.

The correct answer is A. IMDS Attack.

The scenario describes an attacker executing code from inside a cloud instance and retrieving temporary credentials associated with the instance role. This is characteristic of an Instance Metadata Service (IMDS) attack. Cloud platforms expose metadata services to instances so applications can retrieve configuration and role credentials. If an attacker gains code execution on the instance, they may query IMDS and steal temporary credentials.

A cloud security reference explains that when an EC2 instance is associated with an instance profile, temporary security credentials are automatically provided to the instance through the Instance Metadata Service (IMDS) . In the scenario, the tester abuses this behavior after gaining code execution through the vulnerable web application.

Option B. CPDoS Attack is incorrect because Cache Poisoned Denial-of-Service targets caching behavior to cause service denial.

Option C. Cloud Snooper Attack is incorrect because Cloud Snooper refers to bypassing firewall controls and command-and-control through cloud infrastructure paths.

Option D. Wrapping Attack is incorrect because wrapping attacks commonly target SOAP/XML signatures or request manipulation, not cloud instance metadata credentials.

Therefore, the best answer is A. IMDS Attack.

CEH v13 identifies encrypted communication channels as one of the most common and effective firewall evasion techniques. Firewalls that rely on packet inspection or signature-based filtering often cannot inspect encrypted payloads without SSL/TLS interception capabilities.

By encrypting malicious traffic—using HTTPS, VPN tunnels, or encrypted C2 channels—attackers can bypass firewall rules that inspect packet contents. CEH v13 emphasizes that this technique is widely used in malware communication, data exfiltration, and command-and-control operations.

IP spoofing (Option A) is limited by ingress and egress filtering and is less effective against modern firewalls. Open-source operating systems (Option B) do not inherently evade firewalls. Social engineering (Option D) targets users, not firewalls.

Therefore, Option C is the correct and CEH-aligned answer.

The correct answer is C because network segmentation most directly disrupts the spread of ransomware across an organization. Ransomware encrypts or locks systems and demands payment for recovery; examples such as WannaCry are commonly discussed because they spread through vulnerable systems and network services. In the retrieved CEH-aligned material, WannaCry spread via SMB by scanning from an infected computer for other vulnerable systems and then executing against the next machine. Network segmentation reduces this risk by dividing the network into separate zones or VLANs and restricting unnecessary east-west communication between departments, servers, workstations, and critical systems. If one endpoint is infected, segmentation can prevent the malware from reaching file servers, domain controllers, backups, and other endpoints. Backups are extremely important for recovery, but they do not stop spread. IDS may detect suspicious activity, and AV may block known malware, but segmentation is the defense that most directly limits ransomware propagation.

CEH v13 explains that the Deep Web contains content not indexed by search engines, including exposed databases, misconfigured portals, leaked credentials, and internal documents.

This makes it a critical area to assess unintended data exposure. The Deep Web is not primarily for attacker profiling or insider detection.

Thus, Option D is correct.

In CEH v13 DNS Enumeration, DNS cache snooping determines whether a DNS resolver has a record cached. When +norecurse is used and the response is NOERROR with no answer, it means the server is authoritative but does not have the record cached.

CEH v13 explains that this suggests no internal client has recently queried the domain, making option D correct.

A FIN scan is a classic “stealth” TCP scan technique discussed in CEH network scanning methodology. Unlike a TCP Connect scan, which completes the full three-way handshake and is highly visible in logs, a FIN scan sends a TCP packet with only the FIN flag set to a target port. The scan then interprets the target’s response to infer whether the port is open or closed, without establishing a normal TCP session. This matches the scenario’s requirement to “infer port states without completing a full connection” and to keep visibility low.

The logic relies on expected TCP behavior defined for many TCP/IP stacks. For a closed port, the target typically responds with an RST packet, indicating there is no service listening. For an open port, many systems do not respond at all to an unexpected FIN packet (because it does not correspond to an existing connection). That “no response” behavior becomes the signal the tester uses to suspect the port may be open or filtered. CEH emphasizes that because FIN scans do not perform a handshake, they can be less likely to trigger certain basic connection-based logging, and they generate fewer obvious connection events than TCP Connect scans.

Option D, NULL scan, is also a stealth method, but it uses a packet with no flags set. The question specifically highlights leveraging TCP flags and is commonly mapped in CEH-style questions to FIN scanning as the representative “TCP flag stealth scan.” Option B is too generic, and option A is the most detectable. Therefore, FIN scan best aligns with the described stealth reconnaissance strategy.

The correct answer is B. Implementing a Split DNS Architecture.

The issue is that the same DNS infrastructure is being used for both internal and external name resolution, causing internal namespace details to be exposed externally. Split DNS separates internal and external DNS views so that external users receive only public records, while internal clients can resolve private hostnames and internal service records.

CEH-aligned reconnaissance material explains that footprinting and DNS-related information gathering can reveal domain names, namespaces, IP addresses, and network details useful for planning attacks . It also describes DNS and WHOIS queries as methods used during footprinting to collect topology and infrastructure information about a target network . Split DNS directly reduces this exposure by preventing public DNS queries from returning internal naming data.

Option A is incorrect because source port and query ID randomization helps reduce DNS spoofing/cache-poisoning risk, not namespace disclosure.

Option C is incorrect because rate limiting controls query volume, while the problem is sensitive information exposure.

Option D is useful for detection and investigation, but it does not prevent external clients from receiving internal DNS details.

Therefore, the best answer is B. Implementing a Split DNS Architecture.

In CEH v13 Cryptography, this threat is formally referred to as “Harvest Now, Decrypt Later” (HNDL). It describes a long-term cryptographic risk where adversaries intercept and store encrypted communications today, even though they cannot decrypt them with current computational capabilities. The expectation is that future quantum computers will be powerful enough to break widely used public-key cryptographic algorithms.

CEH v13 emphasizes that quantum algorithms such as Shor’s Algorithm can theoretically break RSA, DSA, and ECC by efficiently solving integer factorization and discrete logarithm problems. However, the defining feature of this threat is not the act of breaking encryption itself, but rather the strategic collection and storage of encrypted data in advance.

Option C is incomplete because it focuses only on the cryptographic mechanism rather than the threat model. Options B and D are unrelated to the scenario described and refer to quantum communication integrity issues, not long-term cryptographic exposure.

CEH v13 highlights that sensitive data with long confidentiality lifetimes—such as government records, financial data, healthcare information, and intellectual property—is especially vulnerable to this threat. As a result, organizations are encouraged to adopt quantum-resistant (post-quantum) cryptographic algorithms proactively.

Thus, Option A accurately describes the threat model and aligns with CEH v13’s treatment of future cryptographic risks.

The CEH Cloud Computing module identifies cloud APIs as one of the most critical attack surfaces in public cloud environments. APIs control provisioning, configuration, authentication, and management of cloud resources.

A vulnerability in a cloud API can allow attackers to:

Bypass authentication

Escalate privileges

Access or modify cloud resources

Create or delete services

Option B is therefore correct.

Option A relates to availability, not API flaws.

Option C is managed by the provider and unrelated to APIs.

Option D would require key compromise, not just API weakness.

CEH strongly emphasizes API security as a top cloud risk.

The correct answer is C, Supply chain risk. A Java application commonly depends on third-party libraries, frameworks, packages, and modules. When those dependencies are outdated and have known CVEs, the application inherits the weakness even if the organization’s own custom code is secure. CEH web application security material describes this as using components with known vulnerabilities: third-party components may themselves be vulnerable, and if vulnerable components are used, the new application becomes vulnerable. CEH-aligned OWASP coverage also explains that libraries, frameworks, and software modules often run with high privileges, and exploitation of a vulnerable component can lead to serious impacts such as data loss, server takeover, or undermining application defenses. CSRF tricks authenticated users into submitting unwanted requests, XSS injects malicious scripts, and DoS targets availability. The key risk here is dependency exposure through the software supply chain.

The correct answer is B, Clickjacking Attack. Clickjacking is a web application attack in which an attacker tricks a victim into clicking on a hidden or disguised element different from what the victim perceives on the screen. The most common technique involves placing a transparent or invisible iframe over legitimate-looking content. When the victim clicks the visible button, image, or link, the click is actually directed to the hidden iframe controlled by the attacker.

In CEH web application hacking topics, clickjacking is considered a user-interface redress attack because it manipulates the user’s perception of the web page. Attackers use this technique to force users to perform unintended actions such as changing account settings, authorizing transactions, enabling webcams, downloading malware, or granting permissions on trusted websites while remaining unaware of the action being performed.

HTTP Parameter Pollution involves manipulating application parameters, HTML Injection inserts malicious HTML into a web page, and Session Fixation forces a user to use a predefined session identifier. Since the scenario specifically describes a transparent iframe tricking the victim into clicking hidden content, the attack is Clickjacking.

Answer: B QUESTION NO: 25 [Malware Threats]

What kind of detection technique is being used in antivirus software that identifies malware by collecting data from multiple protected systems and instead of analyzing files locally it ' s made on the provider ' s environment?

A. Heuristics based

B. Honeypot based

C. Behavioral based

D. Cloud based

Answer: D

The correct answer is D. Cloud based because the question describes an antivirus architecture where suspicious files, metadata, reputation information, and threat intelligence are collected from multiple protected endpoints and analyzed within the vendor’s cloud infrastructure rather than exclusively on the local machine. In CEH malware defense concepts, cloud-based detection leverages centralized analysis engines, reputation services, machine learning models, and global threat intelligence gathered from many endpoints. This approach enables rapid identification of emerging malware and zero-day threats because intelligence learned from one protected system can immediately benefit all other protected systems.

Heuristic-based detection focuses on identifying suspicious code characteristics and malware-like patterns. Behavioral-based detection monitors how a program behaves on a system, such as unauthorized registry changes, process injection, or unusual network activity. Honeypot-based solutions use decoy systems to attract and study attackers. None of these specifically describe offloading analysis to the antivirus provider’s environment. The key phrase in the question is that malware analysis is performed in the provider’s environment using information collected from many protected systems, which is the defining characteristic of cloud-based malware detection. Therefore, option D is the most accurate CEH-aligned answer.

Creating scheduled tasks is the most likely persistence technique because it can be configured to execute automatically at system startup or on reboot without requiring a user to log in or manually launch anything. In CEH-aligned post-exploitation and persistence concepts, attackers commonly use operating system native mechanisms that blend into normal administrative activity. A scheduled task fits this goal well because it can be named to look legitimate, set to run under a specific account, and triggered by events such as system boot, user logon, or a timed schedule. The scenario explicitly states the payload launches on every reboot without user interaction, which aligns with a boot-triggered scheduled task.

Injecting into the startup folder usually triggers execution when a user logs on, not strictly on system reboot, and it depends on an interactive user session. That contradicts the requirement of no user interaction. Modifying file attributes, such as setting hidden or system attributes, improves stealth and makes a file less noticeable, but it does not create an automatic execution mechanism by itself. Installing a keylogger is a capability for capturing keystrokes, not a persistence method, and it does not inherently guarantee execution after reboot unless paired with an auto-start mechanism.

Therefore, the action that directly ensures the binary runs after each reboot in a controlled and reliable way is creating scheduled tasks, which is a classic persistence method emphasized in ethical hacking workflows for demonstrating real-world attacker behavior and improving defensive detection and hardening.

The correct answer is Inference-Based Assessment. CEH vulnerability assessment material explains that some scanning approaches do not blindly run every possible test against a host. Instead, they infer what checks are appropriate by first identifying protocols, ports, and services, then dynamically selecting tests that are relevant to those discoveries. The scenario describes exactly that behavior: the platform catalogs communication protocols, determines which services are associated with the observed ports, and automatically adjusts the vulnerability tests during execution. This inference-driven logic improves efficiency and reduces unnecessary probing because the scanner tailors its checks to the environment it discovers. Service-based and product-based phrasing may sound plausible, but the question is specifically about the scanning logic and decision model rather than the type of vendor offering. Tree-based assessment does not best describe the sequence presented. CEH guidance uses inference-based assessment to describe scanners that progressively refine their actions using information learned during earlier scanning stages. Because the selection of tests depends on discovered service characteristics and adapts as the scan proceeds, Inference-Based Assessment is the most accurate answer.

CEH clearly distinguishes between active and passive reconnaissance. Passive methods involve gathering publicly available data without directly interacting with the target’s infrastructure, thus avoiding detection. Tools such as Netcraft, DNSdumpster, VirusTotal, Certificate Transparency logs, and search engine indexing are recommended by CEH for discovering subdomains through public metadata, cached DNS records, WHOIS data, SSL certificate entries, and third-party enumeration databases. These platforms provide insights into externally accessible assets without sending packets or queries to the target organization. Brute-force enumeration is active and violates the rules of engagement. Attempting credential guessing or requesting internal DNS data are unauthorized and clearly active reconnaissance activities. Passive OSINT-based subdomain enumeration is a core CEH technique used to uncover hidden infrastructure safely and legally. It is especially crucial in red team operations where stealth is a priority.

CEH teaches that insufficient input validation on mobile applications enables code injection attacks. Injecting JavaScript or crafted payloads into fields validates whether the application improperly processes untrusted data. If executed, it confirms that the app is vulnerable to injection-based attacks.

The correct answer is D. Nikto.

Nikto is an open-source web server vulnerability scanner. It is specifically designed to scan web servers for dangerous files, outdated server versions, version-specific problems, configuration issues, and known web server weaknesses.

CEH-aligned web server hacking material states that Nikto scans for potentially dangerous files and programs, checks for outdated server versions, and identifies version-specific problems across various servers . Another CEH exam reference describes Nikto as a web-server-focused vulnerability scanner that checks for file problems, script errors, and server configuration errors .

Option A. Nessus is incorrect because Nessus is a broad vulnerability scanner, not the most specific match for the web-server-focused checks described.

Option B. OpenVAS is incorrect because OpenVAS is also a general vulnerability assessment platform.

Option C. Qualys VM is incorrect because Qualys VM is an enterprise vulnerability management platform, not the specific web server scanner described.

Option D. Nikto is correct because the described capabilities directly match Nikto.

Therefore, the best answer is D. Nikto.

The weakness described is that a device can reboot and still execute tampered firmware or pre-boot code “without any integrity check before the operating system loads.” The secure development practice that most directly prevents this is Secure Boot. Secure boot establishes a chain of trust starting at power-on, where each stage of the boot process verifies the integrity and authenticity of the next stage (bootloader, kernel, firmware components) before execution. If the verification fails (because firmware was modified, unsigned, or improperly signed), the device can halt, fall back to a known-good image, or enter a recovery mode—preventing malicious pre-OS code from running as if it were legitimate.

This matters especially for IoT devices such as smart climate control units, where attackers may attempt to persist by modifying firmware so that malware survives reboots. Without pre-boot integrity verification, a compromised device can continually load attacker-controlled instructions, making detection and remediation difficult.

Why the other options are less direct:

Code signing (A) is important, but by itself it does not guarantee the device will verify signatures at boot time. Secure boot is the enforcement mechanism that validates signed boot components before they run.

Secure firmware/software updates (B) reduce the chance of malicious updates being installed (e.g., signed OTA updates, authenticated update channels), but they do not necessarily prevent execution of already-tampered firmware at startup if boot-time verification is missing.

Secure communication protocols (C) protect data in transit and device communications, but they do not address firmware integrity during the boot process.

Therefore, the most direct preventive practice for this pre-OS integrity gap is D. Ensure secure boot.

Remote File Inclusion occurs when an application allows external resources to be loaded from user-controlled input. CEH teaches that an attacker can supply a remote URL pointing to a malicious script (for example, a PHP shell). When the vulnerable application includes this external file, the attacker ' s code executes on the server. This can lead to full system compromise, remote command execution, or lateral movement.

The correct answer is D, Long-term access. In MITRE ATT & CK terminology, “Persistence” refers to techniques adversaries use to keep access to a compromised environment after the initial compromise. This aligns closely with CEH system-hacking methodology, where the equivalent phase is “Maintaining Access.” CEH material describes maintaining access as the phase where a hacker tries to retain ownership of a system after exploiting a vulnerability, often by securing continued access through backdoors, rootkits, Trojans, or Trojan horse backdoors. Another CEH-focused source explains that after privilege escalation, the attacker moves into maintaining access by setting up mechanisms that allow return access later, which directly matches the concept of long-term access. Initial exploit belongs to gaining access, data theft relates more to collection or exfiltration, and cleanup relates to covering tracks. Therefore, ATT & CK “Persistence” means maintaining long-term access to the target environment.

The best answer is Remediation because the workflow centers on fixing confirmed vulnerabilities through an organized, prioritized plan and coordinating corrective actions with operations teams. In CEH-aligned vulnerability management, the lifecycle typically moves from asset identification and risk context, to scanning and validation, to analysis and prioritization, and then into remediation where weaknesses are actually reduced or eliminated. The question explicitly states that after vulnerabilities are detected and validated, Priya’s team “develop a structured timeline to address the confirmed vulnerabilities” and prioritize “high-risk findings affecting mission-critical systems.” Creating the remediation plan, assigning owners, scheduling patch windows, implementing configuration hardening, disabling unnecessary services, updating vulnerable software, and applying compensating controls are all core remediation activities.

Although the final step mentions rescanning to confirm resolution and producing a compliance report, that verification step occurs after remediation work has been performed. Verification is an important follow-on phase, but it is not the main phase being executed throughout the described workflow. Vulnerability analysis refers more to interpreting scan results, validating false positives, mapping weaknesses to impact, and determining exploitability. Risk assessment focuses on evaluating business impact and likelihood to prioritize work. Here, those phases are present, but the primary emphasis is on coordinating and executing fixes and driving them to closure, which is remediation.

In short, Priya is in the remediation phase, with verification used afterward to confirm the remediation was effective.

CEH v13 explains that LDAP enumeration is often restricted by Access Control Lists (ACLs). Sensitive directory objects and attributes are frequently protected to prevent unauthorized disclosure.

Even when LDAP is accessible, ACLs can limit the visibility of users, groups, and configuration data.

The capability described is Kubernetes self-healing, a core behavior emphasized in CEH cloud and container security coverage when discussing resilience, availability, and fault tolerance in containerized environments. Self-healing means Kubernetes continuously monitors the desired state of workloads and automatically acts when the current state deviates due to failures. If a node crashes, a container exits unexpectedly, or a pod becomes unhealthy, Kubernetes responds by restarting containers, recreating pods, and rescheduling workloads onto healthy nodes to maintain service continuity. This directly matches the scenario where containers are “automatically replaced and rescheduled” from failed nodes to keep payment services highly available.

While several Kubernetes components participate in achieving this outcome, the feature name most aligned with the described behavior is self-healing. Kubernetes uses controllers and the scheduler to implement it: deployments and replica sets ensure the correct number of pod replicas exist; liveness and readiness probes detect unhealthy containers; and when nodes become NotReady, pods are evicted and recreated elsewhere. This is exactly how Kubernetes supports uninterrupted operations for critical applications such as payment processing platforms.

Option B, kube-controller-manager, is a control-plane component that runs multiple controllers, and it contributes to enforcing desired state, but the question asks for the feature capability rather than the specific internal process that provides it. Option C, container orchestration, is broader and includes deployment, scaling, and management, but it is less precise than self-healing for the specific behavior of automatic replacement and rescheduling after failures. Option A is unrelated to availability behavior.

The correct answer is B. Inference-based assessment. In CEH vulnerability assessment concepts, an inference-based assessment starts by building an inventory of protocols discovered in the target environment. The tester then investigates the ports and services associated with those protocols and runs only the tests that are relevant to the discovered services. This exactly matches the scenario: James identified protocols, mapped ports to services such as email, web, and database services, and then selected vulnerabilities and tests appropriate for each machine. Tree-based assessment is different because it follows different assessment strategies for different components or platforms, such as Windows systems versus Linux servers. Product-based and service-based solutions refer to how vulnerability assessment tools or services are delivered, not to the protocol-and-service-driven testing logic described here. Therefore, the best CEH-aligned answer is Inference-based assessment.

According to CEH v13 Security Operations and Incident Response, zero-day vulnerabilities pose one of the highest operational risks because exploits exist before official remediation is available. When active exploitation is observed and no vendor patch exists, immediate compensating controls must be deployed.

The first and most effective action is implementing virtual patching, typically through a Web Application Firewall (WAF) or Intrusion Prevention System (IPS). CEH v13 defines virtual patching as a security measure that blocks exploitation attempts at the network or application layer without modifying the vulnerable software. This approach allows organizations to maintain service availability while reducing exposure.

Shutting down the server (Option A) may prevent exploitation but introduces unacceptable business disruption and is not recommended as a first response. Backups and incident response planning (Option C) are critical but do not actively prevent exploitation. Passive monitoring (Option D) allows attackers to continue exploiting the vulnerability unchecked.

CEH v13 emphasizes that virtual patching is the preferred first response for zero-day threats, especially when systems are mission-critical. It provides immediate risk reduction while allowing time for vendor patch development and controlled deployment.

CEH v13 discusses various credential extraction and authentication abuse techniques, including approaches that avoid LSASS memory due to modern protections like Credential Guard. The Internal Monologue technique is a specialized credential-harvesting approach that leverages the Windows SSPI authentication stack to coerce the local system into generating NetNTLM challenge-response hashes without requiring direct access to LSASS. This allows attackers to obtain legitimate NTLM responses entirely within the user’s security context. These captured responses can then be cracked offline using tools such as Hashcat. Unlike replay attacks (Option B), Internal Monologue is not about reusing captured traffic. Hash injection (Option C) requires possession of NT hashes and modifies authentication tokens, which does not occur here. Pass-the-ticket (Option D) targets Kerberos, not NTLM. Therefore, the correct technique is the Internal Monologue attack.

According to the CEH Vulnerability Assessment and Incident Response modules, vulnerabilities with high CVSS scores and potential RCE must be treated as active threats.

CEH best practices recommend:

Immediate containment (network isolation)

Investigation and impact analysis

Patch application

Recovery

Option D follows the CEH incident response lifecycle precisely.

Option C is incomplete without containment.

Options A and B are unsafe.

CEH emphasizes containment before remediation.

The correct answer is D, SMB enumeration. RID cycling is a Windows/SMB enumeration technique used to discover valid user and group accounts by cycling through Relative Identifiers, or RIDs, within Windows Security Identifiers, or SIDs. In Windows, a SID identifies a user, group, or computer account, while the RID is the final portion of the SID that identifies the specific account. CEH-related material explains that RIDs such as 500 identify the Administrator account, 501 identifies Guest, and normal user accounts commonly begin around 1000. During SMB or NetBIOS enumeration, attackers query SMB-accessible systems to retrieve users, groups, shares, machines, and SIDs. RID cycling uses this SID/RID structure to test sequential RID values and map them back to account names. It is not SQL injection, denial of service, or a DNS attack. Therefore, RID cycling belongs to SMB enumeration.

CEH v13 explains that steganography-based exfiltration hides data within benign-looking files, making it extremely difficult to detect via firewalls or IPS alone. Blocking all outbound traffic is impractical, and IPS systems are not designed to analyze file content deeply for hidden data.

The most effective countermeasure is steganalysis, which involves inspecting files for statistical anomalies, altered pixel distributions, or hidden payload patterns. CEH v13 identifies steganalysis tools as the only reliable method to detect and decode hidden data.

Traffic monitoring (Option C) helps identify suspicious transfers but cannot confirm steganography. Therefore, Option D is correct.

An HTTP flood is an application-layer (Layer 7) DoS/DDoS technique that targets web application resources by sending large volumes of seemingly valid HTTP GET/POST requests. Because the traffic can look “legitimate” at the protocol level, controls that primarily focus on network/transport characteristics (such as basic firewalls) are often insufficient. The tool described in the scenario is explicitly inspecting and filtering malicious HTTP traffic while allowing legitimate customer requests—that behavior aligns most directly with a Web Application Firewall (WAF).

A WAF is designed to protect web applications by analyzing HTTP/S requests and responses, applying security rules that detect and block abnormal or malicious patterns. In an HTTP flood scenario, a WAF can enforce rate limiting, detect request anomalies (e.g., repeated requests to resource-intensive endpoints like checkout), identify bot-like behavior, and apply signatures/behavioral policies to mitigate attacks while continuing to permit valid users. The key clue is the focus on HTTP-level inspection and filtering to maintain service continuity—a classic WAF use case during Layer 7 attacks.

Why the other options are less suitable:

A Load Balancer (A) improves availability by distributing traffic across servers, but it does not inherently inspect and filter malicious HTTP requests. It can help absorb load, yet it’s not primarily a security inspection/filtering control.

An Intrusion Prevention System (C) can block malicious activity, but many IPS deployments are stronger at network/transport-layer patterns and may not provide the same depth of application-aware HTTP policy enforcement as a WAF for targeted web endpoints.

A traditional Firewall (D) mainly filters by IP/port/protocol and cannot reliably distinguish malicious vs legitimate HTTP GET/POST floods when they use allowed ports (80/443).

This scenario describes Differential Cryptanalysis, a powerful cryptanalytic technique covered in CEH v13 Cryptography. Differential cryptanalysis focuses on analyzing how small changes in plaintext input affect the resulting ciphertext output, with the goal of uncovering patterns related to the secret encryption key.

CEH v13 explains that symmetric algorithms rely on complex transformations—such as substitution and permutation—to obscure relationships between plaintext and ciphertext. However, in some algorithms, predictable differences may propagate through encryption rounds in a way that reveals statistical biases. By carefully selecting pairs of plaintext inputs with controlled differences and comparing the resulting ciphertexts, attackers can infer information about intermediate states and eventually the encryption key.

This method does not attempt every possible key (brute force), nor does it rely on execution timing or system performance metrics (timing attacks). It also differs from chosen-ciphertext attacks, which involve submitting chosen ciphertexts for decryption rather than observing encryption behavior.

Differential cryptanalysis was instrumental in breaking early block ciphers and is a key reason why modern algorithms like AES are designed with resistance to differential attacks. CEH v13 emphasizes that understanding this attack is critical for evaluating the strength of symmetric encryption algorithms and their internal structure.

Therefore, Option A accurately describes the technique being employed.

The correct answer is B. Rogue AP because the scenario describes an unauthorized access point that has been physically connected to the internal wired network and is providing network access on the corporate VLAN without approval or inventory records. In CEH-aligned wireless security concepts, a rogue access point is any AP that is installed on an organization’s network without authorization, creating an unmanaged entry point that bypasses standard security controls. The key indicators here are: it is “previously unknown,” “neither provisioned by IT nor listed in the asset inventory,” and it is “physically connected to the hospital’s internal switch.”

The fact that the device is issuing IP addresses suggests it may be running a DHCP service or bridging into the internal network in a way that places clients directly onto the corporate VLAN. This can allow attackers to gain internal access from nearby wireless range and can also cause network instability if its DHCP responses conflict with the legitimate DHCP infrastructure. Additionally, the device “relaying internal traffic and providing remote connectivity back to an external host” points to an attacker using it as a covert foothold—effectively an unauthorized wireless bridge into the internal network and a channel for command-and-control or remote access.

Why not the other options: a misconfigured AP implies a legitimate AP deployed by IT but configured insecurely (weak encryption, default credentials, poor segmentation). A honeypot AP is typically deployed deliberately (often by defenders) to attract attackers for detection and research, not stealthy backhaul to an external host. An evil twin AP is a spoofed wireless AP that impersonates a legitimate SSID to lure victims; it does not necessarily require being physically plugged into the internal switch, and the defining trait is impersonation of a real AP/SSID. The defining trait here is unauthorized installation on the wired network, which is most directly a rogue access point.

The correct answer is A, Mimikatz. In CEH system hacking and post-exploitation topics, Windows credential attacks commonly focus on hashes, cached credentials, Kerberos tickets, and authentication material stored in memory or in Windows credential stores. The CEH-related material identifies Mimikatz as the de facto standard tool for extracting credentials from Windows memory and states that it can steal hashes, PIN codes, and Kerberos tickets from memory, as well as support pass-the-hash, pass-the-ticket, and Golden Ticket attacks. This directly matches the question’s phrase “dumps Windows hashes.” John the Ripper is mainly a password-cracking tool used after hashes are obtained. Hydra is primarily an online login/password attack tool for network services. Aircrack-ng is used mainly for wireless password/key cracking. Therefore, among the options, Mimikatz is the tool most specifically associated with dumping Windows credentials and hashes during the system hacking phase.

The correct answer is D. Exposed Bearer Tokens in Logs.

The scenario states that authentication artifacts associated with Kubernetes service accounts are appearing in logs or system-generated output. If those values can be reused to access cluster resources, they are functioning as bearer credentials. A bearer token grants access to whoever possesses it, so exposing it in logs creates a serious privilege-reuse risk.

Option A. No Certificate Revocation is incorrect because the weakness does not involve inability to revoke TLS or client certificates.

Option B. Unauthenticated HTTPS Connections is incorrect because the issue is not that HTTPS connections lack authentication. The issue is that valid authentication tokens are being logged.

Option C. No Non-repudiation is incorrect because non-repudiation concerns proving who performed an action. The scenario concerns credential exposure.

Option D. Exposed Bearer Tokens in Logs is correct because service-account bearer tokens recorded in logs could be reused by anyone who can access those logs.

Therefore, the best answer is D. Exposed Bearer Tokens in Logs.

This scenario most closely matches spam and phishing delivered through social networking platforms, a technique emphasized in CEH social engineering coverage as social media phishing or spear phishing via professional networks. Nadia impersonates a trusted internal authority figure, a senior HR manager, and uses believable branding elements such as a stolen logo and accurate employee details to establish credibility. She then initiates contact through connection requests and funnels targets into a controlled space, a private group, where she requests sensitive information. Collecting a work email address and department role may appear harmless, but CEH guidance notes that attackers often start with small, plausible requests to build trust and assemble data for deeper compromise. Work emails and roles enable targeted spear phishing, business email compromise preparation, password reset targeting, and crafting convincing pretexts aligned to the victim’s function.

The core mechanics align with phishing: deception, impersonation, and a call to action designed to extract information. The “exclusive project updates” hook is a classic lure used to increase compliance. While the exercise could lead to involuntary data leakage as a downstream effect, the primary simulated threat is the phishing process itself, using social media as the delivery channel. Loss of productivity is not the intent here, and network vulnerability exploitation refers to technical system flaws rather than manipulating human trust. Therefore, the most accurate classification of Nadia’s drill is spam and phishing conducted through a social media pretext.

The most likely tool/command is dig @server axfr, which attempts a DNS zone transfer (AXFR) from a specified DNS server. In CEH-aligned reconnaissance and enumeration methodology, DNS is a high-value target because it reveals how an organization’s names map to systems. A successful zone transfer can expose an entire DNS zone database, often including hostnames (subdomains), mail exchanger (MX) records, canonical name (CNAME) aliases, and sometimes internal-facing entries if the zone is misconfigured. The scenario’s outcome—receiving “a full list of subdomains, MX records, and aliases”—matches exactly what an AXFR zone transfer can disclose when a DNS server is improperly configured to allow transfers to unauthorized hosts.

The clue about a “secondary server” is also significant. In DNS architecture, organizations frequently deploy primary (master) and secondary (slave) DNS servers. Secondary servers legitimately request zone transfers from the master to stay synchronized. If the secondary server is misconfigured (for example, allowing AXFR to any requester or to a broader range than intended), an attacker can exploit this and retrieve the zone file. This results in detailed visibility into the organization’s naming scheme and infrastructure layout—information that can be used to identify high-value targets (mail servers, VPN portals, admin hosts), locate staging points, and plan follow-on attacks such as credential harvesting, targeted exploitation, or social engineering.

Why the other options do not fit: smtp-user-enum.pl is used for enumerating valid users on SMTP servers, not DNS records. ldapsearch enumerates directory information from LDAP services, not DNS zones. nbtstat -A queries NetBIOS name tables for Windows hosts, which may reveal local names and shares but not DNS-wide subdomains and MX/CNAME records. Therefore, the enumeration described is most consistent with a DNS zone transfer using dig with AXFR.

The correct answer is D. A hash algorithm is used to verify data integrity, which means confirming that information has not been changed after approval or transmission. Once the CFO approves the financial statements, a hash value can be generated for the document using algorithms such as SHA-256. Later, the accountant can calculate the hash again and compare it with the original hash. If both hash values match, the document has not been modified. If even one character, number, or byte changes, the resulting hash will be different.

Option A only controls the delivery medium and does not prove the file was unchanged. Option B provides password protection, which relates more to access control or confidentiality, not strong integrity verification. Option C gives redundancy, but both copies could still be altered or mishandled.

In CEH cryptography concepts, hashing is specifically associated with integrity verification, while encryption protects confidentiality and digital signatures provide integrity, authentication, and non-repudiation. Therefore, using a hash algorithm is the most suitable answer.

The correct answer is Modifying spacing and delimiter placement to disrupt detection patterns. CEH web application hacking material explains that pattern-based inspection controls, including weak input filters and some signature-driven defenses, often rely on recognizable textual structure in malicious payloads. If detection depends on static pattern matching, an attacker may preserve the same logical database operation while changing whitespace, separators, delimiter placement, or token formatting so the payload no longer matches the expected signature. That is exactly what the question describes: blocked requests shared a consistent textual arrangement, and the tester changed the presentation of those components without changing the intended SQL effect. Alternate encoding and dynamic construction are also known evasion ideas, but the scenario specifically emphasizes changed arrangement rather than transformed character sets or runtime string building. Inline comments can fragment keywords, yet the broader and best-fitting CEH answer is modification of spacing and delimiters to break the detection pattern. CEH materials stress that filters focused only on signature appearance are fragile because slight formatting variation can bypass them while leaving the attack semantics intact. Therefore, option C is the most accurate evasion method.

The correct answer is B, Lateral movement. In CEH security operations and incident response concepts, audit logs are essential for tracing user activity, source IP addresses, logon/logoff events, system changes, and other important security events. CEH-related material states that audit logs are vital for backtracking an incident and finding the root cause; when accounting or logging information is insufficient, incident investigation becomes extremely difficult. Lateral movement is especially difficult to detect without centralized logging because the attacker’s activity is spread across multiple internal hosts. Detecting it requires correlating events such as authentication attempts, remote service execution, SMB access, PowerShell use, privilege changes, and connections between endpoints. If each system keeps logs locally, defenders may miss the full attack path, especially if the attacker clears or tampers with local logs. CEH hacking methodology also notes that attackers can compromise connected intermediate systems and use compromised systems to launch attacks against others. Recon, delivery, and initial access may still appear in perimeter, email, proxy, or firewall logs, but lateral movement depends heavily on cross-host audit correlation.

CEH v13 explains that a keylogger is a type of spyware designed to capture user input covertly, often storing or transmitting captured data—such as passwords, emails, chat messages, and financial information—to an attacker. Keyloggers can be implemented as software, firmware, or hardware, and they operate silently in the background without affecting system performance, making them ideal for credential theft. CEH categorizes keyloggers under spying and monitoring malware frequently used in the System Hacking phase to escalate privileges or move laterally once credentials are harvested. Unlike rootkits, which hide processes, or ransomware, which encrypts files, a keylogger’s main purpose is passive surveillance. CEH emphasizes how attackers deploy keyloggers post-compromise or use phishing/social engineering to trick victims into installing them. Their covert nature and ability to bypass traditional AV solutions by masquerading as legitimate processes make identifying them crucial during forensics and incident response activities.

The correct answer is D because Windows null sessions are tied to SMB/CIFS and NetBIOS-based access to the IPC$ administrative share. CEH enumeration content describes null sessions as unauthenticated connections to Windows NT/2000/XP systems using a null username and password, allowing attackers to enumerate users, groups, shares, machines, and SIDs. The same CEH material states that null sessions require access to TCP 139 and/or TCP 445 ports. TCP 139 is NetBIOS Session Service, traditionally used for SMB over NetBIOS, while TCP 445 is direct-hosted SMB over TCP. CEH enumeration tables also list TCP 139 as NetBIOS Session Service and TCP 445 as SMB over TCP/direct host communication. Port 443 is HTTPS and unrelated to null sessions. Port 137 supports NetBIOS Name Service but is not the main null-session connection port. Therefore, the best answer is 139 and 445.

The command that best matches Bob’s goal is ntpq -p. In CEH-aligned coverage of network services and operational troubleshooting, NTP is highlighted as a critical dependency because inaccurate time can break authentication, distort logs, and cause incorrect transaction ordering. When investigating suspected time drift, the most useful first step is to view the active NTP associations and their quality metrics. The ntpq utility queries an NTP daemon and reports peer status and performance data. Specifically, ntpq -p displays a peer table that includes each configured or discovered time source along with fields such as delay, offset, and jitter. These values help determine whether the server is locked to a stable source or being influenced by a poor or rogue time server. Offset indicates how far the local clock differs from the peer, delay reflects network latency to the peer, and jitter shows the variability in timing measurements, all of which are directly mentioned in the question.

Option A, ntptrace, is used to trace the chain of NTP servers back to a reference clock and is useful for understanding hierarchy, but it does not provide the detailed delay, offset, and jitter peer metrics in the same way. Option C, ntpdc, is an older monitoring tool that can query NTP, but CEH references more commonly emphasize ntpq for peer statistics and associations. Option D is a generic ntpq invocation with interactive command support, but the -p option is the explicit mode that outputs the peer list with the required metrics.

The correct answer is A. Passive Online Attack.

The analyst is not directly guessing passwords, forcing authentication, or stealing a password database for later cracking. Instead, he is positioned on the network and sniffing authentication exchanges while legitimate users authenticate normally.

CEH-aligned password attack material defines a passive online attack as sniffing network traffic in the hope of intercepting a clear-text password, capturing authentication material, replaying authentication, or performing man-in-the-middle activity . Another CEH reference states that passive online password hacking can be performed by sniffing packets and capturing clear-text passwords or hashes for later analysis .

Option B. Non-Electronic Attack is incorrect because non-electronic attacks include methods such as shoulder surfing, dumpster diving, and social engineering.

Option C. Active Online Attack is incorrect because active online attacks involve directly communicating with the victim system, such as password guessing or brute-force attempts.

Option D. Offline Attack is incorrect because offline attacks involve stealing password hashes or files and cracking them separately.

Option A. Passive Online Attack is correct because the analyst captures authentication traffic by monitoring the network.

Therefore, the best answer is A. Passive Online Attack.

This scenario precisely matches polymorphic malware, a type of advanced malware described in CEH v13 Malware Threats. Polymorphic malware dynamically alters its code, encryption, or signature each time it propagates, allowing it to evade traditional signature-based antivirus detection.

Additionally, the malware’s ability to remain dormant until triggered indicates logic-based activation, which is common in advanced threats designed to avoid sandbox detection.

CEH v13 emphasizes that polymorphic malware cannot be reliably detected using static signatures. Instead, organizations must rely on behavior-based detection, heuristic analysis, and advanced threat protection systems capable of identifying suspicious runtime behavior.

Options A, C, and D do not match the described behavior. Adware focuses on advertising. Worms self-propagate aggressively. Rootkits focus on stealth and persistence, not code mutation.

Therefore, Option B is the correct answer.

CEH v13 identifies automated patch management as the most secure and scalable approach. Automated tools ensure timely deployment, validation, rollback capability, and compliance reporting.

Manual patching increases human error. Applying patches from unknown sources introduces malware risk. Limiting patches contradicts best practices.

Therefore, Option B is correct.

AES is the industry-standard symmetric encryption algorithm endorsed by CEH v13. It provides strong confidentiality and resists traffic analysis when used with proper modes (e.g., CBC, GCM).

DES is obsolete, HMAC ensures integrity not encryption, PSA is not a standard encryption algorithm.

Thus, Option B is correct.

The CEH Mobile Platform Security module explains that mobile antivirus solutions rely heavily on signatures and known exploit patterns. A custom exploit with obfuscation is far more likely to bypass detection.

CEH explicitly teaches that:

Zero-day or unpatched vulnerabilities

Custom, obfuscated payloads

Minimal use of known frameworks

are the most effective for bypassing endpoint defenses during controlled testing.

Option A is correct.

Options B and C are easily detected.

Option D is social engineering, not a technical exploit.

The correct answer is DNS interrogation. CEH reconnaissance guidance explains that active footprinting involves direct interaction with the target environment, which can generate logs or alerts. DNS interrogation is an active technique used to query name servers for information about domain structure, hostnames, mail servers, subdomains, and other records that reveal how public-facing systems are logically arranged. The question specifically says Justin is retrieving structural details about the organization’s public-facing systems and that his activity is logged by the target, which is consistent with active DNS queries. Network or port scanning is also active, but it focuses on discovering open ports and reachable services rather than the logical naming and organizational structure of public systems. Social engineering is human-focused, and user and service enumeration typically aims at accounts or system services rather than domain structure. CEH materials repeatedly emphasize DNS as a rich reconnaissance source because records such as A, MX, NS, TXT, and SOA can reveal infrastructure relationships and naming conventions. Since the goal is to understand how the organization’s internet-facing systems are organized and represented, DNS interrogation is the best fit.

The correct answer is A. Design Flaws because the weaknesses originate from fundamental development-time decisions in how the application was architected—specifically (1) selecting or creating a weak custom encryption algorithm and (2) implementing session validation in a way that allows requests to bypass access controls. In CEH-aligned vulnerability classification, design flaws are problems embedded in the application’s design and logic, not merely bugs from implementation mistakes, misconfiguration of a server setting, or missing vendor patches. They are often systemic: even if the code is “working as intended,” the intent itself is insecure.

The prompt explicitly states the issues are “traced back to flawed system logic and poor encryption design decisions made during the development phase.” That description maps directly to design flaws: using “homegrown crypto” instead of vetted cryptographic primitives and protocols is a classic design error because it typically lacks proper peer review, threat modeling, and proven resistance to cryptanalysis. Likewise, session validation that permits bypassing access controls indicates the application’s authorization/session model was designed incorrectly (for example, trusting client-side state, failing to enforce server-side checks consistently, or allowing unauthenticated endpoints to access privileged operations).

Why the other options are less accurate: Application flaws is a broad label that can include coding bugs, but the question is asking for the best category given that the root cause is architectural decisions rather than a narrow coding mistake. Misconfigurations/weak configurations usually refer to insecure settings in deployment (default credentials, permissive headers, weak TLS configuration), not a custom crypto algorithm and flawed session logic baked into the app. Poor patch management concerns failing to update known vulnerable components; here, the weakness is custom logic, not an unpatched third-party vulnerability.

Therefore, the most accurate category for these development-phase encryption and session/authorization weaknesses is Design Flaws.

In CEH’s Cloud Computing module, one of the most common real-world causes of cloud data exposure is misconfiguration, especially overly permissive network access controls. Cloud platforms commonly use constructs like security groups / firewall rules / network ACLs to define inbound and outbound access. CEH highlights that exposing sensitive services (databases, storage endpoints, admin panels) to the public internet—whether by “0.0.0.0/0” rules, overly broad ports, or unintended administrative access—frequently results in unauthorized access and data leakage even without sophisticated exploit chains.

Option D is therefore the most likely, because misconfigured security groups can directly expose customer data stores or management interfaces, enabling data theft through normal connectivity rather than exploiting a rare hypervisor flaw.

Option A (hypervisor side-channel attack) is advanced and less common; it typically requires high attacker capability and conditions not implied here. Option B (DoS) impacts availability, not confidentiality, so it doesn’t best explain data exposure. Option C (brute force passwords) is possible, but the question emphasizes an “unknown vulnerability” in the cloud environment—CEH teaching often frames “unknown vulnerability” in cloud incidents as misconfiguration or uncontrolled exposure rather than authentication guessing alone.

CEH countermeasures include least-privilege security group rules, segmentation, continuous configuration monitoring, cloud security posture management, and auditing publicly exposed resources.

This activity most accurately describes a DHCP starvation attack. CEH network and sniffing coverage explains that DHCP starvation is a denial-of-service technique in which an attacker rapidly sends large numbers of DHCP requests, usually with spoofed MAC addresses, to consume all available IP addresses in the DHCP pool. Once the pool is exhausted, legitimate clients can no longer obtain valid leases, which produces exactly the symptoms described in the question: repeated address negotiation attempts, failure to receive configuration, and a burst of requests coming from a single interface. A rogue DHCP server is often paired with starvation later, but the key evidence here is the rapid exhaustion behavior rather than the distribution of malicious configurations. IRDP spoofing would manipulate gateway discovery, not primarily deplete DHCP leases, and MAC spoofing alone would not explain widespread address assignment failure across multiple hosts. CEH guidance presents DHCP starvation as both a network disruption issue and a stepping stone for further interception attacks, since denying legitimate DHCP service can set conditions for a rogue DHCP server to take over client configuration and redirect traffic.

The correct answer is C. Sherlock.

Sherlock is used to search for a username across many social networking and online platforms. Its primary purpose is cross-platform username correlation. It does not natively provide geolocation tracking like Creepy, and it does not provide relationship-graph visualization like Maltego.

CEH-aligned reconnaissance material describes Maltego as a tool that gathers information from different sources and represents relationships through graph-based analysis . Another reference explains that OSINT username-correlation tools can verify whether a username or profile exists across hundreds of platforms . Sherlock matches that username-correlation function.

Option A. Maltego is incorrect because Maltego is used for relationship graphing and visual investigation.

Option B. Creepy is incorrect because Creepy is associated with geolocation intelligence from social media and image metadata.

Option D. Social Searcher is incorrect because it is mainly used for searching and monitoring social media content, not broad username enumeration across hundreds of sites.

Option C. Sherlock is correct because it specializes in checking whether a username exists across many online platforms.

Therefore, the best answer is C. Sherlock.

The correct answer is C. Encrypt stored data with quantum-resistant algorithms.

The question asks for a mitigation that directly addresses cryptographic resilience for stored data. If future quantum computers can break currently deployed public-key schemes, then the appropriate defense is to migrate protected data and key-establishment designs toward post-quantum or quantum-resistant cryptographic algorithms.

CEH cryptography material explains that cryptographic attacks attempt to recover encryption keys and that weak encryption algorithms may not be resistant enough against cryptographic attacks . In this scenario, the risk is not network exposure or poor coding practice; it is the future strength of the cryptographic algorithm itself.

Option A. Use quantum-specific firewalls is incorrect because firewalls do not protect already encrypted archives from cryptanalytic key recovery.

Option B. Break data into fragments and distribute it across multiple locations may reduce concentration risk, but it does not solve the weakness of an encryption algorithm vulnerable to quantum cryptanalysis.

Option D. Include quantum-resistance checks in SDLC and code review processes is useful as a governance practice, but it does not directly protect the stored archives unless the cryptography is actually changed.

Option C. Encrypt stored data with quantum-resistant algorithms is correct because it directly mitigates the future decryption risk.

Therefore, the best answer is C. Encrypt stored data with quantum-resistant algorithms.

The correct answer is MX. CEH reconnaissance material explains that MX, or Mail Exchange, records identify the mail servers responsible for receiving email for a domain. When a tester wants to understand how an organization handles incoming email traffic, MX records are the most relevant DNS data source because they reveal the designated mail infrastructure and often the priority order of mail servers. In this scenario, the objective is to gather passive intelligence about communication infrastructure without performing active network probing, so querying DNS records is appropriate. SOA records provide domain authority and zone administration information, TXT records often contain verification or policy-related text such as SPF details, and NS records identify authoritative name servers. While those can all contribute to broader reconnaissance, they do not directly answer which systems are responsible for receiving mail. CEH emphasizes that MX records are commonly used during footprinting to identify email infrastructure, support phishing simulations, analyze third-party mail providers, or map communication dependencies. Because the question explicitly asks for the DNS record type that reveals mail server configuration, MX is the correct choice.

The correct answer is A because a deauthentication attack is commonly used to force a connected wireless client to disconnect from an access point and then reconnect. During that reconnection process, the WPA/WPA2 authentication handshake can be captured and later used for offline password-cracking attempts. CEH wireless hacking concepts describe breaking WPA by capturing WPA/WPA2 authentication handshaking packets and forcing a connected client to disconnect and reconnect so authentication packets can be captured for Pairwise Master Key analysis. This matches the purpose of a deauth attack. Jamming is mainly an availability or denial-of-service attack that disrupts wireless communication, not a handshake-capture method. Spoofing means impersonating a device or MAC address, and replay means reusing captured traffic or authentication data. Although replay attacks can be part of wireless exploitation, the specific attack used to trigger a fresh handshake capture is deauthentication. Therefore, option A is the best CEH-aligned answer.

The correct answer is B. Predictive analysis because the client’s primary objective is to anticipate future attack patterns before they occur, and the described AI-enabled platform is explicitly being used to forecast potential attack vectors based on historical breaches and anomaly data. In CEH-aligned coverage of modern security capabilities, AI-driven approaches add value by learning from large datasets (logs, alerts, incidents, threat intelligence, and observed attacker behaviors) to identify trends, detect weak signals, and predict the most likely next steps an adversary may take. This directly supports proactive defense planning rather than purely reactive response.

In this scenario, the platform ingests “previous breaches and anomaly data” and produces forward-looking insights. That is the essence of predictive analysis: applying machine learning/analytics to estimate where attacks may emerge (for example, which assets are most at risk, which tactics are trending, what misconfigurations correlate with compromise, or which sequences of events often precede an intrusion). This helps defenders prioritize controls, patching, monitoring, and hardening to disrupt the projected attack paths ahead of time. It also aligns with the retail client’s desire to know whether their defenses can “anticipate” attacks, not merely document them after the fact.

Why the other options are less correct: Scalability is a benefit of AI (automating large-scale analysis), but it does not specifically address forecasting future attack vectors. Enhanced reporting improves how findings are communicated, but it is not the key capability described. Simulation and testing refers to running scenarios or automated testing in environments to measure resilience; that can be AI-assisted, but the prompt focuses on analyzing historical and anomaly data to predict likely attacks, which maps most directly to predictive analysis.

Therefore, the most critical benefit of AI-driven ethical hacking in this case is predictive analysis.

CEH reconnaissance and enumeration modules explain that LDAP services often support anonymous binding by default unless explicitly disabled. Anonymous bind allows unauthenticated users to query certain directory attributes, which can lead to disclosure of usernames, organizational hierarchy, and email addresses—critical information for password attacks, phishing campaigns, and privilege escalation planning. In the scenario described, the tester obtained directory data without providing any credentials, demonstrating that anonymous bind permissions were enabled. LDAPS requires TLS encryption and authentication, which contradicts the observed access. Kerberos authentication mandates valid credentials. LDAP via RADIUS is used for authentication integration, not for information disclosure. Since the query was successful with no authentication and no access controls triggered, this aligns exactly with CEH’s description of anonymous LDAP binding.

The correct answer is D because the scenario describes Business Email Compromise, commonly called BEC. In BEC, attackers compromise or misuse a trusted business email account and send believable internal messages to employees, finance teams, executives, or partners. The key clues are “compromise a legitimate email account,” “convincing internal messages,” and “urgent actions.” CEH social engineering concepts explain that computer-based social engineering includes phishing and crafted emails that appear legitimate, while spear phishing targets an individual or small group within an organization. However, this question is more specific than ordinary phishing or spear phishing because the attacker is using a legitimate compromised account rather than only a fake or spoofed email. CEH email-hijacking content also describes compromised email accounts sending messages to people the victim knows and email messages containing requests such as money transfers. Therefore, spoofing, phishing, and spear phishing are related, but Business Email Compromise is the most precise answer.

The Certified Ethical Hacker (CEH) Malware Threats module explains that modern malware increasingly uses fileless techniques and living-off-the-land strategies, communicating over legitimate protocols like HTTP and DNS to evade detection.

Because this traffic blends with normal activity, port-based blocking and signature-based antivirus are often ineffective. CEH highlights behavioral analytics and network traffic analysis as the most reliable detection mechanisms for identifying anomalies such as:

Unusual outbound DNS queries

Abnormal HTTP beaconing patterns

Suspicious process behavior

Option C is correct because it focuses on detecting behavioral anomalies, which CEH identifies as essential for combating advanced malware and command-and-control (C2) channels.

Option D may disrupt business operations and does not address DNS-based C2.

Option A is outdated.

Option B cannot detect unknown or fileless malware.

CEH strongly recommends anomaly detection and behavioral monitoring for advanced threats.

CEH v13 states that DNS server hijacking occurs when attackers compromise the authoritative DNS infrastructure and alter DNS zone records to redirect all legitimate queries to malicious destinations. Unlike DNS cache poisoning, which affects specific resolvers temporarily, server hijacking manipulates the core DNS authority controlling the domain. This results in a complete redirect for all users, regardless of geographic location or device configuration. CEH emphasizes that such attacks can lead to large-scale credential theft, phishing, financial fraud, and session compromise because the attacker presents an identical clone site while retaining full control of DNS routing. DNS tunneling is used for covert data exfiltration and does not redirect traffic. DNS rebinding targets browser policies, not global DNS redirection. DNS amplification is a volumetric DDoS technique unrelated to zone manipulation. The scenario matches DNS server hijacking exactly.

The behavior described most closely matches Agent Smith, an Android malware family known for replacing or hijacking legitimate applications and monetizing that access through ad fraud and data abuse. The strongest clues are the installation from a third-party marketplace, the silent replacement of already installed apps, and the use of those altered applications to push excessive advertisements while collecting information. In CEH mobile platform discussions, third-party app ecosystems are repeatedly identified as high-risk distribution paths for malicious or trojanized software because the apps may avoid the stricter vetting associated with official marketplaces. Pegasus is generally associated with advanced spyware capabilities and covert surveillance, not ad-fraud-driven replacement of popular apps. GoldPickaxe is tied to more targeted mobile credential and identity theft campaigns, while Mamo is not the fitting malware profile here. This question is testing recognition of a well-known Android malware pattern: malicious code embedded in an apparently useful application that later abuses the trust and visibility of legitimate apps already on the phone. CEH mobile security principles stress that unofficial app sources significantly increase the risk of this kind of compromise.

The technique demonstrated is Elicitation. CEH social engineering coverage explains elicitation as the art of drawing out information from a target through conversation without making direct or obviously suspicious requests. The attacker carefully guides dialogue so the victim voluntarily reveals sensitive details, often believing the discussion is normal, harmless, or professionally relevant. That is exactly what happens here: the person poses as a recruitment consultant, builds rapport through multiple informal interactions, and gradually obtains information about research, timelines, and internal code names. No credentials are requested and no overt trade or reward is offered, so this is not quid pro quo. It is also not baiting, which typically relies on an enticing object or opportunity, nor a honey trap, which usually involves romantic or intimate manipulation. CEH materials emphasize that elicitation is especially dangerous because the victim often does not realize that the attacker’s questions are strategically sequenced to extract valuable intelligence piece by piece. The gradual, conversational, non-confrontational harvesting of sensitive project details in this scenario is the defining pattern of elicitation.

This refers to the CVSS (Common Vulnerability Scoring System), which CEH v13 identifies as the industry standard for vulnerability prioritization. A score of 9.8 indicates critical severity, combining metrics such as exploitability, impact, privileges required, and scope.

CVSS helps organizations prioritize remediation objectively, focusing resources on vulnerabilities with the highest business risk. It also allows consistent communication between technical and management teams.

Options B, C, and D misrepresent CVSS functionality. Therefore, Option A is correct.

CEH v13 explains that Windows systems running older or default configurations often allow anonymous or null session connections to IPC$ shares, enabling attackers to enumerate users, groups, shares, and other system details without authentication. Null session enumeration is highlighted as a classic yet effective technique because it generates minimal detectable activity and does not require credentials, making it ideal for stealth operations. CEH stresses that SMB null sessions are frequently overlooked in legacy or poorly hardened environments, especially when default permissions remain unchanged. Packet sniffing (Option A) may provide some data but requires traffic visibility and may be detected through monitoring tools. DNS zone transfers (Option B) require misconfigurations and usually do not reveal user list details. SNMP queries (Option D) require community strings and often generate alerts. Therefore, exploiting null sessions is the most covert and effective method for enumerating Windows systems under default configurations.

CEH v13 highlights the Idle Scan as one of the stealthiest reconnaissance methods available, designed specifically to avoid detection by IDS and security monitoring tools. Idle scanning leverages a “zombie host”—a system with a predictable IPID sequence—to route all probe packets through it. Since no packets ever originate directly from the attacker’s IP, IDS systems are unable to attribute the port scan to the attacker. CEH emphasizes that this technique creates zero direct traffic between the attacker and the target, making it extremely evasive and ideal for highly monitored networks. FIN scans (Option A) are somewhat stealthy but still originate from the attacker and are detectable. TCP Connect scans (Option C) are the most detectable because they complete full connections. ICMP Echo scans (Option D) are easily logged and flagged by IDS. Idle scanning is uniquely suited for bypassing advanced detection systems while still identifying open ports and live hosts.

The correct answer is B. ARP Spoofing because the described outcome—silently redirecting traffic between two hosts through the attacker’s machine on a LAN without changing switch configurations—is the classic effect of ARP poisoning (also called ARP spoofing). In CEH-aligned network sniffing and man-in-the-middle (MITM) techniques, ARP spoofing works by sending forged ARP replies onto the local network so that a victim host associates the attacker’s MAC address with the IP address of a legitimate system (commonly the default gateway or another target host). Once the victim’s ARP cache is poisoned, frames intended for the real destination are instead sent to the attacker, who can then forward them to the legitimate host to maintain connectivity while inspecting or altering the traffic.

The scenario states David “injects crafted messages” and then “all traffic between a finance workstation and the authentication server is silently routed through his system.” That behavior strongly indicates ARP spoofing performed in both directions: poisoning the workstation to believe the attacker is the authentication server (or gateway) and poisoning the server to believe the attacker is the workstation (or gateway). This enables a transparent MITM position where credentials can be observed—especially if protocols are unencrypted or if the attacker can downgrade or strip protections. The fact that “no proxy or VPN is in use” supports the idea that the redirection is happening at Layer 2/Layer 3 on the local segment rather than via an explicit application-level proxy.

Why the other options are less accurate: Switch port stealing targets switch CAM tables to redirect frames, but it is less directly described than ARP cache poisoning between two IP endpoints. An STP attack manipulates spanning tree to become the root bridge and can influence paths, but it is a different control-plane attack and usually affects broader Layer 2 topology. IRDP spoofing involves ICMP Router Discovery Protocol to advertise a rogue router, but the scenario fits the much more common and direct MITM sniffing technique on a switched LAN: ARP spoofing.

Therefore, David most likely used ARP spoofing.

The correct answer is A. Stolen equipment. In CEH ethical hacking methodology, “stolen equipment” is a mode of ethical hacking that simulates theft of a critical information resource, such as a laptop owned by an important organizational user, and then provides that asset to the ethical hacker for assessment. The question specifically mentions targeting the CEO’s laptop or backup tapes to extract critical information, usernames, and passwords. These are classic examples of sensitive assets that may contain cached credentials, confidential documents, password hashes, VPN profiles, email archives, or backup copies of production data. This test evaluates whether protections such as full-disk encryption, strong authentication, secure backup handling, and data-at-rest controls are effective. “Physical entry” focuses on entering and compromising the organization’s facilities or ICT infrastructure, while “insider attack” simulates a trusted internal user abusing access. “Outsider attack” typically represents an external threat. Because the focus is on stolen laptops and backup media, the best CEH answer is stolen equipment.

CEH v13 identifies misconfigured cloud security groups as the leading cause of cloud data exposure. Open ports, public storage buckets, and overly permissive firewall rules frequently expose sensitive data.

Brute force and DoS do not directly expose stored data, and side-channel attacks are rare and advanced.

In CEH v13 Cloud Computing, serverless architectures introduce unique security challenges, particularly around Function-as-a-Service (FaaS) permissions. When a serverless function is compromised through an insecure third-party API, the damage depends largely on what the function is allowed to do.

Implementing function-level permission models and enforcing the principle of least privilege ensures that even if a function is exploited, its ability to execute malicious actions is strictly limited. CEH v13 strongly emphasizes granular IAM controls in serverless environments.

While cloud-native security platforms (Option A) and CASBs (Option C) provide visibility and governance, they do not directly prevent excessive permissions. Regular patching (Option D) is important but does not mitigate permission abuse.

CEH v13 identifies least privilege as the single most critical control in preventing serverless abuse and privilege escalation. Therefore, Option B is the correct answer.

TCP NULL scanning is a stealth scanning technique covered in CEH v13 Reconnaissance and Network Scanning. In a NULL scan, all TCP flags are set to zero. According to RFC 793 and CEH documentation, closed ports must respond with a TCP RST (Reset) packet.

If the port is open, the target typically does not respond, making this technique useful for firewall evasion. Therefore:

RST response = Closed port

No response = Open or filtered port

Other options do not apply to NULL scans:

SYN/ACK is associated with SYN scans.

ICMP errors may indicate filtering, not port state.

Tiny Fragments is the technique described because it relies on IP fragmentation to evade firewall or packet-filter inspection by splitting critical header and payload information across multiple fragments. In CEH-aligned network evasion concepts, some security devices make allow or deny decisions by inspecting specific fields and patterns in the first fragment of a packet or by performing limited reassembly. If the attacker deliberately crafts fragments that are unusually small, the first fragment may not contain enough of the TCP header or higher-layer data for the firewall to properly evaluate the packet against its rules and signatures. The remaining TCP header bytes or meaningful payload patterns can be pushed into subsequent fragments, which may pass through because the device cannot correlate them correctly or does not fully reassemble traffic before inspection.

The question’s key clue is that Ethan is “forcing some TCP header information into subsequent packets” to bypass checks. That phrasing is a direct match to fragmentation-based evasion rather than identity deception or tunneling. IP address spoofing changes the apparent source IP, but it does not specifically move TCP header details into later fragments. Source routing is an old technique to influence packet pathing using IP options and is typically blocked in modern environments; it also does not describe splitting TCP header content. HTTP tunneling encapsulates non-HTTP traffic inside HTTP to pass through proxies or firewalls, which is a different mechanism than fragmentation.

Therefore, the correct firewall bypass technique in this scenario is Tiny Fragments.

Zero-day exploits are considered the most dangerous mobile attack vector in CEH v13 Mobile Platform Hacking. These exploits abuse previously unknown vulnerabilities, meaning no patches, signatures, or defenses exist at the time of attack.

In healthcare environments, mobile devices access sensitive EHR systems and operate under strict compliance requirements. Zero-day exploits can bypass mobile OS security, sandboxing, and antivirus controls entirely.

App spoofing and Bluejacking are easier to detect and mitigate through user awareness and Bluetooth controls. Side-channel attacks are highly specialized and rare in enterprise mobile environments.

CEH v13 stresses that zero-day attacks pose the greatest risk due to lack of detection mechanisms, making Option A correct.

Priya is performing Verification because the team has already completed the remediation work (patches and fixes), and is now conducting follow-up scans and attack-surface review to confirm that the applied changes actually resolved the identified vulnerabilities. In a standard vulnerability-management lifecycle, remediation is the phase where vulnerabilities are addressed through actions such as patching, configuration hardening, compensating controls, or removing vulnerable services. Verification comes immediately after remediation to ensure fixes are effective, nothing was missed, and no new issues were introduced.

The scenario’s sequencing is the strongest clue: “already applied patches and fixes” means remediation is done; “run follow-up scans…to confirm” indicates validation of remediation outcomes; and “only after this step will she prepare a compliance report” reflects that organizations typically require evidence that remediation is effective before reporting status to leadership or auditors. Verification often includes rescanning the affected assets, checking configuration baselines, validating that vulnerable versions are no longer present, ensuring services are running as intended, and confirming that the original finding cannot be reproduced.

Why the other options do not match:

Remediation (D) would be the patching/fixing activity itself, which has already occurred.

Risk Assessment (C) is the prioritization and impact evaluation stage, typically performed before remediation to decide what to fix first and how urgently.

Monitoring (A) is ongoing observation and continuous assessment (tracking exposure, trends, new vulnerabilities), but Priya’s specific task is a post-fix confirmation step, which is verification.

Therefore, the correct phase is B. Verification.

This scenario demonstrates a classic case of Session Fixation, a session hijacking technique explicitly covered under the CEH v13 Web Application Hacking module. Session fixation occurs when an attacker sets or predicts a valid session identifier and forces a victim to authenticate using that same session ID.

In the given question, two critical vulnerabilities are highlighted:

The session ID is embedded in the URL

The application does not regenerate the session ID after login

According to CEH v13, secure applications must regenerate session identifiers after successful authentication to prevent fixation attacks. If this does not occur, an attacker can craft a URL containing a known session ID and trick the victim into clicking it. Once the victim logs in, the attacker reuses the same session ID to gain unauthorized access.

CEH documentation states that session fixation is particularly effective when:

Session IDs are passed via URL parameters

Sessions persist across authentication

Secure cookie attributes are not enforced

Other options are incorrect because:

XSS-based cookie theft requires client-side script injection.

DNS cache poisoning is unrelated to session management.

CSRF exploits user trust but does not directly hijack sessions.

Thus, Session Fixation by pre-setting the token in a URL is the most effective attack in this case.

The correct answer is A. PRINCE Attack.

The key clue is that Ethan uses one custom wordlist, and the cracking tool automatically generates candidates by linking multiple entries from that same list. This matches the PRINCE Attack, which builds password candidates by chaining words from a single input list. It is effective against passwords made by concatenating familiar words, such as company names, departments, project names, or common internal terms.

CEH-aligned password-cracking material explains that attackers often exploit weak password habits such as dictionary words and predictable combinations. It also describes dictionary attacks, brute-force attacks, hybrid attacks, syllable attacks, rule-based attacks, rainbow tables, and distributed password recovery as common password-cracking methods .

Option B. Combinator Attack is close, but it traditionally combines words from two separate wordlists. The scenario specifically says Ethan supplied a single custom wordlist.

Option C. Markov-Chain Attack is incorrect because Markov attacks generate candidates based on statistical character-probability models, not by chaining whole words from one list.

Option D. Fingerprint Attack is incorrect because fingerprint attacks build candidates based on observed password structures or patterns, not specifically by concatenating entries from one wordlist.

Therefore, the best answer is A. PRINCE Attack.

The command that best matches “directly interact with the NTP daemon and query its internal state,” enabling monitoring and retrieval of statistics, is ntpdc. Option C is correct because ntpdc is designed as a control/query utility for NTP that communicates with the NTP daemon using control messages. It can be used to request internal variables, statistics, and status information and to perform certain monitoring-style checks related to NTP daemon operation.

The scenario also gives a strong exclusion clue: Bob’s goal is not primarily to list peers with delay, offset, and jitter values. That peer listing is most closely associated with ntpq -p (option A), which prints peer relationships and timing metrics. Similarly, ntptrace (option B) is used to trace the chain of NTP servers (who is syncing from whom), which is not what Bob is seeking. Option D (ntpq with -c command) can query certain runtime details, but the question emphasizes a diagnostic command focused on controlling/checking daemon operation and retrieving internal stats—this description aligns more closely with ntpdc in many NTP administration and diagnostic workflows.

In practice, an assessor might use ntpdc to query items like system status, clock variables, and monitoring statistics from the daemon, which can help diagnose synchronization irregularities and understand how the NTP service is behaving internally. That aligns with “query its internal state” and “retrieve statistics.”

Therefore, the correct command is C. ntpdc [-ilnps] [-c command] [host].

This scenario clearly describes the need for Time-Based Blind SQL Injection, an advanced SQL injection technique covered in the CEH v13 Web Application Hacking module. Blind SQL injection is used when an application does not return database errors or visible output, making traditional techniques ineffective.

According to CEH v13, Time-Based Blind SQL Injection is particularly useful when:

The backend database type is unknown

Error messages are suppressed

UNION queries fail

No direct data is returned in responses

In this technique, attackers inject SQL statements that deliberately introduce time delays using database-specific functions such as SLEEP(), WAITFOR DELAY, or BENCHMARK(). The ethical hacker then observes the application’s response time to determine whether the injected condition is true or false.

For example:

' OR IF(1=1, SLEEP(5), 0) --

If the application response is delayed, it confirms that the injected SQL statement was executed successfully. CEH v13 categorizes this method as behavioral-based inference, where the attacker extracts information one bit at a time by analyzing timing differences.

Other options are incorrect because:

Content-Based Blind SQL Injection relies on visible differences in responses, which the question states are unavailable.

Union-Based SQL Injection requires knowing column count and data types.

Error-Based SQL Injection depends on database error messages being displayed.

CEH v13 emphasizes Time-Based Blind SQL Injection as a last-resort yet highly effective technique when dealing with hardened applications that suppress output, making it a frequent exam-tested concept.

In CEH-aligned cloud security discussions, protecting data across its lifecycle is a primary requirement, and a major risk area is how data moves between clients, applications, and cloud services. The scenario states the exposure occurred because there was no encryption during transmission between user devices and cloud storage. That maps directly to the Service and Data Integration risk area because it focuses on the security controls applied when cloud services exchange data with users and with other services, including secure communication channels, API protection, and proper cryptographic enforcement for data in transit.

When data is transmitted without TLS or with weak or misconfigured TLS, it becomes vulnerable to interception and manipulation through man in the middle attacks, traffic sniffing, SSL stripping, or downgrade attacks. In regulated environments such as healthcare, HIPAA expectations strongly align with implementing strong encryption in transit and ensuring secure session establishment, certificate validation, and modern cipher suites. This is not primarily a multi tenancy or physical security issue, which relates to isolation between tenants and the provider’s datacenter controls. It is also not primarily an incident analysis and forensic support issue, which concerns detection, logging, evidence collection, and investigative capability after events occur. Infrastructure security is broader and can include network protections, but the question is specifically about preventing exposure during transmission, which is most precisely addressed by service and data integration controls.

Correct remediation typically includes enforcing HTTPS with modern TLS, enabling HSTS, disabling legacy protocols and weak ciphers, ensuring correct certificate management, using mutual TLS where appropriate, and securing cloud storage access through authenticated, encrypted endpoints and properly secured APIs.

The correct answer is C. Ping method by sending packets with an incorrect MAC address.

The scenario describes testing whether a network card is processing packets not intended for it. That is exactly what promiscuous mode does. In promiscuous mode, a NIC accepts frames even when they are not addressed to its own MAC address.

CEH sniffing material explains that the Ping Method detects a sniffer by sending a ping request to the suspect IP address with a spoofed MAC address. If the NIC is not in promiscuous mode, it will not respond. If the suspect system is running a sniffer, it may respond to the packet .

Option A. DNS method is incorrect because the scenario does not describe reverse DNS lookup behavior.

Option B. NSE script can be used for promiscuous-mode detection in some cases, but the question specifically describes crafted packets used to test acceptance of traffic not addressed to the host.

Option D. ARP method is another sniffer detection method, but it relies on non-broadcast ARP cache behavior. The scenario’s wording most directly matches the ping method with an incorrect or spoofed MAC address.

Therefore, the best answer is C. Ping method by sending packets with an incorrect MAC address.

Whaling is the correct answer because the scenario describes a highly targeted phishing attempt aimed at a “big fish”—a senior executive (the CEO). In CEH terminology, whaling is a specialized form of phishing that focuses on high-profile, high-authority individuals (e.g., CEOs, CFOs, directors) to maximize impact. These targets often have access to sensitive data, financial approvals, privileged systems, and strategic communications, making their credentials significantly more valuable than those of typical employees.

The attacker (Clara) uses classic social engineering drivers emphasized in CEH training: authority (impersonating the legal department), urgency/fear (a “pending lawsuit”), and trust in internal processes (a link to a supposed internal portal). This combination is designed to short-circuit normal verification behavior and prompt quick compliance. The inclusion of a credential-harvesting link aligns with common phishing goals: capturing usernames/passwords, enabling account takeover, and potentially facilitating broader compromise (e.g., email access for business email compromise, lateral movement, or privileged escalation).

Why the other options are less accurate: Spear phishing is also targeted, but it is a broader category aimed at specific individuals or groups at any level. The defining clue here is the executive-level target, which elevates it to whaling. Clone phishing involves copying a legitimate email previously received and swapping a malicious link or attachment—this detail is not present. Consent phishing typically abuses legitimate OAuth/app consent flows rather than a fake portal requesting credentials.

CEH v13 explains that mobile antivirus solutions rely heavily on signatures and known exploit patterns. A custom exploit using obfuscation is far more likely to evade detection.

Metasploit payloads and rootkits are commonly flagged, and SMS phishing relies on user interaction. Therefore, custom obfuscated exploit code is the most stealthy and effective method.

The Certified Ethical Hacker (CEH) Cloud Computing module emphasizes that serverless environments rely heavily on granular permission models. Attacks involving compromised APIs often succeed because functions are granted excessive privileges.

Option D is correct because enforcing function-level permissions and the principle of least privilege directly limits what a compromised function can execute. CEH documentation states this is the primary defense against serverless abuse.

Option A is beneficial but reactive.

Option B focuses on SaaS governance rather than FaaS execution control.

Option C provides visibility but does not directly prevent privilege misuse.

CEH highlights identity and access management (IAM) as critical in serverless security.

CEH v13 explains that multi-vector DDoS attacks, especially those combining volumetric reflection (DNS amplification) with application-layer exhaustion (Slowloris), require multi-layered mitigation. Standard firewalls and IPS devices cannot handle large-scale distributed attacks without causing collateral damage to legitimate traffic. CEH emphasizes the need for hybrid DDoS protection, combining on-premises appliances for real-time local filtering with cloud-based scrubbing centers capable of absorbing massive volumetric floods. Cloud scrubbing removes malicious traffic upstream, while on-prem devices mitigate application-layer anomalies. Increasing bandwidth (Option A) is ineffective against reflection attacks. IPS (Option B) cannot handle Slowloris-style partial requests at scale. Blocking all external DNS/HTTP (Option C) would deny service to legitimate users. The correct CEH-aligned solution is hybrid DDoS mitigation services.

The correct answer is Checks for outdated versions of over 1,250 servers. In CEH vulnerability assessment coverage, Nessus Essentials is presented as a vulnerability scanning solution that can assess a wide variety of technologies, including operating systems, web servers, databases, network devices, and virtualized environments. Its core role is identifying weaknesses, missing patches, insecure configurations, and exposure conditions across supported platforms. The option about checking outdated versions across a very broad range of server technologies best reflects that scanner-oriented capability. Patch management is not the primary function of Nessus Essentials, because it identifies vulnerabilities rather than directly managing patch deployment. Agent-based detection may be used in some security products, but that is not the defining capability highlighted in this CEH-style framing. High-speed asset discovery is a feature associated more strongly with specialized discovery platforms, whereas Nessus is centered on vulnerability enumeration and assessment. CEH study material emphasizes understanding the purpose of common security tools, and Nessus is generally classified as a scanner that detects outdated software versions and known vulnerabilities so remediation can be prioritized across the environment. That is why option B is the most accurate fit.

CEH v13 highlights behavioral analytics as one of the most effective techniques for identifying ambiguous or stealthy threats such as data exfiltration, command-and-control traffic, and insider abuse. When interactions appear suspicious but not definitively malicious, behavioral profiling provides the most direct visibility.

Behavioral analytics tools establish a baseline of normal system and network behavior, including typical communication patterns, data transfer volumes, destinations, and timing. Deviations from this baseline trigger alerts, allowing analysts to detect previously unknown threats without relying on signatures.

Option C is the most appropriate because it both identifies anomalies and supports continuous mitigation. A full zero-trust shutdown (Option A) is disruptive. Forensics (Option B) is reactive and better suited after confirmation of compromise. Training (Option D) does not address system-level interactions.

CEH v13 emphasizes that modern attacks often blend into normal traffic, making behavioral analysis essential. Therefore, Option C is the correct answer.

This scenario clearly indicates a SYN Flood attack, a classic Denial-of-Service technique discussed in CEH v13 Network and Perimeter Hacking. In a normal TCP three-way handshake, a client sends a SYN, the server responds with SYN-ACK, and the client completes the connection with an ACK. In a SYN flood, attackers send a massive number of SYN packets but never complete the handshake.

As described in CEH v13, the server allocates memory and resources for each half-open connection, placing them in the SYN_RECEIVED state. When these connections are not finalized, the server’s connection table becomes saturated, preventing legitimate users from establishing new sessions.

Other options are incorrect:

Smurf attacks rely on ICMP amplification, not TCP handshakes.

Ping of Death uses malformed ICMP packets.

UDP Floods overwhelm ports using UDP, not TCP session states.

CEH v13 emphasizes SYN floods as one of the most common Layer 4 DoS attacks due to their simplicity and effectiveness.

CEH v13 details the standard penetration testing workflow, where confirmed critical vulnerabilities—especially those affecting core systems like database servers—should be prioritized for exploitation only after verification and when explicitly permitted by the rules of engagement. Exploiting a known vulnerability using vetted tools (e.g., Metasploit, CVE-specific exploits) provides evidence of real-world risk and validates the severity rating. Brute-forcing logins (Option B) is inefficient and often outside scope. Ignoring a critical vulnerability (Option C) violates CEH’s prioritization guidelines. A DoS attack (Option D) is never appropriate unless the engagement explicitly authorizes destructive testing, which is rare. CEH stresses that high-impact vulnerabilities should be exploited to demonstrate business risk, privilege escalation potential, data exposure, or lateral movement possibilities—making Option A fully aligned with CEH methodology.

The correct answer is Clone Phishing. CEH social engineering material explains that clone phishing occurs when an attacker takes a legitimate message previously received by the victim, duplicates its appearance and content, and modifies a malicious element such as a link or attachment. That matches this scenario exactly: the attacker reused genuine branding, the original format, sender display style, and subject line, then changed the embedded hyperlink so users would reauthenticate on a fake portal. Consent phishing is a different cloud-focused technique involving malicious OAuth authorization requests. Search engine phishing relies on manipulating search results so victims voluntarily navigate to a fake site. Tabnabbing involves changing the content of an inactive browser tab to a phishing page. None of those fit as closely as clone phishing. CEH guidance stresses that clone phishing is highly convincing because the message is based on a real prior communication that the victim may remember and trust. Since the attacker preserved almost everything from a legitimate message and altered only the actionable malicious link, the scenario is a textbook example of Clone Phishing.

CEH training emphasizes that mobile applications frequently mishandle local storage, leaving sensitive data such as tokens, passwords, API keys, or personal information unencrypted within SQLite databases, shared preferences, or flat-file storage. When encryption is absent or improperly implemented, attackers can directly access this data through filesystem extraction, Android Debug Bridge (ADB) access, physical device access, or rooted environments. CEH identifies “Insecure Data Storage” as one of the most critical mobile vulnerabilities because it bypasses server-side defenses entirely. Since the vulnerability specifically concerns data at rest, the most direct and effective exploitation method is to retrieve the locally stored unencrypted data. SQL injection (Option B) evaluates backend security, not device storage. XSS (Option C) is a web attack and unrelated to local encryption. Brute-forcing credentials (Option D) is unnecessary when sensitive information is already stored insecurely. Therefore, accessing local storage is the correct exploitation method.

The correct answer is C. Identify and evaluate current practices. In CEH-aligned security assessment concepts, a security audit/review is used to verify whether security policies and procedures are in place and being followed. If documented policies do not exist, the ethical hacker or auditor should not stop the audit or create policies during testing, because policy creation is a management/governance responsibility, not an assessor’s role. Instead, the assessor should identify the organization’s current practices, actual controls, informal procedures, and operational behavior, then evaluate them against accepted standards, baselines, legal requirements, and security best practices. CEH material also emphasizes that information security policies are a fundamental component of the security infrastructure and define requirements, rules, and controls for protecting organizational resources. The absence of policies should be documented as a finding, but the review can still continue by assessing what is currently being done in practice. Increasing testing does not address the governance gap. Thus, the best course is to identify and evaluate current practices.

The correct answer is B. Second-Order SQL Injection.

A second-order SQL injection occurs when malicious input is first stored by the application and then later used unsafely in a database query. The attack does not necessarily execute at the moment the input is submitted. Instead, it triggers later when another function, background job, report generator, or business process retrieves the stored value and incorporates it into a dynamic SQL statement.

The scenario precisely describes this pattern: the template value is accepted and stored, no immediate disruption occurs, and only days later a scheduled reporting process uses that stored value to dynamically construct a query. The resulting dataset includes records beyond the expected scope, indicating SQL injection during later query execution.

CEH web application material explains that SQL injection relies on inserting malicious code or script into existing SQL queries to reveal or manipulate database data . It also classifies SQL injection attacks and explains that in-band, error-based, inferential, and out-of-band SQL injection depend on how the injection is executed and how results are observed . In this case, the defining feature is not an error message or appended immediate query; it is the delayed execution of stored input, which identifies it as second-order SQL injection.

Option A. Stored Procedure Injection is incorrect because stored procedure injection targets database stored procedures or abuses procedure execution. The scenario describes stored user input later used in dynamic reporting queries, not direct stored procedure abuse.

Option C. Error-Based SQL Injection is incorrect because error-based SQL injection depends on database error messages revealing information. No database error messages are described.

Option D. Piggybacked Query Injection is incorrect because piggybacking means appending an additional malicious query to a legitimate query in the same immediate execution context. The scenario emphasizes delayed execution from stored input.

Therefore, the best answer is B. Second-Order SQL Injection.

The correct answer is B, It replaces legitimate programs. A rootkit is malicious software used after compromise to hide the attacker’s presence, maintain privileged access, and avoid detection. CEH-aligned material describes rootkits as tools that obscure system compromise by replacing or substituting administrator utilities with modified versions that hide malicious activity. Linux rootkit material also states that rootkits contain replacement executables for critical operating system components, used to hide evidence and provide backdoor access. Therefore, among the options, replacing legitimate programs is the best match. Option A describes a backdoor concept more generally. Option C describes a vulnerability/exploitation condition, not a rootkit’s purpose. Option D may describe one possible backdoor behavior, but it is not the primary rootkit objective. Rootkits commonly hide files, processes, registry entries, logs, and malicious services, making detection and removal difficult.

The correct answer is D. aireplay-ng.

The scenario describes transmitting crafted wireless frames to interrupt active client connections so that the clients reconnect and generate fresh authentication handshakes. In the Aircrack-ng suite, aireplay-ng is the component used for packet injection and deauthentication-style attacks.

The referenced wireless testing material shows aireplay-ng being used to force client deauthentication during a handshake capture workflow, while airodump-ng is used to capture traffic, airmon-ng is used to enable monitor mode, and aircrack-ng is used later for cracking captured handshakes or keys .

Option A. airodump-ng is incorrect because it captures and monitors wireless traffic.

Option B. airmon-ng is incorrect because it places the wireless adapter into monitor mode.

Option C. aircrack-ng is incorrect because it performs the cracking phase after useful capture material has been collected.

Option D. aireplay-ng is correct because it injects frames, including deauthentication frames, to stimulate handshake capture.

Therefore, the best answer is D. aireplay-ng.

A Rogue DHCP Server attack best fits the symptoms because it directly explains unexpected gateway changes, IP conflicts, and traffic redirection to deceptive portals. In CEH network attack coverage, DHCP is a foundational service that automatically provides clients with IP configuration such as IP address, subnet mask, default gateway, and DNS servers. If an attacker introduces a rogue DHCP server on the same broadcast domain, clients may accept leases from the rogue server—especially if it responds faster than the legitimate DHCP infrastructure. Once that happens, the attacker can push a malicious default gateway or DNS server to victims. This allows redirection of traffic, man-in-the-middle positioning, and phishing-style interception, which matches the “unfamiliar gateway settings” and “misleading login portals” described.

The mention of “temporary IP address conflicts” also aligns: a rogue server can hand out addresses that overlap with legitimate allocations, causing intermittent connectivity issues and failed connection attempts. While a DHCP starvation attack can create disruption by exhausting the DHCP pool, the key difference is outcome: starvation primarily denies service until a rogue server takes over. Here, the defining observable behavior is not just outage—it is misconfiguration and redirection, which points to the presence of a rogue DHCP server actively issuing malicious leases.

Packet sniffing alone would not change gateway settings, and MAC flooding is aimed at forcing switches to behave like hubs, not issuing IP configuration. Defensive controls include DHCP snooping, port security, network segmentation, and monitoring for unauthorized DHCP offers and anomalous lease patterns.

The risk described is increased attack surface caused by unnecessary services and protocols running on a web server—specifically NetBIOS and SMB. The most direct hardening action to mitigate this is to block/disable unnecessary ports and protocols so they are not exposed to the network and cannot be abused by attackers. Option D captures that principle: reduce exposure by closing ports and restricting protocols that are not required for the server’s role.

A well-hardened web server should run only the services needed to deliver its intended web functionality (e.g., HTTP/HTTPS and necessary management interfaces under strict control). Services like SMB (commonly TCP 445/139) and NetBIOS (UDP 137/138, TCP 139) are not normally required for public-facing web hosting and are frequent targets for enumeration and exploitation. Leaving such services open can enable attackers to perform credential attacks, exploit legacy vulnerabilities, access shared resources, or pivot further into the environment. By blocking or disabling these ports at the host firewall and/or perimeter firewall, the organization reduces reachable attack paths and limits what an external attacker can interact with.

Why the other options are less direct:

Dedicated machine (A) can help separation of duties, but if unnecessary services still run, the attack surface remains.

Risk assessment for patching (B) is important, but it doesn’t immediately remove the exposure created by unneeded services.

Eliminating unnecessary files (C) addresses file-system exposure, not open network services like SMB/NetBIOS.

Because the problem is explicitly about unnecessary open services/protocols, the best mitigation is D. Block all unnecessary ports, ICMP traffic, and protocols (i.e., minimize exposed services).

The attackers described are most consistent with black hat hackers because their actions are clearly unauthorized, intentionally harmful, and motivated by financial gain. They compromise a financial institution, deploy credential-stealing malware, exfiltrate customer account data, and then sell the stolen information on underground forums. This aligns with criminal hacking behavior: monetizing access and stolen data through illicit marketplaces, fraud, and repeated targeting of similar victims.

The scenario explicitly rules out ideologically motivated activity: “no political or social statements are made.” That makes hacktivists unlikely, since hacktivism typically involves a political, social, or ideological motive and often seeks publicity for a cause (defacements, leaks, DDoS protests). It also rules out ethical categories: white hat hackers operate with authorization and report findings to improve security rather than steal and sell credentials. Script kiddies are generally low-skill attackers who rely on existing tools and scripts; while they can cause harm, the scenario highlights sustained targeting, credential theft, and underground monetization—behavior more strongly associated with organized cybercriminals/black hats.

Black hats typically pursue objectives like theft of credentials, financial fraud, ransomware deployment, and sale of access or data. Their operations often emphasize anonymity, operational security, and repeatability across many similar targets—consistent with “continuing to target similar organizations for financial gain.”

Therefore, the most likely category is A. Black Hat hackers.

The scenario describes an authentication endpoint that allows a high volume of repeated login attempts with no additional friction, enabling automated scripts to rapidly try large password lists. This is typical of online password guessing and credential stuffing/brute-force style automation. The countermeasure being requested is explicitly one that “forces interaction steps designed to disrupt automation,” which best matches CAPTCHA. CAPTCHA mechanisms introduce a challenge-response test intended to distinguish humans from automated bots, thereby reducing the effectiveness of scripted, high-rate credential attempts.

CAPTCHA is commonly deployed on login and registration pages (and sometimes on password reset flows) to slow down or block automated abuse. When triggered—often after a threshold of failed attempts or suspicious behavior—it forces the requester to complete an interactive step (image selection, puzzle, checkbox with behavioral analysis, etc.). This breaks fully automated attack loops and increases the attacker’s cost, especially when combined with additional controls such as account lockout thresholds, IP reputation, device fingerprinting, and rate limiting.

Why the other options are less aligned to the “disrupt automation” requirement:

Strong hashing algorithms (A) protect stored passwords at rest (e.g., if a database is compromised). They do not directly stop online automated login attempts.

2FA/MFA (B) is excellent for reducing account takeover impact, but it does not inherently prevent high-volume credential submissions; it adds a second factor after correct credentials are provided. Also, the question’s wording strongly points to a bot-disruption interaction step.

Forced periodic password changes (D) is not a primary control for stopping automated login attempts and can introduce usability issues; it does not directly add friction to repeated submissions.

Therefore, the most appropriate countermeasure described is C. Use CAPTCHA challenges on login and registration pages.

CEH identifies brute-force cryptanalysis as a method in which an attacker systematically tests every possible key, password, or passphrase until the correct one is found. When an attacker obtains initial bytes from an encrypted container—often referred to as known plaintext—they can use this to validate attempts as the tool iterates through candidate keys. Automated brute-force tools compare decrypted results with known header patterns, file signatures, or expected byte structures to determine when the correct key is reached. This process aligns precisely with brute-force password testing described in CEH cryptography modules. Quantum solving is not part of CEH scope, digest comparison relates to collision attacks, and analyzing output length pertains to padding oracle detection. The correct classification is automated brute-force cryptanalysis.

The CEH IoT and APT Threat modules describe APT groups as highly skilled adversaries that favor stealth, persistence, and advanced exploitation techniques. IoT environments are particularly attractive due to:

Limited monitoring

Infrequent firmware updates

Weak or proprietary security mechanisms

CEH highlights that APT actors often exploit zero-day vulnerabilities in firmware to gain long-term, covert access to IoT systems. Firmware-level exploitation allows attackers to maintain persistence while evading traditional security controls.

Option C is correct.

Option A is noisy and short-term.

Option B is common but less sophisticated for APTs.

Option D is possible but secondary compared to firmware exploitation.

CEH emphasizes firmware security as a critical concern in IoT deployments.

The correct answer is C because LSASS, or Local Security Authority Subsystem Service, is a Windows process responsible for authentication-related operations. CEH system-hacking concepts associate LSASS access with attempts to extract credentials, password hashes, cached logon data, and Kerberos tickets from memory. The referenced CEH-aligned guide explains that Windows stores password hashes in memory while a user is logged on and that these hashes are loaded into LSASS, which is responsible for user authentication. It also notes that tools such as Mimikatz can extract plaintext passwords, hashes, PINs, and Kerberos tickets from memory. Red-team material similarly links LSASS process dumping and Mimikatz analysis with extracting information from memory. Therefore, unknown processes accessing LSASS memory strongly indicate credential dumping. SQLi and XSS are web application attacks, and DoS targets availability, not authentication secrets.

The attack described is spear phishing because it is a targeted phishing attempt crafted for a specific individual using personal and organizational context. In CEH social engineering coverage, spear phishing differs from generic phishing by its customization: the attacker addresses the victim by name, references the victim’s job function, and tailors the message to create credibility and urgency. Here, the email is addressed specifically to Clara and mentions her role in the accounts team, which increases the likelihood she will trust the message and comply.

The message uses classic phishing psychological triggers emphasized in CEH materials: urgency and fear. By claiming a “critical system vulnerability” and threatening account suspension, the attacker pressures Clara to act quickly and ignore verification steps. The inclusion of a link to a login page that “resembles the company’s internal portal” indicates credential harvesting, where the attacker’s goal is to capture usernames and passwords or other authentication tokens. The subtle misspelling in the sender’s domain is a common indicator of lookalike or typosquatting domains used to mimic legitimate corporate email addresses and bypass casual inspection.

The other options do not match as well. Impersonation is a broader category, but spear phishing is the specific technique using an email lure with personalization. Quid pro quo involves offering a benefit or service in exchange for information, which is not present. Vishing is voice-based phishing via phone calls, not email. Recommended defenses in CEH guidance include verifying sender domains, using out-of-band confirmation with IT, enabling email security controls like SPF, DKIM, and DMARC, and enforcing phishing awareness training and MFA to reduce credential theft impact.

The observed characteristics point most strongly to WPA2 because the scenario explicitly identifies CCMP-like headers and AES-based encryption, along with replay protection using a packet number (PN) and the familiar four-way handshake. WPA2 (based on IEEE 802.11i) replaced older approaches that relied on RC4 and TKIP, introducing AES-CCMP as the standard data confidentiality and integrity mechanism for Wi-Fi protected networks. CCMP uses AES in a mode designed for wireless frames and includes a per-packet number to prevent replay attacks.

The mention that these features were “introduced to replace older TKIP/RC4 approaches” is a major clue. Original WPA was designed as a transitional upgrade over WEP and commonly used TKIP with RC4, whereas WPA2 standardized the stronger AES-CCMP mechanism. The four-way handshake is used to derive and install fresh session keys (pairwise transient keys) between the client and access point, and the packet number increases with each encrypted frame to provide replay protection and maintain encryption correctness.

Why the other options don’t fit as well:

WEP (D) uses RC4 with weak IV handling and lacks the robust key management and handshake properties described.

WPA (B) typically centers on TKIP/RC4 rather than AES-CCMP as the defining feature set, especially in CEH-style distinctions.

WPA3 (C) introduces improvements such as SAE (Simultaneous Authentication of Equals) replacing the legacy PSK handshake method in WPA2-Personal, and enhanced protections (e.g., stronger password-based authentication). While WPA3 can still use AES-based encryption, the scenario’s emphasis is on CCMP/AES replacing TKIP/RC4—most directly the WPA2 shift.

Therefore, the access point is most likely using A. WPA2.

According to the CEH Cryptography module, strong symmetric encryption algorithms are essential for protecting data confidentiality and obscuring traffic content.

AES (Advanced Encryption Standard) is the industry-standard symmetric encryption algorithm approved by NIST and recommended by CEH for encrypting data in transit and at rest. AES provides strong resistance against cryptanalysis and prevents attackers from deriving meaningful information from encrypted traffic.

Option D is correct because AES is efficient, secure, and widely implemented.

Option A (HMAC) provides integrity and authentication, not encryption.

Option B (RSA) is computationally expensive and not suitable for bulk traffic encryption.

Option C (DES) is deprecated due to weak key length.

CEH materials clearly recommend AES over legacy algorithms.

A polymorphic virus is specifically designed to change its code appearance while keeping the same underlying functionality, which aligns exactly with the scenario. In CEH terms, polymorphism allows malware to mutate its decryptor routine, instruction ordering, register usage, junk code insertion, and other syntactic elements every time it propagates or executes. This causes each instance to look different at the binary level, producing different hashes and signatures, even though the malicious payload and behavior remain the same. That is why the security team sees inconsistent antivirus detection and why “traditional hash-based comparison” fails. The key indicator is that static analysis shows the “underlying logic remains unchanged,” but “code patterns vary unpredictably,” which is the hallmark of polymorphism: behavior stays consistent, signature changes.

The other options do not fit as well. A cavity virus typically hides by inserting itself into unused spaces within legitimate executable files to avoid changing the overall file size, but it does not inherently generate unpredictable code variants per infection. A macro virus primarily targets macro-enabled documents and spreads through document templates and user actions, which is not suggested here. A stealth virus focuses on evading detection by intercepting system calls and hiding its presence, such as returning “clean” file reads, but it does not necessarily produce many structurally different binaries that break hash matching. Therefore, the most likely cause of the described outbreak is a polymorphic virus.

The correct answer is B because an ACK scan is mainly used to determine firewall filtering rules, not to identify services or directly confirm open and closed ports. In CEH scanning methodology, an ACK scan sends TCP packets with only the ACK flag set and analyzes how the target or intermediate firewall responds. CEH material states that ACK probe scanning helps identify filtering systems: if an RST packet is returned, packets to that port are not being filtered; if there is no response, a stateful firewall is likely filtering the packet. Another CEH exam-focused reference similarly notes that ACK probes check filtering at the remote end; no response indicates a stateful firewall between the attacker and host, while an RST response indicates there is not. Services are better identified through version detection or banner grabbing, while open ports are commonly identified with SYN or TCP connect scans. Therefore, the best CEH answer is firewall rules.

Client-side controls, such as JavaScript validation and CAPTCHA enforcement, are explicitly described in CEH v13 as inherently untrustworthy, since they run on the user’s device. The most effective way to bypass them is by intercepting and modifying HTTP requests after client-side validation but before server-side processing.

Using a proxy tool (such as Burp Suite) allows the tester to manipulate parameters invisibly, without disabling JavaScript or injecting code that could raise alarms. This makes Option B the most stealthy and effective method.

Disabling JavaScript (Option A) is noisy and easily detected. Injecting JavaScript (Option C) may trigger client-side protections. Reverse-engineering encryption (Option D) is complex and unnecessary.

CEH v13 emphasizes proxy-based manipulation as the preferred technique for bypassing client-side security mechanisms. Therefore, Option B is correct.

Colasoft Packet Builder is specifically designed for creating and editing custom packets, making it the best match for a scenario where the tester “crafts custom network packets” and “carefully designs their headers” to test or evade firewall filtering. In CEH methodology, packet crafting is a common technique used to validate how filtering devices respond to unusual or borderline traffic patterns, including altered TCP flags, manipulated fragmentation behavior, spoofed fields, and protocol edge cases. A packet builder tool enables precise control over Layer 2 through Layer 4 fields and, in many cases, supports building application payloads as well. This supports testing for weaknesses such as overly permissive rules, inconsistent state handling, improper reassembly, and inadequate normalization that could allow malicious traffic to pass.

Metasploit is primarily an exploitation framework used to deliver payloads and run modules after targets and weaknesses are identified. While it can generate traffic, it is not the most direct tool for low-level, manual header crafting as described. Nmap is mainly used for host discovery, port scanning, service detection, and scripting-based enumeration; it can manipulate some packet characteristics, but its core purpose is not interactive custom packet construction. Traffic IQ Professional is typically associated with network analysis and traffic monitoring rather than crafting bespoke packets to probe firewall rule behavior.

Therefore, the tool most aligned with CEH-style custom packet creation for firewall evasion testing is Colasoft Packet Builder.

The correct answer is D because Telnet is insecure by default. Telnet is an older remote access protocol that provides command-line access to remote systems, but it does not encrypt communication. This means usernames, passwords, commands, and keystrokes can travel across the network in clear text and may be captured through sniffing or man-in-the-middle attacks. The CEH-aligned material specifically states that Telnet sends usernames, passwords, and keystrokes over the network as clear text, making it easy to sniff. HTTPS is secure HTTP over TLS/SSL, SFTP is file transfer protected through SSH, and SSH is a secure replacement for Telnet that uses encryption and commonly operates on TCP port 22. Therefore, compared with HTTPS, SFTP, and SSH, Telnet is the protocol that is insecure by default because confidentiality and secure authentication protection are not built into its normal operation.

The correct answer is Host-based Scanning. CEH vulnerability assessment material explains that host-based scanning focuses on individual systems such as servers, desktops, and workstations, and is intended to discover local security weaknesses including file permissions, registry permissions, patch issues, configuration errors, installed software problems, and operating-system-level exposures. The question explicitly mentions Windows servers and workstations, valid logins to each device, and inspection targets such as registry settings and local file permissions. Those are classic indicators of host-based scanning. Network-based scanning would focus more on exposed network services, listening ports, protocol behavior, and remotely visible vulnerabilities. External scanning is concerned with internet-facing exposure from outside the organization. Application scanning is too narrow because the scenario is not limited to a specific software application but instead covers broad system-level posture. CEH guidance often notes that host-based vulnerability scans may be credentialed so the scanner can inspect the internal configuration of each machine in detail. Because the assessment is centered on system-specific misconfigurations and local security settings across endpoints and servers, host-based scanning is the best classification.

The correct answer is External Scanning. CEH vulnerability assessment material explains that external scanning evaluates the systems, services, and exposures visible to parties outside the organization, typically from the perspective of an internet-based attacker. In this scenario, the consultants are reviewing infrastructure reachable through publicly registered domain records, identifying open ports on exposed servers, checking for outdated components, and reviewing DNS information that is visible to remote systems. Those activities clearly indicate an external perspective. Network-based scanning is broader and can occur either internally or externally, so it is not the most precise answer here. Internal scanning would assess assets from inside the organization’s environment, and manual scanning would describe the method rather than the exposure perspective. CEH emphasizes that external scans are used to understand the public attack surface, including internet-facing services, exposed applications, open ports, SSL/TLS posture, and domain-related information available to outsiders. Because the engagement is centered on what can be reached and learned from outside the network through public records and exposed hosts, the scan is best classified as External Scanning.

Covert channel communication is one of the most sophisticated evasion techniques described in CEH v13 Evasion Techniques. By embedding malicious data within unused or rarely inspected protocol fields (such as IP headers), attackers can bypass firewalls, IDS, and IPS systems entirely.

Unlike polymorphic malware (Option C), which can still be detected using behavior analysis, covert channels blend seamlessly into legitimate traffic. Packet fragmentation (Option D) is well-known and often mitigated. Honeypot spoofing (Option B) is rare and defensive in nature.

CEH v13 emphasizes that covert channels are difficult because:

They do not violate protocol specifications

They evade signature-based and stateful inspection

They appear as normal traffic

Detecting covert channels often requires deep protocol analysis and statistical traffic inspection, making them extremely challenging to mitigate.

Thus, Option A is the correct answer.

The correct answer is C. Ettercap. Ettercap is a well-known Man-in-the-Middle (MITM) attack framework frequently covered in CEH wireless and network attack concepts. It supports ARP poisoning, traffic interception, packet manipulation, content filtering, and HTTP injection, making it capable of modifying web traffic in transit.

In the scenario, the attacker established a rogue wireless access point and intercepted users ' HTTP traffic. By positioning himself between the victim and the destination website, the attacker could modify the HTTP response and inject malicious HTML code containing a Java applet or script. Ettercap includes filtering capabilities that allow attackers to alter web pages before they reach the victim, making it the most appropriate tool for this attack.

The other options are less suitable. Wireshark and Tcpdump are packet capture and analysis tools used primarily for monitoring network traffic, not for modifying or injecting content. Aircrack-ng focuses on wireless security assessment tasks such as packet capture, wireless reconnaissance, and cracking WEP/WPA keys, but it is not designed for HTTP content injection.

CEH Exam Tip:

Ettercap = MITM + ARP Poisoning + Traffic Manipulation + HTTP/HTML Injection.

The correct answer is B. Impersonation because Rachel’s primary technique is pretending to be a specific, legitimate employee (“Mark Stevens, a senior finance manager”) to induce the HR staffer to disclose or transmit sensitive information. In CEH-aligned social engineering concepts, impersonation is the act of assuming another person’s identity or role—often someone with authority or a believable business need—to gain trust and persuade the target to perform an action they otherwise should not (such as sharing confidential documents, resetting credentials, or bypassing verification steps).

The scenario includes multiple social engineering influence factors commonly emphasized in CEH: authority (claiming to be a senior finance manager and referencing the CFO), urgency (“upcoming presentation” and “urgently needs”), and pressure to reduce the likelihood the staffer follows standard validation procedures. These elements strengthen the impersonation by making the request feel both legitimate and time-sensitive, increasing compliance. The target’s reaction—feeling compelled due to Rachel’s authoritative tone—matches the expected psychological effect of impersonation attacks.

Why the other options are less correct: Vishing (voice phishing) is a delivery channel—social engineering conducted via phone calls. While this interaction occurs over the phone, the question asks for the technique being demonstrated. The defining technique here is the identity deception (impersonation) rather than merely the medium. Quid pro quo involves offering something in exchange (e.g., “I’ll fix your issue if you give me your password”), which is not present. Reverse social engineering involves the attacker creating a problem and positioning themselves as the helper so the victim contacts them; that is not described because Rachel initiates the call and directly requests the document.

Therefore, the most accurate classification of Rachel’s method is Impersonation.

According to the CEH attack methodology, once an attacker obtains initial access—whether through exploitation, misconfiguration, or credential compromise—the next critical phase is privilege escalation. Gaining system-level or administrative control is essential for maintaining persistence, accessing protected data, modifying system configurations, and pivoting further into the network. Privilege escalation exploits target kernel flaws, misconfigured services, improper permission settings, or vulnerable drivers. CEH emphasizes that performing a DoS attack disrupts the engagement and provides no strategic advantage. Similarly, CSRF targets web applications rather than operating systems, and brute-force password attempts are inefficient, noisy, and often ineffective once local access has already been established. By leveraging privilege escalation techniques, the tester converts limited user access into full system control, enabling comprehensive post-exploitation activities aligned with CEH system hacking procedures.

This scenario best illustrates impersonation. In CEH-aligned social engineering concepts, impersonation occurs when an attacker assumes the identity of a legitimate person, such as an employee, contractor, executive, or vendor, to exploit trust and bypass established procedures. Rachel explicitly “poses as a stressed employee named Laura Bennett” and uses a believable workplace pretext such as a slow laptop and a tight deadline. This is a classic pressure-and-urgency tactic used to lower skepticism and push the target into breaking policy, such as skipping identity verification or accepting unsafe troubleshooting steps.

Although the interaction happens over the phone, the defining technique being tested is not merely the communication channel but the identity deception. Vishing is phone-based phishing, and while the call could be described as vishing in a broad sense, the prompt emphasizes the assumed identity and the help desk’s verification controls, which is the hallmark of impersonation. Quid pro quo typically involves offering a benefit or service in exchange for information; here, the core mechanic is Rachel’s false identity and her attempt to get the help desk to accept credential sharing as part of support. Shoulder surfing is unrelated because it involves physically observing someone’s screen or keystrokes.

CEH best practices to mitigate impersonation include strict caller verification, callback procedures to known numbers, ticket validation, prohibiting password sharing, requiring multi-factor authentication resets via approved workflows, and training help desk staff to recognize urgency-based manipulation and escalate suspicious requests.

The correct answer is B. Transforming Query Structure to Evade Pattern-Based Inspection.

The scenario describes a pattern-based security control blocking conventional injection payloads. The tester then changes the request’s format and composition while preserving the intended database action. This is a classic SQL injection/WAF evasion concept: changing how the query looks so that the security control no longer matches the malicious pattern, while the backend database still interprets the request successfully.

CEH-aligned SQL injection material explains that signature-based detection compares input strings against known signatures and that attackers may evade these signatures through techniques such as inline comments, character encoding, string concatenation, obfuscated code, manipulating white spaces, hex encoding, and sophisticated matches .

Option A is incorrect because HTTP Parameter Fragmentation specifically splits payload components across parameters; the scenario does not describe fragmentation.

Option C is incorrect because no combined or integrated multi-method evasion is described.

Option D is incorrect because HTTP Parameter Pollution involves duplicate or conflicting parameters; the scenario does not describe overriding query parameters.

Therefore, the best answer is B. Transforming Query Structure to Evade Pattern-Based Inspection.

This scenario primarily simulates dumpster diving because the key action involves retrieving sensitive information from discarded materials and then using it to gain access. In CEH social engineering coverage, dumpster diving is a physical information-gathering technique where an attacker searches trash, recycling bins, unsecured disposal containers, or shredding waste to find documents and artifacts that can be exploited. Common targets include access codes, employee directories, printed emails, shipping labels, invoices, internal memos, and partially shredded documents—exactly what Priya finds in the unsecured maintenance container. The question even emphasizes “discarded packaging,” “shipping labels,” “shredded office material,” and a “crumpled document listing temporary access codes,” which are classic dumpster-diving indicators.

The later use of recovered access codes to enter the break room is the impact of the dumpster-diving phase, but the primary social engineering technique tested is how improper disposal leads to compromise. Tailgating would involve following an authorized person through a secure door without proper authentication. Eavesdropping refers to listening in on conversations or communications to capture sensitive information. Shoulder surfing involves visually observing someone’s screen or keyboard while they enter credentials or view confidential data. None of those describe the initial method of obtaining the access codes.

CEH-aligned mitigations include enforcing clean-desk and secure disposal policies, using locked disposal bins, shredding sensitive documents properly with secure destruction processes, training staff on handling printed data, and restricting access to loading docks and waste areas. Regular audits of disposal practices and physical security checks reduce the likelihood that attackers can harvest usable access details from trash.

Comprehensive and Detailed Explanation From CEH v13 Guide Topics:

The correct answer is D. nmap -T4 -F 10.10.0.0/24. The objective is to quickly enumerate hosts within the same subnet as the compromised server (10.10.0.5), which belongs to the 10.10.0.0/24 network.

In Nmap, the -F (Fast Scan) option scans only the most commonly used ports instead of the full port range, significantly reducing scan time. Combined with -T4, which increases scan speed through a more aggressive timing template, it is the fastest option among the choices provided for rapidly identifying active systems and services on the subnet.

Option A (-q) does not perform host enumeration and is not a standard Nmap host-discovery optimization. Option B (-O) performs OS detection, which generates additional probes and takes longer than necessary when the goal is simply to identify systems quickly. Option C (-r) scans ports sequentially and targets the wrong subnet (10.10.1.0/24), making it incorrect.

From a CEH reconnaissance and network scanning perspective, when speed is important, security professionals commonly use optimized Nmap scans such as Fast Scan and aggressive timing templates to identify live hosts efficiently before conducting deeper enumeration activities.

The most clearly demonstrated vulnerability is Lack of authentication. In CEH-aligned network device security principles, authentication is the fundamental control that verifies a user or device is permitted to access administrative functions or participate in trusted communications. The scenario states that the router allows external administrative access without requiring a password. That directly indicates that authentication is not being enforced for management access, meaning an unauthorized user could potentially gain administrative control simply by reaching the management interface.

The second observation reinforces the same core weakness in a different context: the router uses a protocol that provides neither encryption nor validation. In CEH terms, “validation” in routing and management protocols commonly refers to authentication and integrity checks, ensuring that updates or communications are sent by trusted peers and not altered in transit. When a protocol lacks validation, an attacker may be able to inject rogue updates, impersonate a trusted neighbor, or manipulate routing behavior, depending on the protocol and topology. While this could also be described as “insecure routing protocols,” the question asks what vulnerability is most clearly present based on both observations together. The common denominator is the absence of authentication controls: no password for admin access and no validation for device-to-device protocol exchanges.

“Lack of password protection” addresses only the first issue and is narrower. “Firewall vulnerabilities” is not evidenced. Therefore, the clearest and most comprehensive vulnerability indicated by the observations is Lack of authentication.

If a system stores passwords in weak or reversible formats, attackers can perform offline cracking. CEH emphasizes dictionary attacks as the fastest and most efficient method to exploit weak hashing practices. This avoids detection and leverages known password patterns to recover plaintext credentials.

The correct answer is A. Activating Dynamic ARP Inspection to validate ARP packets.

The scenario describes a switch discarding ARP replies that do not match known IP-to-MAC and address-to-port bindings. This is the function of Dynamic ARP Inspection (DAI).

CEH-aligned sniffing and ARP defense material states that Dynamic ARP Inspection is used with DHCP snooping, where IP-to-MAC bindings are tracked from DHCP transactions to protect against ARP poisoning. It also notes that DHCP snooping is required to build the MAC-to-IP bindings used for DAI validation . The same material lists the configuration command ip arp inspection vlan < vlan number > and the verification command show ip arp inspection .

Option B is incorrect because displaying the DHCP snooping table only verifies bindings; it does not enforce ARP validation.

Option C is incorrect because DHCP Snooping builds the trusted binding database, but DAI is the feature that validates and drops invalid ARP packets.

Option D is incorrect because BPDU Guard protects spanning-tree edge ports from unexpected BPDUs. It does not validate ARP packets.

Therefore, the best answer is A. Activating Dynamic ARP Inspection to validate ARP packets.

Blowfish is the only option that matches all the technical characteristics described. In CEH cryptography concepts, symmetric algorithms are commonly distinguished by their structure (block cipher versus stream cipher), block size, and supported key lengths. The question states the algorithm encrypts data in 64-bit blocks and supports a variable key size ranging from 32 bits up to 448 bits, and it was introduced as a replacement for DES. Blowfish fits precisely: it is a symmetric block cipher with a 64-bit block size and a configurable key length from 32 to 448 bits, designed to be fast in software and positioned historically as an alternative to older ciphers such as DES.

The other choices do not align with these identifying properties. RC4 is a stream cipher and does not operate on fixed-size blocks, so it cannot match the 64-bit block requirement. AES is a block cipher but uses a 128-bit block size with fixed key sizes of 128, 192, or 256 bits, not 32 to 448 bits. Twofish, while related historically as a successor-era design, also uses a 128-bit block size and fixed key sizes up to 256 bits, so it does not match either.

From a CEH perspective, the mention of variable key sizes also hints at risk evaluation: shorter keys in any cipher can be brute-forced, so secure deployments require strong key length selection and proper key management. Additionally, Blowfish’s 64-bit block size can be a concern in large-volume encryption scenarios due to block collision risks, which is why modern systems often prefer 128-bit block ciphers for new designs.

CEH v13 emphasizes that after identifying vulnerabilities during scanning, testers must validate findings to determine real impact and eliminate false positives. This requires safe, controlled exploitation using approved tools such as Metasploit, Nikto, or custom proof-of-concept scripts. Misconfigurations labeled as medium-risk may still provide privilege escalation, data exposure, or footholds for further attacks. CEH methodology reinforces that exploitation should always follow the scope and rules of engagement and should avoid disruptive activities like brute-forcing or DoS attacks unless explicitly authorized. Ignoring the vulnerabilities is never acceptable in a professional assessment. Verifying the issue helps the organization prioritize remediation using evidence-based results. Therefore, the correct next step is to verify the vulnerability through controlled exploitation.

CEH v13 classifies state-sponsored hackers as highly skilled professionals who operate under government direction to conduct espionage, intelligence gathering, sabotage, or cyber warfare. These attackers often target foreign governments, critical infrastructure, and strategic industries.

The defining characteristics are:

Government backing

National or geopolitical objectives

Advanced resources and long-term campaigns

Options B, C, and D do not fit. Organized hackers are typically financially motivated cybercriminal groups. Gray hats operate without authorization but not for national interests. Hacktivists pursue ideological or political causes independently.

CEH v13 explicitly associates covert intelligence operations with state-sponsored actors, making Option A correct.

In CEH v13 Cloud Computing, multi-tenancy is a core cloud characteristic—but also a major risk if isolation controls are weak. When one tenant’s actions affect others, the issue is almost always insufficient isolation between tenants.

Multi-tenant isolation ensures that compute, storage, memory, and network resources are strictly separated. Without proper isolation, a malicious tenant can:

Exhaust shared resources

Access neighboring virtual machines

Damage the provider’s reputation

Encryption and authentication protect data access but do not stop cross-tenant impact. Logging helps detect incidents but does not prevent them.

CEH v13 emphasizes strong logical isolation mechanisms—such as hypervisor hardening and tenant segmentation—as essential cloud security controls. Therefore, Option C is the correct answer.

A logic bomb is malware or malicious code that is deliberately planted within a system and configured to execute when a specific condition is met, such as a particular date and time, a user action, or the presence or absence of a file. CEH materials describe logic bombs as condition-based triggers that can remain dormant for extended periods, producing minimal indicators until the trigger occurs. The most decisive clue in this scenario is the “scheduled task set to a specific date,” followed by abnormal behavior that appears only after that date passes. This is a textbook trigger mechanism used to activate malicious actions while avoiding early detection.

The “odd email from an unfamiliar source” suggests an initial delivery or social engineering vector, but the core behavior is the delayed activation. The later “faint increase in network activity only after the scheduled date passed” aligns with a logic bomb executing a payload such as beaconing, data exfiltration, or enabling remote access. The “unusual code traces on a dormant workstation” further supports the idea of implanted code that was inactive until triggered.

Fileless malware emphasizes execution in memory using legitimate tools such as PowerShell or WMI and is defined more by its living-off-the-land technique than by a date-based trigger. An APT describes a broader campaign style involving long-term, multi-stage intrusion, not a single defining trigger artifact. Ransomware is characterized by encryption and extortion behavior, which is not described. Therefore, the threat is best characterized as a logic bomb.

The correct answer is C. Analyze Firmware.

The firmware image has already been obtained. The tester is now inspecting the binary to understand its format, architecture, readable strings, and low-level structure. This is part of the Analyze Firmware stage.

The referenced firmware analysis material lists commands such as file < bin > , strings, strings -n5 < bin > , strings -tx < bin > , binwalk < bin > , and hexdump -C < bin > as firmware analysis activities used to inspect firmware content and structure .

Option A. Extract the Filesystem is incorrect because filesystem extraction would involve extracting embedded filesystems from the firmware image, commonly with tools such as binwalk -e.

Option B. Obtain Firmware is incorrect because the question states that the tester already received the firmware image.

Option D. Emulate Firmware is incorrect because emulation involves running or simulating the firmware environment, which has not yet occurred.

Therefore, the best answer is C. Analyze Firmware.

The correct answer is D. Obtain written permission to hack. In CEH methodology, the ethical difference between a hacker and an ethical hacker is authorization. Before any testing, scanning, exploitation, or information gathering begins, the ethical hacker must have written approval from the system owner. The CEH-aligned penetration testing lifecycle places rules of engagement, customer requirements, scope definition, legal agreements, contracts, and NDAs in the pre-attack or preparation phase before active testing begins. Written permission defines what systems may be tested, which techniques are allowed, when testing may occur, who must be notified, and what liability protections apply. Verbal permission is not sufficient because it is difficult to prove and may not clearly define legal boundaries. Hacking the web server before permission would be unauthorized activity, and gathering target information before approval may also violate scope and legal requirements. Therefore, the most important pre-assessment action is to obtain written authorization. CEH exam guidance also emphasizes that an ethical hacker always obtains written permission before testing.

The CEH SQL Injection module defines stacked (piggybacked) queries as attacks where an attacker appends an additional SQL statement using a statement delimiter such as a semicolon.

In this scenario, the attacker executed a second query (DROP TABLE users) after the original query, resulting in destructive behavior.

Option B is correct.

Option A retrieves data, not execute destructive commands.

Option C infers logic outcomes.

Option D relies on error messages for data extraction.

CEH classifies stacked queries as high-impact SQL injection attacks.

The correct answer is C. Applying Root Guard on designated interfaces.

The scenario describes an unauthorized or unintended device sending superior spanning-tree information that influences root bridge selection. Root Guard is specifically designed to prevent a port from accepting superior BPDUs that could cause an unauthorized switch to become the root bridge or alter the intended Layer 2 topology.

A related switching reference states that Root Guard on aggregation switch downlinks ensures that access switches cannot send superior BPDUs to challenge the aggregation switch’s root status, thereby maintaining predictable STP root placement .

Option A. Loop Guard is incorrect because Loop Guard protects against missing BPDUs and loop conditions, not unauthorized superior BPDUs attempting to influence root election.

Option B. BPDU Guard is useful on PortFast/edge ports because it disables a port when any BPDU is received. However, the question specifically focuses on preserving root selection and preventing superior bridge-priority information from changing the STP hierarchy, which is the purpose of Root Guard.

Option D. UDLD is incorrect because UDLD detects unidirectional link failures, not malicious or unintended STP root manipulation.

Therefore, the best answer is C. Applying Root Guard on designated interfaces.

The described bypass is most consistent with using an in-line comment technique. Many simplistic SQL injection filters look for specific “blocked” keywords such as SELECT, UNION, OR, or DROP as contiguous strings. If the tester breaks a keyword apart by inserting tokens the database will ignore—most commonly comment delimiters—the filter may fail to match the forbidden keyword, while the SQL parser still reconstructs the intended meaning. For example, inserting comment markers inside a keyword can cause the application-layer filter to miss the pattern, yet the database can still process the statement depending on the DBMS and parsing rules. This is why comment-based obfuscation is a common SQLi evasion approach against weak signature filters.

The scenario’s wording “broken apart with unexpected symbols” maps well to comment markers such as /**/ (or other DBMS-specific comment forms). These characters look “unexpected” to a naïve filter, but to the SQL engine they are treated as comments/whitespace and effectively ignored during parsing, allowing the attacker’s intended keyword to be interpreted correctly.

Why the other options are less aligned:

String concatenation (A) is an obfuscation approach where attackers build keywords/strings using concatenation operators or functions (DBMS-specific). The scenario emphasizes splitting keywords with symbols that the DB interprets correctly as separators/ignored content, which more directly matches comment insertion.

Hex encoding (B) encodes parts of a payload (strings, sometimes function names) in hexadecimal form. That is a different technique than splitting keywords with inserted symbols.

Null byte (D) is historically used to terminate strings in certain contexts (more common in older file/path handling bugs) and is not the primary technique for bypassing keyword filters in modern SQL parsing.

Therefore, the SQL injection evasion technique is C. In-line Comment.

The requirements map most directly to WPA3, because WPA3-Personal replaces the legacy WPA2-PSK handshake with SAE (Simultaneous Authentication of Equals). SAE is designed to resist offline dictionary attacks: even if an attacker captures the handshake, they cannot simply take it offline and test password guesses at high speed the way they can with WPA2-PSK handshakes. This directly addresses management’s concern that a captured handshake plus a weak passphrase could enable offline cracking and eventual session key recovery.

WPA3 also strengthens per-session protection by improving how keys are established and by supporting stronger cryptographic defaults. In enterprise contexts, WPA3 aligns with stronger authentication and encryption suites, and in IoT scenarios it supports modern onboarding and improved security posture compared to older WPA2/TKIP-era configurations. The “per-session encryption” and “stronger protection” goals are consistent with WPA3’s modern design focus.

Why the other options are less suitable:

MAC address filtering (A) is not a security control against credential capture or offline attacks; MACs are easily spoofed and do not provide cryptographic protection.

802.1X authentication (B) (WPA2/WPA3-Enterprise) is very strong and removes reliance on a single shared PSK by using per-user/device credentials and dynamic keys. However, the question’s key requirement explicitly calls out preventing offline dictionary attacks even if a handshake is captured—this is most directly the hallmark improvement of WPA3-Personal (SAE). (In practice, WPA3-Enterprise with 802.1X is also excellent, but “upgrade to WPA3” is the single best match to the stated offline dictionary concern.)

Disabling TKIP (D) is good hygiene (prefer AES/CCMP), but it does not prevent WPA2-PSK handshake capture and offline cracking if PSK is used.

Therefore, the best measure to meet the stated modernization goals is C. Upgrade to WPA3.

The correct answer is C because using Java Random() for session tokens can create predictable tokens. Session tokens must be unpredictable because they identify authenticated user sessions. In CEH web application and session hijacking concepts, weak or simple session IDs allow attackers to guess or brute-force valid IDs and gain unauthorized access to the target application. CEH session hijacking material also explains that attackers may predict session IDs by observing currently used tokens, identifying constant and variable parts, and guessing the next token. Java Random() is a general-purpose pseudorandom generator, not a cryptographically secure random number generator, so it should not be used for authentication tokens. The secure approach is to generate long, complex, random session IDs and regenerate them after authentication or privilege changes. This is not session fixation, where an attacker forces a known session ID on a victim; not XSS, which injects browser-side scripts; and not CSRF, which abuses a victim’s authenticated browser actions.

The CEH IDS/IPS Evasion module describes packet fragmentation as a common evasion technique used to bypass signature-based detection.

Option B is correct.

Other options represent different attack categories.

CEH highlights reassembly normalization as a countermeasure.

The correct answer is C. Whois lookup because the scenario describes retrieving publicly available domain registration records using an online service without directly interacting with the target organization’s infrastructure. In CEH-aligned reconnaissance (footprinting) techniques, WHOIS is a foundational passive information-gathering method used to identify details tied to a domain name, such as the registrant/organization, administrative and technical contacts, registration and expiration dates, and the authoritative name servers associated with the domain. These details are commonly used to establish ownership context, map the organization’s external footprint, and identify potential points of contact for administrative or security coordination.

The prompt emphasizes that the ethical hacker wants “details about the organization’s domain ownership” and “points of contact.” That is precisely the kind of information WHOIS is intended to provide. It also explicitly notes “without direct interaction with the target,” which aligns with WHOIS being passive: queries are made to registries/registrars or WHOIS aggregation services rather than probing the target’s servers.

Why the other options are less correct: Email footprinting focuses on collecting email addresses, formats, mail servers, and potentially related metadata, but it is not the primary method for domain ownership/registrant contact records. Network footprinting is broader and often involves identifying IP ranges, network blocks, technologies, and topology—potentially including active probing. DNS interrogation (such as querying A, MX, NS, TXT records) can reveal technical DNS data and infrastructure mapping, but it typically does not provide the domain’s registrant ownership details and formal contact records; that role is handled by WHOIS and registry data.

Therefore, the method most likely used here is a WHOIS lookup to obtain public domain registration and contact information.

The highest-priority proactive control “to embed into the organization’s development lifecycle” is including quantum-resistance checks in the SDLC and code review processes. The scenario emphasizes a company-wide, long-term risk reduction strategy while development continues on a major refactor. In that context, the most scalable and durable control is governance and engineering hygiene: ensuring that new features and refactored components do not reintroduce weak or legacy cryptography and that teams consistently select algorithms and key sizes aligned with modern guidance and future migration plans.

Embedding checks into the SDLC means instituting standards and guardrails such as approved cryptographic libraries, banned algorithm lists (e.g., legacy RSA key sizes, deprecated curves, weak hashes), cryptography design reviews, automated dependency scanning for crypto usage, and CI/CD policy gates that flag noncompliant implementations. This approach reduces “crypto sprawl,” prevents new technical debt, and creates a structured path to transition toward post-quantum or quantum-resistant approaches as the organization modernizes systems.

Why the other choices are not the best “highest priority” SDLC-embedded control:

Encrypt stored data with quantum-resistant algorithms (B) may be appropriate for protecting long-lived sensitive data (“harvest now, decrypt later”), but it is a targeted technical control and may not be feasible immediately across many services during refactoring. It also does not by itself prevent developers from continuing to implement legacy public-key schemes elsewhere.

Quantum-specific firewalls (C) is not a realistic or standard control for post-quantum readiness in typical enterprise environments.

Fragmenting data across locations (D) can help resilience/confidentiality in some designs but does not address the core issue: preventing continued reliance on weak public-key cryptography.

Therefore, the best answer is A. Include quantum-resistance checks in SDLC and code review processes.

This scenario is a classic session fixation attack. In session fixation, the attacker sets or “fixes” a known session identifier (session ID) for the victim before the victim authenticates. The attacker then persuades the victim to use that predetermined session—often by embedding the session ID into a URL, link, or cookie setting mechanism. Once the victim logs in, the application incorrectly continues using the same session ID (rather than issuing a new one upon authentication). As a result, the attacker can reuse that known session ID to access the victim’s authenticated session context.

The described sequence matches session fixation exactly: James first crafts a session and obtains a session ID, then shares it with the victim via a link, the victim clicks and logs in, and “their activity is bound to the attacker’s pre-assigned session.” Later, James accesses the session and retrieves the victim’s input—demonstrating that authentication was tied to an attacker-controlled session token.

Why the other options do not fit:

Session replay (B) involves capturing a valid session token (e.g., via sniffing, XSS, or leakage) and replaying it, but it does not require pre-setting the token before the victim logs in.

Session prediction (C) is about guessing or calculating valid session IDs due to weak randomness. Here the attacker does not guess; he deliberately provides a session ID he already controls.

“Session donation (A)” is not the standard classification for this well-known web session weakness in CEH-style taxonomy; the described behavior aligns with fixation.

Therefore, the correct answer is D. Session Fixation Attack.

In CEH v13 Maintaining Access, stealth and persistence are key goals after compromise. Placing a backdoor in a file type excluded from resource maps (such as image metadata, configuration files, or uncommon extensions) reduces the likelihood of discovery by automated scanners and integrity checks.

Option D is correct because many security tools focus on executable or commonly accessed web files. Files excluded from resource maps are less likely to be scanned or monitored.

Option A increases detection risk due to frequent changes. Option B increases signature visibility. Option C still exposes the file to access logs and monitoring.

CEH v13 highlights that attackers often hide backdoors in non-obvious locations to avoid detection. Therefore, Option D is correct.