312-50v13 Certified Ethical Hacker Exam (CEHv13) Questions and Answers

The CEH Footprinting and Reconnaissance module describes DNS interrogation as a valuable technique for extracting publicly available infrastructure information such as A records, MX records, NS records, and subdomains.

DNS can reveal:

Subdomains (via zone transfers, brute forcing, or enumeration)

Mail server IP addresses (MX records)

Server locations inferred from IP geolocation

However, DNS does not store authentication credentials. Usernames and passwords are protected within authentication systems and directories, not DNS records.

Therefore, option A is correct.

CEH clearly states that DNS reconnaissance is limited to infrastructure metadata, not sensitive user credentials.

This scenario describes SNMP Enumeration, a technique covered under CEH v13 Reconnaissance and Enumeration. Simple Network Management Protocol (SNMP) operates over UDP port 161 and is widely used for monitoring and managing network devices. A common and critical weakness arises when organizations leave default or publicly known community strings such as public (read-only) or private (read-write) unchanged.

CEH v13 explains that when an SNMP agent is configured with default community strings, it allows unauthenticated or weakly authenticated queries, enabling attackers to retrieve extensive system information. This includes installed software, running processes, system descriptions, network interfaces, and routing tables. The ability to perform bulk data queries using SNMP GET and WALK commands makes enumeration highly effective and fast.

Option B correctly identifies the root cause: misconfigured SNMP agents permitting anonymous or default access. The other options are incorrect because SNMP does not rely on FTP, registry access, or trap logging for enumeration. Traps (Option D) are unsolicited notifications sent to managers and are not used for querying system details.

CEH v13 strongly recommends disabling SNMP when not required, changing default community strings, restricting SNMP access via ACLs, and using SNMPv3, which supports authentication and encryption. Therefore, Option B is the correct and CEH-aligned answer.

The correct answer is C because an SMB relay attack is best classified as a Man-in-the-Middle attack. In this attack, the attacker positions a fraudulent SMB server or relay between a victim client and a legitimate target server. When the victim attempts Windows/SMB authentication, the attacker does not simply replay old traffic later; instead, the attacker relays the live authentication exchange to the real target server and uses the resulting authenticated connection. EC-Council material describes SMBRelay as an SMB server that can capture usernames and password hashes from incoming SMB traffic and states that it can perform man-in-the-middle attacks. It also describes a scenario where the victim thinks they are connecting to the target, while the MITM server intercepts the call and passes the connection to the target server. Replay is a related concept, but replay usually means capturing authentication data and reusing it later. SMB relay is specifically a live MITM relay technique, so option C is the most accurate.

The Certified Ethical Hacker (CEH) Incident Response lifecycle begins with Identification, followed by containment, eradication, recovery, and lessons learned. CEH documentation stresses that understanding the scope and nature of an incident is critical before taking disruptive action.

Option A is the correct initial response because it focuses on real-time monitoring and log analysis, which are essential during the identification phase. CEH materials emphasize analyzing logs, authentication failures, and traffic anomalies to confirm whether an incident has occurred and determine the attacker’s techniques, persistence level, and impact.

Option B, while valuable, is more appropriate after initial identification. Conducting deep outbound traffic audits without first understanding the attack vector can delay containment decisions.

Option C is premature. CEH warns that changing credentials too early may alert the attacker and cause them to escalate or destroy evidence.

Option D represents a containment strategy, not an initial response. CEH guidelines advise against immediately disconnecting systems unless there is confirmed active data exfiltration that cannot be otherwise controlled, as this may disrupt business operations and erase volatile forensic evidence.

Therefore, the CEH-approved approach is to monitor, analyze, and identify the incident before moving to containment and eradication.

The correct answer is C. Leveraging DDoS Prevention Offerings from an ISP or DDoS Mitigation Service.

The scenario describes a large-scale DDoS attack that exceeds the organization’s local mitigation capacity. The traffic is rerouted through an upstream filtering or scrubbing infrastructure that absorbs malicious traffic and forwards legitimate traffic back to the organization. This is the function of an ISP-backed or specialized DDoS mitigation/scrubbing service.

CEH-aligned DDoS countermeasure material notes that, for a true DDoS attack, the practical answer is often involvement of the upstream ISP because endpoint-level defenses may not keep up with a sophisticated global botnet attack .

Option A. RFC 3704 Filtering is incorrect because ingress/egress filtering helps reduce spoofed traffic but does not describe large-scale traffic scrubbing.

Option B. Cisco IPS Source IP Reputation Filtering is incorrect because source reputation filtering alone does not match upstream traffic rerouting and scrubbing.

Option D. Black Hole Filtering is incorrect because blackholing drops traffic, often including legitimate traffic, while the scenario says clean traffic is forwarded back to the retailer.

Therefore, the best answer is C. Leveraging DDoS Prevention Offerings from an ISP or DDoS Mitigation Service.

CEH v13 stresses that IoT-to-OT convergence is one of the most dangerous architectures in critical infrastructure environments. IoT devices often lack strong security controls and become ideal entry points for lateral movement into OT systems controlling physical processes.

The immediate priority is to secure the communication boundary between IoT and OT systems. Implementing strong encryption, authentication, and access control ensures that even if an IoT device is compromised, it cannot be used as a pivot point. CEH v13 explicitly recommends network segmentation and secure communication channels as first-response containment measures.

Penetration testing (Option A) is valuable but time-consuming and not an immediate mitigation. ML-based tools (Option C) require training time and are not instant safeguards. IPS deployment (Option D) helps detect attacks but does not prevent credential abuse or trusted-path exploitation between IoT and OT layers.

By enforcing secure protocols, certificates, and authentication mechanisms, the organization reduces attack surface immediately. Thus, Option B is correct.

DHCP starvation is a network-level attack in which an attacker sends a massive number of DHCPDISCOVER requests, each appearing to originate from a different MAC address. CEH courseware explains that DHCP servers assign IP leases based on unique MAC addresses, and when the lease pool is exhausted, legitimate clients are unable to obtain valid IP configurations. This disrupts network connectivity and can serve as a precursor to deploying a rogue DHCP server, enabling further attacks such as traffic redirection or credential interception. DHCP starvation is different from ARP spoofing, which manipulates MAC–IP mappings, or DNS poisoning, which corrupts domain resolution. Rogue DHCP relay attacks involve forwarding DHCP packets to unauthorized servers, not depleting leases. The scenario described—rapid MAC address spoofing and exhaustion of DHCP leases—matches the precise definition of DHCP starvation as documented in CEH materials.

WPA2-Enterprise networks authenticate clients through 802.1X using a RADIUS server. A common attack method described in CEH training is to create an evil-twin access point broadcasting the same SSID as the legitimate one. Combined with de-authentication frames, clients are forced off the real AP and automatically reconnect to the stronger rogue AP. This allows the attacker to capture authentication exchanges for later misuse, including credential harvesting or EAP-based downgrade attacks.

The correct choice is the SOA record because it uniquely provides authoritative administrative and operational metadata about a DNS zone. In CEH reconnaissance techniques, DNS enumeration is a high-value passive and semi-passive method to learn about an organization’s infrastructure without actively attacking hosts. The Start of Authority record defines core parameters of the zone and identifies the primary authoritative name server for that domain. Most importantly for this question, the SOA record contains fields that directly match “serial number and refresh interval,” which are classic SOA elements used for zone replication and synchronization behavior between primary and secondary DNS servers.

An SOA record typically includes the primary name server, the responsible party field often formatted like an email address for the zone administrator, the zone serial number, and timing values such as refresh, retry, expire, and minimum TTL. These details can reveal change frequency, operational practices, and sometimes administrative contact clues, all of which are relevant in reconnaissance and reporting.

The other record types do not meet the requirement. MX records identify mail exchangers for the domain but do not include serial or refresh parameters. NS records list authoritative name servers but lack administrative timing metadata. TXT records store arbitrary text such as SPF, DKIM, DMARC, or verification strings and are useful for email security posture analysis, but they do not provide the zone control fields the question references. Since the question explicitly calls out serial and refresh interval, the SOA record is the only option that fits completely.

The correct answer is C, tcpdump. Passive OS fingerprinting identifies the operating system of a target by observing and analyzing network traffic without actively sending probe packets to the target system. Tools such as tcpdump capture packets traversing a network and allow analysts to inspect characteristics like TCP window size, Time-To-Live (TTL) values, TCP options, and packet behavior that can reveal the operating system in use. Because the target is not directly interrogated, passive fingerprinting is stealthier and less likely to trigger alerts.

Nmap is primarily associated with active OS fingerprinting because it sends specially crafted packets and analyzes the responses to determine the target operating system. Ping is used mainly to verify host availability, while tracert (traceroute) identifies network paths and intermediate hops between systems. Neither ping nor tracert performs OS fingerprinting.

In CEH reconnaissance and enumeration topics, passive information gathering focuses on observing existing communications rather than generating new traffic. Therefore, among the given options, tcpdump is the most appropriate tool for passive OS fingerprinting because it captures and analyzes network traffic without directly probing the target.

In CEH v13 Mobile, IoT, and OT Hacking, firmware-level attacks on Programmable Logic Controllers (PLCs) are categorized as high-impact and stealth-oriented threats, often designed to evade traditional network-based defenses. Malicious firmware compromises the integrity of the device itself, allowing attackers persistent and covert control over industrial processes.

The first and most critical step is to verify the integrity of the firmware and software running on the PLCs. CEH v13 emphasizes that before containment or mitigation actions are applied, accurate identification and confirmation of compromise must occur. Firmware inspection enables analysts to detect unauthorized code injections, modified logic blocks, altered checksums, or tampered boot loaders—hallmarks of OT malware such as Stuxnet-like attacks.

Immediate isolation (Option A) may be necessary later, but premature isolation can disrupt industrial operations and destroy volatile forensic evidence. IDS enhancements (Option C) focus on traffic patterns and are ineffective against firmware-resident malware. Restricting remote access (Option D) is preventative but does not validate or remove an existing firmware compromise.

CEH v13 stresses that OT environments require forensic verification at the device level, especially when abnormal behavior originates from controllers themselves. Firmware validation using vendor-approved tools and hash verification is the correct first step to confirm compromise and plan remediation without risking operational safety.

Reconnaissance is the correct phase because the scenario explicitly states Sarah starts by gathering publicly available information about employees and infrastructure. In the Cyber Kill Chain, reconnaissance is the first phase where an attacker collects intelligence to understand the target and identify the most effective paths for compromise. In CEH-aligned methodology, this includes open-source intelligence activities such as discovering employee names, roles, emails, technology stack clues, exposed services, and organizational patterns that help craft realistic and convincing attack lures.

The question mentions that Sarah plans to craft a mock phishing email and later deploy a harmless payload. Those actions map to later kill chain phases: delivery is when the phishing email or malicious link is sent to the target, and exploitation is when a vulnerability is triggered to execute code or gain access. Weaponization is the step where an attacker prepares the malicious artifact, such as packaging an exploit with a payload or preparing a document or link to deliver. However, the key wording is that Sarah “begins” by collecting public information and is asked which phase she should prioritize to simulate the adversary’s approach effectively. That is reconnaissance, because effective phishing and subsequent steps depend on accurate target profiling, believable pretexts, and identifying likely weak points based on what is learned during intelligence gathering.

Therefore, to match the described starting point and the kill chain sequence, the prioritized phase is Reconnaissance.

CEH v13 highlights the importance of route tracing during internal reconnaissance to identify key infrastructure devices such as distribution switches, firewalls, and core routers. When a single IP address consistently appears as the penultimate hop across multiple network paths, this typically indicates that the device serves as a core router responsible for inter-VLAN or inter-subnet routing. Core routers aggregate traffic from various segments before forwarding to endpoint subnets, explaining why it appears before diverse destinations. CEH emphasizes recognizing core infrastructure because compromising such devices provides attackers with significant visibility and potential control over network-wide communications. DNS poisoning would affect name resolution, not hop patterns. Loopback misconfigurations would affect single hosts, not multiple segments. A transparent proxy would appear only for traffic routed through application-layer inspection, not all traceroute tests. The consistency across subnets strongly points to a centralized routing device.

The correct answer is B, Reaver. Reaver is the well-known wireless attack tool used to target Wi-Fi Protected Setup, especially the WPS PIN mechanism. In wireless hacking, WPS PIN attacks attempt to recover or validate the router’s WPS PIN and then derive access to the WPA/WPA2 pre-shared key. This is different from normal WPA/WPA2 cracking, where attackers commonly capture authentication handshakes and use dictionary or brute-force attacks against the passphrase. CEH wireless-hacking material notes that WPA/WPA2 cracking commonly involves capturing WPA/WPA2 authentication traffic and using tools such as Aircrack for offline cracking. Kismet is mainly used for wireless discovery/sniffing, and Wireshark is a packet analyzer, not a WPS PIN attack tool. Aircrack is associated with WEP/WPA/WPA2 cracking, but not specifically WPS PIN attacks. Therefore, the tool that specifically targets WPA/WPS PIN weakness is Reaver.

The described behavior strongly matches HTTP Response Splitting. This vulnerability occurs when an application includes unsanitized user input in HTTP response headers. By injecting carriage return and line feed characters (CRLF), an attacker can “split” the server’s response into multiple parts—causing additional headers to appear or injecting unintended body content. The scenario explicitly says Raj’s payloads cause “additional headers to appear” and “inject unintended content into the output,” which is the classic outcome of response splitting.

Why this matters: response splitting can enable attacks such as web cache poisoning, cookie manipulation, redirection, and cross-site scripting-like impacts through header/body injection. For example, if an attacker can inject a Set-Cookie header, they may set or overwrite cookies in the victim’s browser. If they can inject a Location header, they may force redirects. If they inject content into the body, they may deliver malicious scripts or alter page behavior—especially when combined with caching intermediaries. The vulnerability typically arises in features that reflect user input into headers such as Location, Set-Cookie, Content-Disposition, or custom headers.

The other options do not match the symptoms:

XML Poisoning (B) and XXE (C) relate to XML parsing and entity resolution; they do not directly cause added HTTP headers in responses.

SSRF (D) involves forcing the server to make outbound requests to internal/external resources; it may expose data but does not primarily manifest as injected response headers and altered response structure.

Therefore, Raj is most likely exploiting A. HTTP Response Splitting.

A load balancer is the best match because the key mitigation behavior described is distributing incoming traffic across multiple servers to prevent any single system from being overwhelmed. In CEH coverage of availability attacks, one of the most practical architectural defenses against flooding-based DoS and DDoS is to scale horizontally and place a load-balancing layer in front of a server pool. This allows the organization to absorb spikes by spreading connections and requests across multiple backend nodes, improving resilience and maintaining uptime.

The scenario also mentions filtering malicious requests. Modern load balancers commonly provide health checks, rate limiting, connection limiting, and integration with access control rules, and they are often deployed alongside DDoS scrubbing or edge protections. Even when the filtering logic is implemented through integrated security policies or upstream services, the defining characteristic in the prompt is traffic distribution across multiple servers, which is a primary function of load balancing and a common CEH-referenced mitigation strategy for volumetric attacks.

A web application firewall focuses on inspecting and blocking malicious HTTP and application-layer payloads such as injection, request anomalies, and known attack patterns, but it is not primarily responsible for distributing traffic across multiple servers. An IPS can block suspicious patterns and exploit attempts, yet it does not typically provide the core traffic distribution function described. A traditional firewall enforces network-level rules and may help with rate limits, but it does not inherently balance traffic across a server farm. Therefore, the most likely tool in use here is a load balancer.

The correct answer is A. ISO/IEC 27001:2022.

ISO/IEC 27001 is the international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It is the best match when an organization wants a governance framework to manage confidentiality, integrity, availability, risk management, regulatory obligations, and stakeholder assurance.

CEH-aligned standards material identifies ISO/IEC 27001 as the standard that defines requirements for implementation, maintenance, and improvement of an information security management system. It also associates the standard with information security management processes, cost-effective risk management, security requirements, and compliance with laws . Another CEH-aligned reference states that ISO/IEC 27001 provides requirements for creating, maintaining, and improving organizational information security systems and addresses compliance with laws as well as internal security requirements and objectives .

Option B. ISO/IEC 27005:2022 is incorrect because ISO/IEC 27005 focuses on information security risk management guidance, not the full certifiable ISMS framework.

Option C. ISO/IEC 27701:2019 is incorrect because it extends privacy information management, not general information security governance.

Option D. ISO/IEC 27002:2022 is incorrect because it provides security control guidance, but ISO/IEC 27001 is the management system standard used for certification and governance.

Therefore, the best answer is A. ISO/IEC 27001:2022.

In the CEH Denial-of-Service and Network Attacks coverage, a SYN flood is a classic TCP-based DoS technique that exploits the TCP connection establishment process. In a normal handshake, the client sends SYN, the server replies SYN/ACK, and the client completes with ACK. A SYN flood deliberately sends a high volume of SYN packets (often spoofed) but never completes the final ACK. As CEH describes, this leaves the server holding many half-open connections in SYN_RECEIVED, consuming memory and connection table resources (backlog queue). When the backlog fills, legitimate clients cannot establish connections, degrading availability.

The indicators in your scenario align exactly with CEH’s SYN flood fingerprints: incomplete handshakes and accumulation of half-open connections. The goal is resource exhaustion at the connection-management layer rather than bandwidth saturation.

Option B (Ping of Death) involves malformed/oversized ICMP packets and does not match SYN_RECEIVED behavior. Option C (UDP flood) targets UDP services/ports and creates different symptoms (high UDP traffic, ICMP unreachable messages, service degradation) without half-open TCP states. Option D (Smurf) is ICMP-based amplification via broadcast addresses—again unrelated to incomplete TCP handshakes.

CEH also notes mitigations such as SYN cookies, increasing backlog, reducing SYN-RECEIVED timers, rate limiting, and upstream filtering—further reinforcing that the described event is a SYN flood.

This question relates to Malware Analysis, specifically PDF-based malware, as covered in the CEH v13 Malware Threats module. The presence of /JavaScript and /OpenAction keywords identified by pdfid strongly indicates potentially malicious behavior triggered when the PDF is opened.

CEH v13 recommends static analysis of PDF stream objects as the next step to understand embedded malicious logic. Tools such as PDFStreamDumper allow analysts to extract, decompress, and inspect object streams within a PDF file, revealing obfuscated JavaScript code or exploit payloads.

The /OpenAction keyword indicates that the embedded JavaScript executes automatically when the document is opened, a common technique used in PDF-based attacks to exploit reader vulnerabilities or download secondary payloads.

Other options are insufficient:

VirusTotal provides detection results but not behavioral insight.

PE Explorer is irrelevant because PDFs are not Portable Executable files.

Hashing only helps identify known malware, not analyze behavior.

CEH v13 emphasizes manual inspection of embedded scripts to determine intent, making PDFStreamDumper the correct next step.

The capabilities described match an enterprise Wireless Intrusion Prevention System (WIPS) tightly integrated with WLAN infrastructure: it uses access points as sensors (placing selected APs into passive scan/monitor mode), correlates and aggregates alarms from multiple controllers into a central engine for analysis and forensic retention, and can push automated countermeasures across the campus (such as coordinated channel scanning and remote configuration enforcement) when a device is classified as malicious. This is most consistent with Cisco Adaptive Wireless IPS.

Cisco’s adaptive WIPS model uses the existing Cisco wireless architecture (controllers and APs) to provide campus-wide monitoring and enforcement. The phrase “selected APs into a passive scan mode” is a strong indicator of adaptive sensor use—APs can be dedicated or time-sliced for scanning, and the system can coordinate coverage across channels. The centralized engine concept also aligns with enterprise WIPS deployments that collect events and alarms from multiple controllers for correlation and long-term storage, supporting incident investigation and compliance.

Why the other options are less fitting:

Fern WiFi Cracker (C) is an attack/assessment tool, not a production defensive platform, and it does not provide centralized alarm aggregation and automated enterprise countermeasures.

RFProtect (B) is a known wireless security/WIPS solution family, but the question’s feature set and wording (“adaptive,” APs used for passive scanning, controller-integrated countermeasures) most closely matches Cisco’s adaptive WIPS concept.

WatchGuard Wi-Fi Cloud WIPS (A) is a vendor-managed WIPS offering; while it can provide monitoring, the scenario stresses multi-controller aggregation into a central engine and coordinated campus countermeasures via WLAN infrastructure—again aligning best with Cisco’s controller/AP ecosystem.

Therefore, the best answer is D. Cisco Adaptive Wireless IPS.

CEH v13 explains that LDAP enumeration is often restricted by Access Control Lists (ACLs). Sensitive directory objects and attributes are frequently protected to prevent unauthorized disclosure.

Even when LDAP is accessible, ACLs can limit the visibility of users, groups, and configuration data.

Tailgating, as defined in CEH v13 Social Engineering, is a physical social engineering attack where an unauthorized individual gains access by following an authorized person into a restricted area.

The attacker exploits human courtesy rather than technical vulnerabilities. Options B, C, and D describe phishing, pretexting, and baiting respectively.

Thus, option A is the correct representation of tailgating.

The correct answer is Checks for outdated versions of over 1,250 servers. In CEH vulnerability assessment coverage, Nessus Essentials is presented as a vulnerability scanning solution that can assess a wide variety of technologies, including operating systems, web servers, databases, network devices, and virtualized environments. Its core role is identifying weaknesses, missing patches, insecure configurations, and exposure conditions across supported platforms. The option about checking outdated versions across a very broad range of server technologies best reflects that scanner-oriented capability. Patch management is not the primary function of Nessus Essentials, because it identifies vulnerabilities rather than directly managing patch deployment. Agent-based detection may be used in some security products, but that is not the defining capability highlighted in this CEH-style framing. High-speed asset discovery is a feature associated more strongly with specialized discovery platforms, whereas Nessus is centered on vulnerability enumeration and assessment. CEH study material emphasizes understanding the purpose of common security tools, and Nessus is generally classified as a scanner that detects outdated software versions and known vulnerabilities so remediation can be prioritized across the environment. That is why option B is the most accurate fit.

A logic bomb is malware or malicious code that is deliberately planted within a system and configured to execute when a specific condition is met, such as a particular date and time, a user action, or the presence or absence of a file. CEH materials describe logic bombs as condition-based triggers that can remain dormant for extended periods, producing minimal indicators until the trigger occurs. The most decisive clue in this scenario is the “scheduled task set to a specific date,” followed by abnormal behavior that appears only after that date passes. This is a textbook trigger mechanism used to activate malicious actions while avoiding early detection.

The “odd email from an unfamiliar source” suggests an initial delivery or social engineering vector, but the core behavior is the delayed activation. The later “faint increase in network activity only after the scheduled date passed” aligns with a logic bomb executing a payload such as beaconing, data exfiltration, or enabling remote access. The “unusual code traces on a dormant workstation” further supports the idea of implanted code that was inactive until triggered.

Fileless malware emphasizes execution in memory using legitimate tools such as PowerShell or WMI and is defined more by its living-off-the-land technique than by a date-based trigger. An APT describes a broader campaign style involving long-term, multi-stage intrusion, not a single defining trigger artifact. Ransomware is characterized by encryption and extortion behavior, which is not described. Therefore, the threat is best characterized as a logic bomb.

The correct answer is D. Obtain written permission to hack. In CEH methodology, the ethical difference between a hacker and an ethical hacker is authorization. Before any testing, scanning, exploitation, or information gathering begins, the ethical hacker must have written approval from the system owner. The CEH-aligned penetration testing lifecycle places rules of engagement, customer requirements, scope definition, legal agreements, contracts, and NDAs in the pre-attack or preparation phase before active testing begins. Written permission defines what systems may be tested, which techniques are allowed, when testing may occur, who must be notified, and what liability protections apply. Verbal permission is not sufficient because it is difficult to prove and may not clearly define legal boundaries. Hacking the web server before permission would be unauthorized activity, and gathering target information before approval may also violate scope and legal requirements. Therefore, the most important pre-assessment action is to obtain written authorization. CEH exam guidance also emphasizes that an ethical hacker always obtains written permission before testing.

The Certified Ethical Hacker (CEH) Cryptography module explains that one of the primary challenges in encryption is secure key distribution. Asymmetric encryption, also known as public-key cryptography, was specifically designed to address this issue.

In asymmetric encryption, each entity possesses a public key and a private key. The public key can be shared openly, allowing anyone to encrypt data securely, while only the corresponding private key can decrypt it. CEH documentation highlights that this model eliminates the need to transmit secret keys over insecure channels.

Option D is correct because asymmetric encryption enables secure key exchange without prior trust.

Option B (symmetric encryption) requires a shared secret key and suffers from key distribution challenges.

Option A refers to data-at-rest protection, not key exchange.

Option C provides integrity verification, not encryption.

CEH emphasizes that asymmetric encryption underpins secure protocols such as TLS and digital certificates.

CSRF occurs when a vulnerable application processes unauthorized state-changing requests because it does not verify whether the request was intentionally initiated by the authenticated user. CEH v13 explains that exploitation involves tricking a logged-in user into unknowingly executing a crafted HTTP request—usually via a malicious webpage, hidden form submission, embedded image tag, or JavaScript trigger. When the victim visits the attacker-controlled page, the browser automatically includes the user’s active session cookies, allowing the server to treat the forged request as legitimate. This technique is central to CSRF attacks and is highlighted in the CEH curriculum as the correct exploitation path. Directory traversal, SQL injection, and brute-force attacks target different vulnerabilities and do not exploit missing request authenticity validation. The key requirement for CSRF exploitation is user interaction via a malicious external resource, making option B the correct CEH-aligned method.

CEH identifies brute-force cryptanalysis as a method in which an attacker systematically tests every possible key, password, or passphrase until the correct one is found. When an attacker obtains initial bytes from an encrypted container—often referred to as known plaintext—they can use this to validate attempts as the tool iterates through candidate keys. Automated brute-force tools compare decrypted results with known header patterns, file signatures, or expected byte structures to determine when the correct key is reached. This process aligns precisely with brute-force password testing described in CEH cryptography modules. Quantum solving is not part of CEH scope, digest comparison relates to collision attacks, and analyzing output length pertains to padding oracle detection. The correct classification is automated brute-force cryptanalysis.

CEH v13 explains that multi-vector DDoS attacks, especially those combining volumetric reflection (DNS amplification) with application-layer exhaustion (Slowloris), require multi-layered mitigation. Standard firewalls and IPS devices cannot handle large-scale distributed attacks without causing collateral damage to legitimate traffic. CEH emphasizes the need for hybrid DDoS protection, combining on-premises appliances for real-time local filtering with cloud-based scrubbing centers capable of absorbing massive volumetric floods. Cloud scrubbing removes malicious traffic upstream, while on-prem devices mitigate application-layer anomalies. Increasing bandwidth (Option A) is ineffective against reflection attacks. IPS (Option B) cannot handle Slowloris-style partial requests at scale. Blocking all external DNS/HTTP (Option C) would deny service to legitimate users. The correct CEH-aligned solution is hybrid DDoS mitigation services.

The correct answer is C. Firewalls and IPS systems protect the perimeter, but they do not replace system hardening, access control, patching, auditing, and regular security testing on the internal network elements themselves. In CEH security concepts, defense should be implemented in layers, commonly called defense-in-depth. This means that even if an attacker bypasses perimeter defenses, internal systems should still be protected.

Because these network elements are Linux-based computers, they require strong user account management, secure authentication, least privilege, service hardening, vulnerability assessment, patch management, logging, and periodic audits. Strong passwords and unique user IDs also support accountability and reduce the risk of unauthorized access.

Option A is incorrect because relying only on firewalls and IPS creates a single point of failure. Option B mentions disaster recovery but does not address preventive security. Option D is also incomplete because physical security alone cannot stop remote attacks, malware, insider threats, misconfigurations, or credential abuse.

Therefore, the best policy is to harden the systems and perform regular security testing and audits.

CEH materials explain that modern web applications deploy multiple layers of security—HTTPS, secure cookies, HttpOnly flags, and strict session regeneration—to defend against standard hijacking methods such as token theft through XSS or fixation. When these protections are properly implemented, attackers must compromise the underlying trust relationship between the client and server to successfully intercept or manipulate session tokens. One of the most advanced techniques described in CEH is compromising a trusted certificate authority or injecting a forged certificate into the victim’s trust store. This enables the attacker to perform a transparent MITM attack despite HTTPS protections. Because the victim’s browser trusts the forged certificate, encrypted traffic—including session tokens—is exposed to the attacker without generating browser warnings or IDS alerts. Timing side-channel attacks are not considered session hijacking methods; XSS is mitigated by secure flags; and session fixation is ineffective when session regeneration occurs. Therefore, compromising a trusted certificate authority to enable an undetectable MITM attack is the most viable method.

The correct answer is B. Pharming.

The scenario describes users being directed to a fraudulent website that closely resembles the legitimate portal and then being prompted to submit credentials. Among the available options, this best aligns with pharming because the key behavior is redirection or misdirection of users’ web traffic to a fake website designed to harvest credentials.

CEH-aligned social engineering material describes pharming as a phishing-related variant involving redirection of a user’s web traffic and refers to it as “phishing without a lure.” The same reference distinguishes spimming as spam over instant messaging and whaling as a phishing attack targeting high-level executives . CEH web attack material also explains that attackers may use fake websites that look legitimate to extract login details from victims .

Option A. Whaling is incorrect because whaling targets senior executives or high-value individuals.

Option C. Spear Phishing is incorrect because spear phishing is a targeted phishing message sent to a specific individual or small group, usually through email.

Option D. Spimming is incorrect because spimming involves spam messages sent over instant messaging platforms.

Option B. Pharming is the best answer because the attack directs users to a fake portal where credentials are harvested.

Therefore, the best answer is B. Pharming.

This scenario is a classic vishing (voice phishing) attempt: the attacker calls employees, impersonates a vendor, and tries to persuade them to disclose sensitive payment information. The most direct, practical countermeasure that employees can apply in every interaction is verifying the requester’s identity before sharing any information. That means using a trusted verification method—such as calling back using an official number from an internal directory/vendor contract, confirming through a known manager or procurement channel, or following an established verification workflow—rather than trusting the caller ID, the caller’s confidence, or claimed affiliation.

Option B is the best answer because it directly breaks the social engineering tactic being used: pretexting (posing as a vendor) relies on getting the victim to accept identity and urgency without validation. If employees consistently verify identity through independent channels, the attacker’s pretext collapses and the request is denied or escalated. This is the most immediate control at the human decision point, where the data disclosure risk occurs.

Why the other choices are less direct:

Security awareness programs (A) are important, but the question asks for the practical step employees must apply in each interaction. Training supports the behavior; it is not the specific action that stops the call from succeeding.

Policies and procedures (C) provide governance and guidance, but the direct operational control during a phone call is still identity verification.

Two-factor authentication (D) protects login processes but does not prevent an employee from verbally disclosing payment details over the phone.

Therefore, the prioritized countermeasure is B. Employees must verify the identity of individuals requesting information.

A NULL scan is a TCP port scanning technique in which the attacker sends a TCP packet with no flags set. This technique is commonly used during the network reconnaissance and port-scanning phase to identify open and closed ports while attempting to evade some security controls and logging mechanisms.

According to TCP/IP behavior defined in RFC 793 and discussed in CEH network scanning concepts, when a NULL packet is sent to a closed port, the target system should respond with a TCP RST (Reset) packet. The RST packet indicates that no service is listening on that port and that the connection attempt should be terminated immediately.

When the port is open, most UNIX/Linux systems generally do not respond to a NULL scan packet. Therefore, scanners such as Nmap interpret no response as either an open or filtered port and RST as a closed port.

Option A (No response) is associated with an open port in a typical NULL scan, not a closed one. Options B, D, E, and F are incorrect because FIN, SYN, ACK, and PSH are not the expected responses from a closed port during a NULL scan.

CEH v13 explains that WPA2-Enterprise replaces the static, shared password model of WPA2-Personal with a centralized authentication system that relies on the 802.1X framework. The essential component of this architecture is RADIUS integrated with EAP, which manages user authentication, device identity verification, and dynamic session key generation. RADIUS acts as the backend authentication server, while EAP provides a flexible authentication framework supporting certificates, smartcards, or credentials. This combination allows organizations to enforce per-user access control policies, revoke individual users without changing network-wide passwords, and generate unique Pairwise Master Keys (PMKs) for every authenticated session. CEH highlights that one of the major advantages of WPA2-Enterprise is its ability to produce unique encryption keys for each client, preventing key reuse and mitigating lateral movement if one device is compromised. Certificate-based EAP types such as EAP-TLS introduce mutual authentication, ensuring both client and server validate each other’s identity before allowing network access. This significantly increases security posture compared to PSK networks, which cannot scale securely for large enterprise deployments.

CEH v13 highlights the Idle Scan as one of the stealthiest reconnaissance methods available, designed specifically to avoid detection by IDS and security monitoring tools. Idle scanning leverages a “zombie host”—a system with a predictable IPID sequence—to route all probe packets through it. Since no packets ever originate directly from the attacker’s IP, IDS systems are unable to attribute the port scan to the attacker. CEH emphasizes that this technique creates zero direct traffic between the attacker and the target, making it extremely evasive and ideal for highly monitored networks. FIN scans (Option A) are somewhat stealthy but still originate from the attacker and are detectable. TCP Connect scans (Option C) are the most detectable because they complete full connections. ICMP Echo scans (Option D) are easily logged and flagged by IDS. Idle scanning is uniquely suited for bypassing advanced detection systems while still identifying open ports and live hosts.

A Directory Traversal attack, also known as path traversal, exploits weaknesses in how a web server or web application processes user-supplied file and directory paths through URLs or parameters. In CEH-aligned terminology, the attacker crafts requests that use traversal sequences such as dot-dot-slash patterns or encoded equivalents to escape the intended web root or permitted directory and reach sensitive locations on the underlying file system. The question states Sofia “manipulates resource paths” and successfully accesses “restricted system files,” revealing “sensitive configuration data.” This is the defining outcome of directory traversal: unauthorized access to files that should never be directly retrievable via the web interface, including application configuration files, server configuration, environment files, or other OS-level resources.

The prompt also eliminates other options by describing what the issue is not. It is not header manipulation, which would be more consistent with HTTP response splitting or header injection behaviors. It is not cached content tampering, which points to web cache poisoning. It is not credential compromise, which would indicate password cracking. Instead, the root cause is explicitly “failure to validate input paths,” matching CEH emphasis on inadequate input validation and improper path normalization or canonicalization before file access. Defensive guidance typically focuses on strict allowlisting of accessible resources, canonicalizing paths and enforcing a fixed base directory, blocking traversal tokens and their encoded forms, using indirect references instead of raw file paths, and applying least-privilege permissions to reduce impact if traversal is attempted.

The correct answer is B. Implementing a Split DNS Architecture.

The issue is that the same DNS infrastructure is being used for both internal and external name resolution, causing internal namespace details to be exposed externally. Split DNS separates internal and external DNS views so that external users receive only public records, while internal clients can resolve private hostnames and internal service records.

CEH-aligned reconnaissance material explains that footprinting and DNS-related information gathering can reveal domain names, namespaces, IP addresses, and network details useful for planning attacks . It also describes DNS and WHOIS queries as methods used during footprinting to collect topology and infrastructure information about a target network . Split DNS directly reduces this exposure by preventing public DNS queries from returning internal naming data.

Option A is incorrect because source port and query ID randomization helps reduce DNS spoofing/cache-poisoning risk, not namespace disclosure.

Option C is incorrect because rate limiting controls query volume, while the problem is sensitive information exposure.

Option D is useful for detection and investigation, but it does not prevent external clients from receiving internal DNS details.

Therefore, the best answer is B. Implementing a Split DNS Architecture.

Passive reconnaissance is emphasized throughout CEH as an essential method for gathering intelligence without alerting monitoring systems. When the tester cannot interact with the live site, they must rely entirely on third-party archives or cached content stored by search engines or internet archival services. Google’s cache function provides previously stored versions of web pages exactly for this purpose. CEH explains that attackers frequently use cached content to retrieve outdated login portals, administrative pages, exposed directories, or other sensitive elements that may no longer appear on the live web server. Unlike operators such as intext or intitle, which query live indexed metadata, the cache operator retrieves historical snapshots without accessing the target website. The link operator identifies backlinks but does not provide historical page content. Only the cache operator directly supports viewing previous versions of pages passively, aligning perfectly with the requirement to avoid detection while gathering intelligence on legacy web content.

This refers to the CVSS (Common Vulnerability Scoring System), which CEH v13 identifies as the industry standard for vulnerability prioritization. A score of 9.8 indicates critical severity, combining metrics such as exploitability, impact, privileges required, and scope.

CVSS helps organizations prioritize remediation objectively, focusing resources on vulnerabilities with the highest business risk. It also allows consistent communication between technical and management teams.

Options B, C, and D misrepresent CVSS functionality. Therefore, Option A is correct.

CEH covers classical cryptanalytic attacks, including linear cryptanalysis, which uses statistical correlations between plaintext and ciphertext to infer bits of the secret key. If a cipher leaks structural patterns across many data samples, linear approximations can be computed to break the cipher.

To determine which specific system on the sender’s side processed the message, the most relevant email-header detail is the sender’s mail server, typically revealed in the chain of Received: headers. Each mail transfer agent (MTA) that handles the message adds a Received line indicating the system that passed the message along and the system that received it. By reviewing these headers from bottom to top (earliest hop upward), analysts can identify the originating outbound infrastructure used by the sender—such as the initial submission server, outbound relay, or gateway that first accepted the email for delivery.

The scenario’s goal is to “map the sender’s outbound email infrastructure” and identify “which specific system on the sender’s side processed the message.” That maps more directly to identifying the mail server hostnames involved (the MTAs), because those are the processing systems that relayed the email. While an IP address can help locate a host, the question emphasizes the “specific system” responsible for processing, which is typically expressed as the mail server identity (hostname/domain) shown in header traces. In practice, investigators correlate the sender mail server information with IPs, TLS details, and authentication results, but the primary header clue for the processing system is the server identified in Received lines.

Why the other options are less suitable:

Date and time (A) helps with timeline analysis, not identification of the processing system.

Sender’s IP address (C) can indicate a source network, but the message may traverse NAT, relays, or cloud email services; it doesn’t always name the processing system.

Authentication system used (D) (e.g., SPF/DKIM/DMARC results) indicates validation outcomes, not which server processed the message.

Therefore, the correct choice is B. Sender’s mail server.

The correct answer is B. Stealth Virus because the defining characteristic described is hiding malicious presence by intercepting operating system calls and masking changes so that normal tools (including antivirus scans) do not observe the infection. In CEH-aligned malware concepts, stealth viruses are designed to evade detection by concealing modifications to files, boot records, or system areas. They commonly do this by hooking system functions or APIs so that when the OS or a security product requests file contents, sizes, checksums, directory listings, or other metadata, the virus returns clean-looking or original data instead of the infected/modified version. This makes infected files appear to “function normally,” while the malware remains active in memory and persists on disk.

The scenario explicitly mentions that “infected files continue to function normally” and that the malware “conceals its modifications by intercepting operating system calls.” That is the classic behavior of stealth techniques: manipulate what the system reports, not necessarily change the outward behavior of the application. The repeated “no threats detected” results also align: signature-based or basic scanning can be blinded when the malware controls the interface through which the scanner reads target files or system structures.

Why the other options are less correct: a polymorphic virus focuses on changing its code/signature between infections to evade signature-based detection, but the key clue here is OS call interception and hiding modifications, not code mutation. A macro virus targets macro-enabled documents and spreads through macro execution in office applications; it is not primarily defined by OS-level call hooking. A cavity virus (spacefiller) hides by inserting itself into unused areas of a file without changing the file size, but the scenario’s emphasis is on intercepting OS calls to conceal changes, which is more directly the stealth-virus behavior.

Therefore, Ryan most likely deployed a stealth virus.

Bluesnarfing is a Bluetooth attack described in CEH v13 Wireless Network Hacking, where attackers exploit misconfigured Bluetooth devices to access sensitive data such as contacts, messages, and files—often without user interaction.

One of the most critical enablers of Bluesnarfing is Bluetooth discoverable mode. When devices are discoverable, attackers can easily identify them and attempt unauthorized connections or exploit vulnerabilities in Bluetooth services.

Disabling discoverable mode significantly reduces the attack surface by preventing unauthorized devices from locating Bluetooth-enabled systems. CEH v13 explicitly recommends setting Bluetooth devices to non-discoverable mode when not pairing.

While firmware updates (Option B) are important, they do not immediately prevent discoverability-based attacks. Stronger PINs (Option C) help against pairing attacks but do not stop unauthorized queries. Network-level encryption (Option D) is inherent in Bluetooth protocols and does not mitigate discovery abuse.

CEH v13 highlights that visibility control is the most immediate and effective defense against Bluesnarfing. Therefore, Option A is the correct answer.

This scenario describes fileless malware using covert command-and-control (C2) channels over commonly allowed protocols such as HTTP and DNS, a technique heavily emphasized in CEH v13 Malware Threats. Such malware avoids writing files to disk and instead leverages memory, legitimate system tools, and trusted protocols to evade traditional defenses.

Signature-based antivirus updates (Option A) are ineffective against fileless malware because there are no static artifacts to match. Blocking known malware ports (Option C) is also ineffective, as the malware intentionally uses ports 80 and 53, which must remain open for normal business operations. Restricting plain HTTP (Option B) may reduce visibility but does not stop DNS tunneling or encrypted malicious traffic.

CEH v13 identifies behavioral analytics as the most effective countermeasure against advanced malware. Behavioral solutions establish a baseline of normal system and network activity, then detect anomalies such as:

Unusual outbound DNS query patterns

Abnormal HTTP beaconing intervals

Legitimate applications behaving suspiciously

PowerShell or system tools generating network traffic unexpectedly

By monitoring how systems behave rather than what files exist, behavioral analytics can identify stealthy C2 communications and disrupt them early. Therefore, Option D is the most effective and CEH-aligned response.

Credential stuffing is the best match because the scenario highlights automated login attempts across many accounts with an unusually high success rate, occurring in the aftermath of a breach. In CEH-aligned system hacking concepts, credential stuffing is the automated testing of known username and password pairs—typically harvested from prior breaches—against a different service. Because many users reuse passwords across sites, attackers often achieve a higher-than-normal success rate compared to guessing-based attacks. This “high success rate” across numerous accounts is a key indicator that the attacker is not randomly guessing, but replaying valid credentials at scale using bots or automation frameworks.

Password spraying differs in that the attacker tries a small set of common passwords (or one password) across many accounts to avoid lockouts. Spraying generally yields a lower success rate and is driven by guessing rather than replaying known credential pairs. A brute force attack is even noisier and typically involves repeated guessing for a single account or small set of accounts; it is both slower and far less likely to produce a high success rate across many users in a short period. Phishing attacks can lead to account takeovers, but the pattern described would more often show targeted victims and varied sources rather than broad, automated, multi-account authentication bursts with consistently successful logins.

CEH defensive guidance emphasizes layered controls: enforce MFA, monitor for abnormal login velocity and credential reuse indicators, deploy bot detection and rate limiting, use breached-password checks, implement adaptive authentication, and tune lockout and detection policies to disrupt automated credential replay without enabling denial-of-service against legitimate users.

The correct answer is F because the Windows Administrator account is identified by its RID value, not merely by the visible username. In Windows enumeration, a Security Identifier, or SID, uniquely identifies user, group, and computer accounts. The last portion of the SID is the Relative Identifier, or RID. CEH-aligned material explains that Windows uses SIDs and RIDs to track account rights and permissions, and the RID value 500 identifies the built-in Administrator account. The Guest account normally uses RID 501, while standard created users usually begin at 1000 and increment upward. Therefore, when SIDExtractor displays multiple users, the account whose SID ends in -500 is the system administrator account, even if the Administrator account has been renamed. Enumeration tools such as sid2user and user2sid are used to map usernames to SIDs and SIDs to usernames. In this question, John corresponds to the administrator RID, so option F is correct.

The correct choice is OS command injection in nginxWebUI because the question describes untrusted input being passed into backend processing in a way that affects system-level operations. CEH web application material classifies command injection as an injection flaw that occurs when a vulnerable application allows attacker-controlled input to be interpreted by the operating system or shell environment. The key clue is that the tester manipulates parameters associated with uploaded content, and those altered values influence commands executed in the server-side web service context. That is the hallmark of command injection rather than SSRF, which would involve the server making unintended outbound requests, or certificate validation issues, which relate to TLS trust decisions. The mention of no direct shell access is also consistent with command injection, because the attacker does not need an interactive shell if malicious input can still alter system commands behind the application. CEH guidance repeatedly stresses that unvalidated input in web applications can lead to injection attacks, including command injection, when user-controlled values reach backend interpreters without strict sanitization, parameter control, or allow-list validation.

CEH identifies spear-phishing as a targeted, context-rich social engineering method tailored to specific individuals or departments. By incorporating accurate insider details, attackers significantly increase trust and likelihood of disclosure.

Social engineering attacks that target business processes are especially effective when they mimic legitimate workflows. CEH learning materials emphasize that attackers often exploit trust relationships and organizational procedures rather than attempting broad or generic phishing methods. In the context of HR operations, onboarding portals are highly trusted and frequently accessed by new employees who expect to enter personal information, submit documents, and receive initial network credentials. By creating a fake onboarding portal that closely resembles the organization’s internal system, an attacker can collect credentials without triggering suspicion because the action being requested appears normal and expected. This method leverages procedural familiarity, brand consistency, and the implied authority of HR communications, making it far more effective than generic phishing emails or unsolicited social media messages. Phone calls, while sometimes useful, involve real-time interaction and increase the chance of detection. The fake portal, however, seamlessly integrates into existing processes, making it the most effective and lowest-profile approach for acquiring network credentials.

The correct answer is D. XMAS Scan.

An XMAS scan sends TCP packets with multiple flags set, commonly FIN, URG, and PSH. In RFC 793-style behavior, closed ports respond with RST, while open ports often return no response.

CEH scanning material describes inverse TCP flag scanning as sending TCP probes with flags such as FIN, URG, and PSH. It identifies probes with these flags as XMAS scanning and explains that a closed port responds with an RST packet, while open ports may ignore or drop the abnormal packet combination .

Option A. FIN Scan is incorrect because a FIN scan uses only the FIN flag, while the scenario specifies an uncommon combination of multiple TCP control bits.

Option B. UDP Scan is incorrect because the probes are TCP packets, not UDP packets.

Option C. TCP Connect Scan is incorrect because a TCP connect scan completes the normal three-way handshake.

Option D. XMAS Scan is correct because it uses multiple TCP flags and produces the open/closed behavior described.

Therefore, the best answer is D. XMAS Scan.

The correct answer is IMDS Attack. CEH cloud security material explains that cloud instances often obtain temporary credentials from an Instance Metadata Service, commonly called IMDS, which supplies identity and role-based access details to workloads running on the virtual machine. If an attacker gains code execution on the instance, even through a separate web application flaw, the attacker may query the metadata endpoint locally and retrieve temporary credentials associated with the instance role. That is precisely what happens in this scenario: the tester runs a script on the VM, extracts temporary role credentials, and then uses them to enumerate storage and other services within the same cloud account. Wrapping attacks target SOAP message manipulation, while cloud snooper and CP DoS do not match the behavior of harvesting role credentials from local cloud metadata. CEH emphasizes that overprivileged instance roles and exposed metadata access can allow attackers to pivot from a single compromised workload into broader cloud service access. Because the key step is retrieving temporary credentials from the instance metadata service, the best match is IMDS Attack.

TCP 139 and UDP 137 and 138 correspond to NetBIOS over TCP/IP services that are closely associated with Windows file and printer sharing and legacy SMB browsing. In CEH methodology, these ports are high-value enumeration targets because NetBIOS name service and datagram service can disclose hostnames, domain or workgroup names, logged-in users, and shared resource details, often before any strong authentication occurs. UDP 137 is used for NetBIOS Name Service, which supports name registration and lookup. UDP 138 supports NetBIOS Datagram Service, commonly tied to browsing and announcement traffic. TCP 139 supports NetBIOS Session Service, historically used to establish sessions for SMB traffic and to query share and user-related information when configurations are weak.

In real environments, misconfigurations such as permissive share settings, legacy protocols, or anonymous and guest-access allowances can allow an attacker to enumerate user accounts, groups, and policies indirectly through browsing data, share lists, and RPC-related exposure that frequently accompanies SMB environments. CEH training emphasizes prioritizing enumeration against Windows networking services because the information gained can rapidly support follow-on attacks such as password spraying, targeted phishing, lateral movement, and privilege escalation planning.

The other choices include TCP 21 FTP, TCP 23 Telnet, and TCP 25 SMTP, which may expose banners or allow limited user enumeration in specific configurations, but they are not the primary ports associated with classic Windows user and group enumeration. UDP 133 is not a standard enumeration target in this context. Therefore, TCP 139 with UDP 137 and 138 is the best priority set for username and group-related enumeration.

This scenario demonstrates a classic case of Session Fixation, a session hijacking technique explicitly covered under the CEH v13 Web Application Hacking module. Session fixation occurs when an attacker sets or predicts a valid session identifier and forces a victim to authenticate using that same session ID.

In the given question, two critical vulnerabilities are highlighted:

The session ID is embedded in the URL

The application does not regenerate the session ID after login

According to CEH v13, secure applications must regenerate session identifiers after successful authentication to prevent fixation attacks. If this does not occur, an attacker can craft a URL containing a known session ID and trick the victim into clicking it. Once the victim logs in, the attacker reuses the same session ID to gain unauthorized access.

CEH documentation states that session fixation is particularly effective when:

Session IDs are passed via URL parameters

Sessions persist across authentication

Secure cookie attributes are not enforced

Other options are incorrect because:

XSS-based cookie theft requires client-side script injection.

DNS cache poisoning is unrelated to session management.

CSRF exploits user trust but does not directly hijack sessions.

Thus, Session Fixation by pre-setting the token in a URL is the most effective attack in this case.

CEH v13 distinguishes between vertical and horizontal privilege escalation. Vertical escalation occurs when an attacker moves upward in the hierarchy of privileges—such as from a regular user to an administrator or root—by exploiting vulnerabilities, misconfigurations, or insecure privilege boundaries. This allows the attacker to perform tasks that were previously restricted, such as modifying system settings, accessing sensitive data, installing malware, or controlling the entire environment. Horizontal escalation, on the other hand, involves accessing another user’s resources at the same privilege level, which the other options describe. Exploiting unquoted service paths or weak access controls may facilitate privilege abuse, but they do not inherently elevate the user to a higher privilege tier unless they specifically lead to administrative execution. The scenario that aligns perfectly with the CEH definition of vertical privilege escalation is the escalation from regular user to administrator.

The directory that contains the publicly accessible web content—including HTML pages, images, JavaScript, CSS, and other client-side assets—is known as the Document Root. This is the base filesystem path that a web server maps to the “/” location of a website. When a user requests a resource (for example, https://site.com/index.html), the web server typically resolves that URL path to a file under the configured document root and then serves it to the client (subject to access controls and server configuration).

The scenario’s details match this precisely: Jake identifies “the directory that stores the publicly accessible website content,” and notes that it is a frequent attacker target due to risks from improper permissions. Document root security is critical because overly permissive read or browse access can expose files that were never intended to be public—such as backups, configuration files, temporary files, source code archives, or sensitive data accidentally placed in web-accessible paths. Misconfigurations can also enable directory listing, allowing attackers to enumerate and retrieve files directly. Attackers often probe for common filenames (e.g., old .zip backups, .bak files, exposed .env files, or test pages) precisely because document root is where such mistakes become externally reachable.

Why the other options are less accurate:

An Application Server (A) runs server-side application logic (e.g., Java/.NET app containers) and is not specifically the directory of static public web content.

The HTTP Server (Core) (C) refers to the web server software/service handling HTTP requests, not the content directory itself.

A Virtual Document Tree (D) describes the logical structure mapping URLs to resources (sometimes via aliases and virtual hosts), but the question asks for the directory that stores the publicly accessible content—this is the document root.

Therefore, Jake is analyzing B. Document Root.

CEH v13 highlights behavioral analytics as one of the most effective techniques for identifying ambiguous or stealthy threats such as data exfiltration, command-and-control traffic, and insider abuse. When interactions appear suspicious but not definitively malicious, behavioral profiling provides the most direct visibility.

Behavioral analytics tools establish a baseline of normal system and network behavior, including typical communication patterns, data transfer volumes, destinations, and timing. Deviations from this baseline trigger alerts, allowing analysts to detect previously unknown threats without relying on signatures.

Option C is the most appropriate because it both identifies anomalies and supports continuous mitigation. A full zero-trust shutdown (Option A) is disruptive. Forensics (Option B) is reactive and better suited after confirmation of compromise. Training (Option D) does not address system-level interactions.

CEH v13 emphasizes that modern attacks often blend into normal traffic, making behavioral analysis essential. Therefore, Option C is the correct answer.

CEH v13 defines a penetration tester as an authorized security professional whose responsibility is to identify, exploit, and report vulnerabilities within an organization’s systems, networks, applications, and processes. Unlike malicious hackers, penetration testers operate strictly within legal boundaries, under documented Rules of Engagement (RoE), and with explicit written permission from the organization. Their goal is not to harm systems but to simulate real-world cyberattacks to help organizations strengthen their defenses. CEH emphasizes the ethical responsibilities of penetration testers, including maintaining confidentiality, avoiding unauthorized data exposure, ensuring minimal operational impact, and providing actionable recommendations. Options B, C, and D describe malicious actors, malware authors, or unauthorized attackers—roles opposite to that of an ethical penetration tester. CEH makes a strong distinction between white-hat ethical hackers and black-hat attackers, with penetration testers firmly falling under the ethical, lawful category. Therefore, Option A accurately reflects CEH’s definition of a penetration tester.

This describes a rule-based or logic-based password attack, which CEH v13 classifies as a smart, targeted guessing technique. Attackers use known patterns—such as naming conventions, dates, or personal interests—to reduce the keyspace and increase success rates.

Option A accurately reflects this methodology. Option B is brute force, which is random and exhaustive. Option C is physical observation. Option D describes hybrid attacks without structured logic.

CEH v13 emphasizes that pattern-based attacks are highly effective when attackers possess prior intelligence. Therefore, Option A is correct.

The best choice is Caido because the scenario describes a web-focused interception proxy workflow: intercepting HTTP traffic, logging requests, and performing advanced searches to identify session tokens. In CEH-aligned web application testing methodology, session hijacking simulations commonly rely on an intercepting proxy to observe and manipulate application-layer requests and responses, extract session identifiers from cookies or headers, and demonstrate how weak session management can lead to account compromise. A lightweight security research proxy that captures traffic and supports fast filtering and searching across requests fits this exact need. Caido is designed as a modern web security toolkit centered around an interception proxy, allowing testers to capture browser-to-server traffic, inspect headers and cookies, and quickly search through recorded traffic for patterns such as session IDs, authentication cookies, bearer tokens, or predictable parameters.

The other tools are less aligned with the described requirements. Wireshark is a powerful packet analyzer, but it operates primarily at the packet level and is not optimized for web-app testing workflows such as organized request history, token-focused searching, and convenient HTTP manipulation. Bettercap is primarily a network MITM and exploitation framework; while it can intercept traffic, it is not the typical choice for controlled web proxy testing and detailed HTTP request analysis in the way described. Hetty is an HTTP toolkit, but the question’s emphasis on a lightweight, security-research proxy with strong captured-data searching and request logging aligns more closely with Caido’s purpose-built approach for web application assessments and session token discovery.

‘

This scenario clearly indicates a SYN Flood attack, a classic Denial-of-Service technique discussed in CEH v13 Network and Perimeter Hacking. In a normal TCP three-way handshake, a client sends a SYN, the server responds with SYN-ACK, and the client completes the connection with an ACK. In a SYN flood, attackers send a massive number of SYN packets but never complete the handshake.

As described in CEH v13, the server allocates memory and resources for each half-open connection, placing them in the SYN_RECEIVED state. When these connections are not finalized, the server’s connection table becomes saturated, preventing legitimate users from establishing new sessions.

Other options are incorrect:

Smurf attacks rely on ICMP amplification, not TCP handshakes.

Ping of Death uses malformed ICMP packets.

UDP Floods overwhelm ports using UDP, not TCP session states.

CEH v13 emphasizes SYN floods as one of the most common Layer 4 DoS attacks due to their simplicity and effectiveness.

The most direct technique demonstrated is D. Compromising secrets, because the attackers abused exposed API keys to authenticate to the cloud provider and execute unauthorized cloud commands. In CEH-aligned cloud attack paths, “secrets” commonly include API keys, access tokens, secret keys, passwords, certificates, and service account credentials. When these secrets are exposed (for example, hard-coded in source code, leaked in public repositories, stored insecurely in endpoints, or logged accidentally), an attacker can use them to gain the same privileges as the legitimate account or service identity.

Once valid API keys are obtained, attackers typically perform actions consistent with the compromised identity’s permissions: spinning up compute, modifying IAM policies, accessing storage, disabling logging, creating new credentials, and pivoting across services. The incident description mentions both resource abuse and lateral movement. Resource abuse is a frequent consequence of stolen cloud credentials because attackers can provision infrastructure on the victim’s account (often for botnets, staging, or other activities). Lateral movement inside the cloud environment can happen when the compromised keys grant access to additional services or when the attacker uses the initial foothold to discover and access other roles, instances, or secrets (for example, by querying metadata services, reading configuration stores, or enumerating IAM privileges).

Why the other options are less accurate: Cryptojacking specifically refers to illicit cryptocurrency mining using hijacked resources; while “resource abuse” could include mining, the key distinguishing factor in the question is the use of exposed API keys to issue commands, which is fundamentally credential/secret compromise. Enumerating S3 buckets is a reconnaissance activity focused on object storage discovery and misconfigurations, not the central mechanism here. A wrapping attack relates to specific cloud/identity token wrapping scenarios and is not indicated by exposed API keys.

Therefore, the incident most clearly demonstrates compromising secrets (exposed API keys).

TCP NULL scanning is a stealth scanning technique covered in CEH v13 Reconnaissance and Network Scanning. In a NULL scan, all TCP flags are set to zero. According to RFC 793 and CEH documentation, closed ports must respond with a TCP RST (Reset) packet.

If the port is open, the target typically does not respond, making this technique useful for firewall evasion. Therefore:

RST response = Closed port

No response = Open or filtered port

Other options do not apply to NULL scans:

SYN/ACK is associated with SYN scans.

ICMP errors may indicate filtering, not port state.

The Certified Ethical Hacker (CEH) Social Engineering module defines tailgating as a physical social engineering attack where an unauthorized person follows an authorized individual into a restricted area.

Option C precisely matches CEH’s definition.

Option A is pretexting.

Option B is baiting.

Option D is phishing.

CEH stresses physical security awareness as critical as cyber defenses.

CEH v13 identifies kernel-level rootkits as among the most dangerous malware types. Because they operate at the lowest OS level, they can hide processes, files, and system calls.

CEH v13 states that the only guaranteed remediation is a complete system wipe and clean OS reinstallation from a trusted source. Attempting removal risks incomplete eradication.

Powering down alone does not remove the rootkit. Honeypots are for detection, not remediation. Tailored removal tools may fail at kernel depth.

Thus, Option C is correct.

The correct answer is B, Reconnaissance. In CEH methodology, reconnaissance is the initial information-gathering phase where an attacker or ethical hacker collects as much data as possible about a target before deeper technical testing or attack activity. The retrieved CEH-related material describes reconnaissance as gathering information about the target using active or passive means, and it specifically includes collecting initial information about the target system or organization. Visiting an organization’s public website to collect employee names, email addresses, and phone numbers is passive information gathering because the tester is using publicly available sources rather than directly probing systems. Footprinting, which is part of reconnaissance, can include gathering employee information, phone numbers, and emails. Fingerprinting is more specific to identifying systems, services, or operating systems. Scanning and enumeration involve actively probing hosts, ports, and services. Gaining access occurs later, when vulnerabilities are exploited. Therefore, this activity corresponds to reconnaissance.

The requirements map most directly to WPA3, because WPA3-Personal replaces the legacy WPA2-PSK handshake with SAE (Simultaneous Authentication of Equals). SAE is designed to resist offline dictionary attacks: even if an attacker captures the handshake, they cannot simply take it offline and test password guesses at high speed the way they can with WPA2-PSK handshakes. This directly addresses management’s concern that a captured handshake plus a weak passphrase could enable offline cracking and eventual session key recovery.

WPA3 also strengthens per-session protection by improving how keys are established and by supporting stronger cryptographic defaults. In enterprise contexts, WPA3 aligns with stronger authentication and encryption suites, and in IoT scenarios it supports modern onboarding and improved security posture compared to older WPA2/TKIP-era configurations. The “per-session encryption” and “stronger protection” goals are consistent with WPA3’s modern design focus.

Why the other options are less suitable:

MAC address filtering (A) is not a security control against credential capture or offline attacks; MACs are easily spoofed and do not provide cryptographic protection.

802.1X authentication (B) (WPA2/WPA3-Enterprise) is very strong and removes reliance on a single shared PSK by using per-user/device credentials and dynamic keys. However, the question’s key requirement explicitly calls out preventing offline dictionary attacks even if a handshake is captured—this is most directly the hallmark improvement of WPA3-Personal (SAE). (In practice, WPA3-Enterprise with 802.1X is also excellent, but “upgrade to WPA3” is the single best match to the stated offline dictionary concern.)

Disabling TKIP (D) is good hygiene (prefer AES/CCMP), but it does not prevent WPA2-PSK handshake capture and offline cracking if PSK is used.

Therefore, the best measure to meet the stated modernization goals is C. Upgrade to WPA3.

CEH defines botnets as networks of compromised machines controlled remotely to perform coordinated activities such as DDoS attacks, spam campaigns, and credential theft. Systems showing outbound connections to unknown IPs and participating in mass spam dissemination are characteristic indicators of botnet infection.

Side jacking, as defined in CEH v13 Web Application Hacking, is a form of session hijacking where an attacker captures valid session identifiers—usually cookies—by sniffing network traffic. This attack is particularly effective when applications fail to encrypt session cookies using HTTPS.

In CEH v13, side jacking is commonly associated with attacks performed on unsecured wireless networks, where attackers passively monitor traffic using packet sniffers such as Wireshark. If session cookies are transmitted in plaintext, the attacker can replay them to impersonate the victim without needing login credentials.

Option B precisely matches this definition: capturing unencrypted session cookies and reusing them to gain unauthorized access.

Other options describe different attack types:

A is credential harvesting via social engineering.

C is network exploitation.

D is cross-site scripting (XSS).

CEH v13 emphasizes enforcing HTTPS, Secure and HttpOnly cookie flags, and session regeneration as defenses against side jacking.

CEH emphasizes that application-layer DoS attacks are often the most difficult to detect and mitigate because they can mimic legitimate user behavior while exhausting backend resources. A distributed SQL injection–driven DoS (Option B) can be especially challenging: attackers send requests that appear valid at the HTTP level, but the injected or crafted parameters force the application/database to execute expensive queries (heavy joins, sleep/delay functions, or costly operations). When distributed across many sources, the traffic can look like normal customer usage—successful TCP handshakes, valid HTTP requests, and realistic user-agent patterns—while still causing database connection pool exhaustion, CPU spikes, lock contention, and degraded response times.

Option A (Smurf) and Option D (UDP/DNS flooding) are more volumetric/network-layer patterns and are typically mitigated with upstream DDoS scrubbing, rate limiting, and filtering, and are more readily detectable via traffic anomalies. Option C (zero-day RCE) is severe, but it is not primarily a “DoS technique” in CEH classification; it’s an exploitation scenario that may lead to service outage, but the detection/mitigation path centers on exploit prevention, EDR, patching, and containment rather than DoS controls. In CEH terms, Option B aligns best with a sophisticated, scenario-like DoS that blends into normal app activity.

CEH mitigation approaches for application-layer DoS include WAF rules, input validation/parameterization (preventing SQLi), query cost controls, rate limiting by behavior, caching, database hardening, and anomaly detection at the application and database tiers.

This scenario demonstrates SMTP Enumeration, a classic enumeration technique described in CEH v13 Network Enumeration. SMTP servers may expose commands such as VRFY, EXPN, and RCPT TO, which can be abused to validate user accounts.

When these commands are enabled without restriction, attackers can enumerate valid usernames without authentication. The Nmap script used explicitly leverages these commands, confirming the misconfiguration.

Option B is incorrect because authentication is not bypassed. Option C concerns DNS routing, not user enumeration. Option D relates to encryption, not enumeration capability.

CEH v13 strongly recommends disabling or restricting SMTP user verification commands. Thus, Option A is correct.

The correct answer is C because the activity described is specifically known as dumpster diving. In CEH social engineering and reconnaissance concepts, dumpster diving refers to searching through an organization’s discarded materials to obtain sensitive or useful information. Attackers may look for printed documents, network diagrams, employee lists, invoices, sticky notes, password reminders, hardware labels, old storage media, or other items that reveal details about the target environment. Although this activity can support intelligence gathering and reconnaissance, those terms are broader phases or objectives. Social engineering is also a broader category that includes manipulating people or exploiting human behavior, and dumpster diving is commonly treated as one technique within that area. The question asks what best describes the exact activity of going through a company’s garbage, so the most precise option is dumpster diving. Organizations reduce this risk by enforcing secure disposal practices such as shredding documents, sanitizing media, locking trash areas, and training employees on information handling.

The correct answer is B because an API without request-rate limiting allows automated clients, bots, or scripts to repeatedly request large volumes of data from application endpoints. In CEH web application hacking concepts, web applications expose services to clients through front-end and back-end processing, and APIs are often used as direct interfaces to application data. When no rate limit, throttling, pagination control, quota enforcement, or anomaly detection exists, an attacker can enumerate records, harvest user profiles, pull product data, extract pricing information, or scrape sensitive business data at scale. This weakness is not XSS because no client-side script injection is described. It is not SQL injection because there is no malicious database query input. It is not CSRF because the attacker is not forcing a victim’s browser to submit authenticated requests. The missing control specifically enables repeated automated API access, making data scraping the best answer. Rate limiting should be enforced server-side, not only in client code.

Insecure communication is defined in CEH’s mobile and IoT security modules as the failure to encrypt sensitive data transmitted between a device and a server. When applications use plain HTTP instead of HTTPS, all traffic—including authentication tokens, user identifiers, and session data—can be monitored and altered by an attacker through network sniffing or man-in-the-middle attacks. CEH emphasizes that insecure transport channels represent one of the most common and critical weaknesses in mobile ecosystems, allowing attackers to harvest credentials or inject malicious commands. Security misconfiguration refers to improper server settings, while SSL pinning issues involve certificate validation bypassing. Insufficient input validation pertains to application-side data validation. None of these align as directly as insecure communication, which precisely describes the unencrypted data exposure.

This scenario most accurately represents repackaging legitimate apps. CEH mobile social engineering coverage explains that in a repackaging attack, an adversary takes a real application, modifies its internal code or structure to include malicious functionality, and redistributes it through a third-party marketplace. The important clues here are that the app appears visually and functionally identical to the legitimate version, yet sandboxing reveals additional outbound activity and binary comparison confirms structural differences from the official build. That pattern is stronger than merely publishing a look-alike malicious app, because the question indicates there are two versions of what is essentially the same application and the unofficial copy has been altered. Smishing involves fraudulent SMS messages and fake security applications typically masquerade as protective tools, neither of which matches this case. CEH warns that unofficial application stores are a common distribution point for repackaged mobile apps because attackers can embed spyware, adware, credential theft code, or other malicious logic into otherwise trusted software. The user often sees a familiar interface and therefore assumes the application is safe, making repackaging a highly effective mobile-based social engineering method.

Rachel is using the Ping method for sniffer detection. The distinguishing behavior in the scenario is that she sends ICMP echo requests (pings) crafted so that the Layer 2 MAC address is incorrect/mismatched, while the Layer 3 IP destination is correct. Under normal circumstances, a host’s network interface card (NIC) should drop frames not addressed to its MAC address. However, when a NIC is set to promiscuous mode (as sniffers often require), it can accept frames regardless of destination MAC and pass them up the stack. If the operating system then processes the encapsulated IP packet and responds (e.g., sends an ICMP echo reply), that response suggests the host is accepting frames it normally would ignore—an indicator consistent with promiscuous mode sniffing.

This technique is used as a heuristic: by intentionally violating normal Ethernet delivery rules and observing whether the target still responds, you can infer that the interface may be capturing traffic not explicitly addressed to it. It’s not perfect—modern drivers, switches, VLAN configurations, and host firewall behavior can affect results—but the scenario’s “mismatched MAC but correct IP” plus “the suspected machine responds” is the classic signature of the ping-based promiscuous-mode test.

Why the other options are less suitable:

ARP method (B) typically involves ARP-based tricks (non-broadcast ARP requests or crafted ARP traffic) to test how the target responds; the scenario explicitly describes ICMP behavior.

DNS method (C) relates to DNS queries/resolution behavior and does not match the ICMP/MAC mismatch test.

Nmap sniffer-detect (NSE) (D) is a specific scripted approach, but the question asks for the underlying technique being used; the described action matches the Ping method.

Therefore, the correct answer is A. Ping Method.

VLAN hopping is an advanced attack technique described in CEH materials, used to bypass VLAN segmentation by exploiting switch misconfigurations or vulnerabilities. Two primary methods—switch spoofing and double tagging—allow attackers to gain access to traffic from VLANs they are not authorized to view. This technique enables the capture of inter-VLAN traffic without requiring administrative privileges or triggering security tools. Port mirroring requires administrative control and is not an attack method. Rogue DHCP servers target IP assignment, not VLAN segmentation. ARP poisoning is effective only within a single broadcast domain and cannot traverse VLAN boundaries. Because the objective is to silently access multiple VLANs despite enforced segmentation, VLAN hopping is the correct technique as per CEH’s network perimeter attack methodology.

The most direct guideline is D. Register devices with a remote locate and wipe facility because the incident’s core impact came from two factors: loss of physical control of the device and continued exposure of sensitive records while the device remained active. A remote locate-and-wipe capability (commonly delivered through Mobile Device Management (MDM) / Enterprise Mobility Management (EMM) platforms) addresses both problems immediately: it enables administrators to identify the device’s last known location (or trigger location reporting) and, critically, to remotely lock or wipe the device to prevent ongoing unauthorized access to patient data.

In healthcare environments handling regulated data, the priority during a lost-device event is rapid containment. Even if device tracking alone can help find the phone, it does not guarantee that sensitive information stops being accessed during the search. Remote wipe (often paired with remote lock, enforced encryption, and policy-based access control) reduces exposure time by allowing responders to remove protected data and invalidate application access. This is particularly important when the device is still connected to the network, because an attacker (or unauthorized holder) could continue using cached sessions, stored tokens, or locally available records until access is cut off.

Why the other options are less direct: A (anti-virus/DLP) may help detect malware or control data movement, but it does not solve the immediate lost-device containment requirement. B (VPN on public Wi-Fi) is unrelated because the problem is physical loss and inability to control the endpoint. C (install tracking software) helps locate the device, but the scenario highlights that sensitive records were exposed for hours; the most direct impact reduction is achieved when the organization can both locate and wipe/lock the device through an enrolled, centrally managed capability.

Therefore, enrolling devices in a remote locate and wipe facility would have most directly reduced the breach impact.

CEH incident response material explains that LLMNR and NBT-NS poisoning is a common credential-harvesting technique in internal networks. These legacy name-resolution protocols operate via broadcast queries. Attackers can listen for these broadcasts and respond faster than legitimate DNS/hosts entries, impersonating the requested resource. Once the victim system attempts to authenticate, it sends NTLM hashes to the attacker-controlled machine. Tools like Responder and Inveigh automate this process, enabling attackers to collect challenge-response hashes for offline cracking. CEH highlights that this method is passive from the victim’s viewpoint and difficult to detect unless monitoring tools watch for anomalous LLMNR/NBT-NS responses. Options A, B, and D refer to other components of password cracking, but none describe the mechanism of capturing hashes via poisoned name resolution. The attacker’s technique directly aligns with exploiting the name-resolution protocol to intercept authentication attempts.

The correct answer is D. SOA.

The SOA, or Start of Authority, record identifies the primary name server for a DNS zone and contains important administrative and technical information about that zone. The CEH reconnaissance reference states that the SOA record identifies the primary name server and contains the hostname of the server responsible for DNS records within the namespace, along with the basic properties of the domain .

The SOA record also provides zone metadata including:

Source host

Contact email

Serial number

Refresh time

Retry time

Expire time

TTL

These details match the question’s requirement to identify administrative and technical DNS metadata such as the serial number and refresh interval .

Option A. TXT is incorrect because TXT records usually store arbitrary text values, such as SPF, DKIM, DMARC, ownership verification, and other policy data. They do not provide zone authority metadata such as serial number or refresh interval.

Option B. MX is incorrect because MX records identify mail exchange servers for a domain, but they do not provide full zone administration details.

Option C. NS is incorrect because NS records identify authoritative name servers, but they do not include serial number, refresh time, retry time, expire time, or TTL values.

Option D. SOA is correct because it provides both the authoritative DNS information and administrative zone parameters needed during DNS reconnaissance.

Therefore, the best answer is D. SOA.

Broken Access Control is the correct choice because the scenario describes a user being able to access and modify resources that should be restricted to other users or roles. In CEH-aligned web testing, access control flaws occur when an application fails to enforce authorization checks consistently on the server side. Manipulating session parameters and then retrieving “sensitive medical records not associated with their own account” is a classic indicator of an authorization bypass, often seen as insecure direct object references, parameter tampering, or horizontal and vertical privilege escalation. Horizontal escalation is when one user accesses another user’s data at the same privilege level, while vertical escalation is when a user performs actions reserved for higher-privileged roles. The prompt explicitly states users can perform actions beyond assigned roles, which is the definition of broken authorization enforcement.

The other options do not align with the described root cause. Cryptographic Failures focuses on weak or missing encryption and does not explain why authenticated users can reach unauthorized records. Insecure Deserialization involves unsafe deserialization leading to remote code execution or data tampering via serialized objects, which is not indicated here. Security Misconfiguration is broader and can contribute to exposure, but the scenario emphasizes role and resource permission bypass rather than mis-set server headers, default accounts, or exposed admin interfaces.

Mitigation in CEH best practices includes enforcing server-side authorization on every request, using deny-by-default policies, validating that the authenticated user is allowed to access the specific record identifier, implementing robust role-based access control, logging access denials, and adding automated tests to prevent IDOR and privilege escalation regressions.

Comprehensive and Detailed Explanation From CEH v13 Guide Topics:

The correct answer is A. hashing algorithms. In information security and cryptography, hashing algorithms are specifically designed to provide data integrity. A hash function takes an input message, file, or data block and produces a fixed-length value known as a hash, message digest, or checksum. If even a single bit of the original data changes, the resulting hash value changes significantly, making unauthorized modifications easy to detect.

Common cryptographic hash algorithms include SHA-256, SHA-384, and SHA-512. These algorithms are widely used to verify the integrity of files, software downloads, digital documents, emails, and transmitted network data. During verification, the recipient calculates the hash of the received data and compares it to the original hash value. If the values match, the data has maintained its integrity.

Option B is incorrect because “integrity algorithms” is not a standard cryptographic algorithm category. Option C (symmetric algorithms) such as AES and DES primarily provide confidentiality through encryption, while Option D (asymmetric algorithms) such as RSA and ECC are mainly used for encryption, key exchange, authentication, and digital signatures. Although digital signatures can support integrity verification, the fundamental mechanism used to detect changes in data is the cryptographic hash function. Therefore, hashing algorithms are the best answer for guaranteeing message integrity.

White Hat Hacking is defined in CEH v13 as ethical hacking performed with explicit authorization to identify and remediate vulnerabilities. White hat hackers operate within legal frameworks and contractual agreements.

Grey hats act without permission but without malicious intent. Black hats conduct illegal attacks. Blue hats are external testers invited to find bugs before product release.

Thus, Option C is correct.

This scenario best illustrates impersonation, which is a core social engineering technique emphasized in CEH under pretexting and physical security testing. Impersonation occurs when an attacker assumes a believable identity, such as an IT technician, vendor, maintenance worker, or delivery person, to gain trust and bypass access controls. In the prompt, the red team member adopts a third-party IT technician role and is granted entry because the receptionist assumes the visit is legitimate and does not verify credentials. That is the defining moment of impersonation: exploiting human trust and procedural gaps to obtain unauthorized physical access.

While the attacker later observes open terminals, unattended printouts, and sticky notes, those observations are opportunistic data collection that becomes possible only after successful impersonation. Shoulder surfing is specifically observing a user entering credentials or viewing a screen while standing nearby, typically during active use. Eavesdropping focuses on capturing spoken or transmitted information, such as listening to conversations or intercepting communications. Dumpster diving involves retrieving sensitive information from trash or discarded materials in waste bins, not simply seeing sticky notes left on desks.

CEH guidance highlights that impersonation often succeeds when organizations lack visitor verification, badge enforcement, escort policies, and security awareness training. Controls include validating work orders, requiring government-issued ID, issuing visitor badges, escorting visitors, enforcing clean desk practices, locking workstations, and secure printing to prevent exposure of credentials and sensitive data.

The correct answer is D. ldapsearch -h < host > -x -s base namingContexts.

The goal is to query the directory server’s root DSE for exposed naming contexts. The -x option performs simple authentication, -s base limits the search scope to the base object, and namingContexts requests the attribute that lists available naming contexts, such as domain and configuration partitions.

CEH-aligned LDAP enumeration material explains that LDAP directory services provide information about users, systems, networks, services, and organizational structure, and that LDAP enumeration can reveal domain and directory details useful for later targeting .

Option A is incorrect because it assumes a known base DN before discovering the naming contexts.

Option B is incomplete because it does not request the naming context attribute.

Option C also assumes the base DN is already known.

Option D is correct because it retrieves base-level naming context information before deeper LDAP searches.

Therefore, the best answer is D. ldapsearch -h < host > -x -s base namingContexts.

Server-Side Request Forgery (SSRF) is emphasized in CEH v13 Web Application Hacking as a stealthy and powerful attack. SSRF allows attackers to make requests from the trusted server itself, bypassing firewalls, authentication, and logging controls.

Compared to web shells or webhook abuse, SSRF leaves fewer forensic artifacts and enables internal API access, metadata exposure, and lateral movement.

Zero-day exploits are considered the most dangerous mobile attack vector in CEH v13 Mobile Platform Hacking. These exploits abuse previously unknown vulnerabilities, meaning no patches, signatures, or defenses exist at the time of attack.

In healthcare environments, mobile devices access sensitive EHR systems and operate under strict compliance requirements. Zero-day exploits can bypass mobile OS security, sandboxing, and antivirus controls entirely.

App spoofing and Bluejacking are easier to detect and mitigate through user awareness and Bluetooth controls. Side-channel attacks are highly specialized and rare in enterprise mobile environments.

CEH v13 stresses that zero-day attacks pose the greatest risk due to lack of detection mechanisms, making Option A correct.

Non-repudiation is the security principle that prevents a sender from denying having performed a specific action, such as sending a message or approving a transaction. In CEH-aligned cryptography, non-repudiation is most commonly achieved using digital signatures backed by public key cryptography and, in many real-world deployments, supported by digital certificates and a trusted certificate authority. When Alice digitally signs the email contract, she uses her private key to create a signature that is mathematically tied to both her identity and the exact content of the message. Bob can then use Alice’s corresponding public key to verify the signature. If verification succeeds, it provides strong evidence that the message originated from the holder of Alice’s private key and that the content has not been altered since it was signed.

This is different from confidentiality, which is about preventing unauthorized disclosure of message contents through encryption. It is also distinct from integrity alone: integrity ensures the message was not modified, but non-repudiation adds accountability by binding the action to a specific signer in a way that can be demonstrated to a third party. Availability is unrelated here, as it concerns ensuring systems and data are accessible when needed.

CEH materials emphasize that non-repudiation depends on proper key management and trust infrastructure. If Alice’s private key is compromised, the evidentiary value is weakened. Therefore, protecting private keys with secure storage, access controls, and revocation mechanisms is essential to preserve non-repudiation.

CEH covers advanced cryptanalytic attacks, including Meet-in-the-Middle (MITM) attacks, which are especially effective against multi-round symmetric encryption schemes. When an algorithm encrypts data twice using different keys, the naive brute-force method would require testing every possible combination of both keys—a time complexity of 2ⁿ × 2ⁿ. Meet-in-the-Middle dramatically reduces this complexity by splitting the problem in half. Attackers encrypt the plaintext using all potential values of the first key and store the results. They then decrypt the final ciphertext using all possible values of the second key. When an intermediate value matches one in storage, the corresponding key pair is identified. CEH highlights that this approach exploits the lack of key independence between two encryption layers, demonstrating how doubling encryption does not always double security. This attack is well-known for targeting 2DES, one of the historical examples covered in CEH. It is not related to side-channel attacks, brute-force flooding, or permutation reversal; it strictly relies on midpoint matching to reduce computational workload.

This attack is a classic example of Piggybacked SQL Injection, covered in CEH v13 Web Application Hacking. Piggybacked queries allow attackers to append additional malicious SQL commands to an existing query using a delimiter such as a semicolon.

The payload executes the original query followed by a destructive command (DROP TABLE). UNION-based injections retrieve data, Boolean-based injections infer logic, and error-based injections rely on error messages—not destructive execution.

CEH v13 explicitly describes piggybacked queries as capable of data destruction and privilege escalation, making Option A correct.

CEH v13 explains that fingerprinting is a core reconnaissance technique used to identify software versions, server types, and configurations by analyzing how systems respond to crafted or abnormal input. When testers send malformed HTTP verbs, unusual headers, or atypical URI structures, the server’s specific response codes, banners, and error messages reveal distinctive behavioral patterns. These patterns allow tools like httprint, Nmap NSE scripts, and custom probes to match the responses to known server profiles. This technique is part of active reconnaissance, enabling attackers to determine vulnerabilities associated with specific versions. Phishing (Option B) is unrelated to protocol analysis. Session fixation (Option C) manipulates session identifiers, not HTTP response patterns. Persistent XSS (Option D) relies on web application vulnerabilities, not server fingerprinting. Thus, the tester is performing HTTP-based server fingerprinting.

The scenario emphasizes that Daniel “begins capturing and reviewing live network traffic” to identify unauthorized session behaviors. In CEH-aligned network analysis practice, the most direct method to confirm session hijacking when you already have a packet capture is manual packet analysis using packet sniffing tools. By inspecting live traffic, Daniel can correlate sessions, verify whether multiple sources are reusing the same session identifiers, identify abnormal TCP sequence and acknowledgment behavior, and detect patterns such as duplicated cookies/tokens, replayed requests, inconsistent client IP or user-agent shifts, or sudden session reuse across hosts. This approach provides evidentiary detail beyond an alert and allows validation before escalation.

An IDS can be helpful, but it is a detection system that generates alerts based on signatures or anomalies; it does not inherently “confirm” the issue unless it provides clear supporting evidence, and the question specifically frames Daniel’s action as hands-on traffic review. Checking for predictable session tokens is a preventive and diagnostic step for weak session management design, but it does not directly confirm an in-progress hijacking event from observed network behavior. Monitoring for ACK storms can indicate certain TCP-level hijacking/desynchronization conditions, but it is narrower and may not apply to application-layer session hijacking, which is far more common in enterprise environments and would be validated by inspecting session identifiers and request flows in the capture.

Therefore, given the described workflow and the need to confirm unauthorized session activity from live traffic, CEH methodology aligns best with manual packet analysis using sniffing tools.

CEH methodology stresses prioritization based on risk, exploitability, and business impact. High-severity vulnerabilities—especially those related to outdated or unsupported server software—are frequently associated with known, publicly documented exploits. The proper next step after identifying such vulnerabilities is to confirm exploitability safely, typically by researching available exploit code, validating version-specific weaknesses, and determining whether the vulnerability can be successfully leveraged under the defined scope of engagement. CEH highlights that exploitation attempts must be evidence-driven, not arbitrary, and focusing on high-risk vulnerabilities allows testers to demonstrate meaningful security impacts. Brute-forcing (Option A) is unnecessary and high-noise. Ignoring or deprioritizing the high-risk finding (Options B and C) contradicts CEH risk-based assessment principles. Therefore, verifying exploitability of the high-risk vulnerability is the correct step.

OSINT-based reconnaissance includes using search engines to identify publicly exposed cloud assets. CEH highlights Google dorking as a passive method to reveal S3 buckets indexed in search engines through patterns such as site:s3.amazonaws.com or keyword-based queries.

The correct answer is B because the scenario exactly describes a pass-the-hash attack. In Windows environments, NTLM authentication uses password hashes as part of the authentication process. In a pass-the-hash attack, the attacker or authorized penetration tester does not need to recover the cleartext password. Instead, they extract the NTLM hash and reuse that hash directly to authenticate to another system or service. CEH-aligned system hacking material explains that Windows stores password hash values and that an attacker can steal a hash and send it instead of cracking the password. This is different from brute force, where many password guesses are attempted until the correct password is found. It is also different from Kerberoasting, which targets Kerberos service tickets for offline cracking. “Replay attack” is a broader term, but the precise Windows/NTLM technique described here is pass-the-hash. Therefore, option B is the best answer.

The correct answer is D. Date and time received by the originator’s email servers.

Email header tracing reveals hop-by-hop routing information, including mail servers, IP addresses, timestamps, and authentication-related details. CEH-aligned email footprinting material states that tracing an email using the header can reveal the destination address, sender’s IP address, sender’s mail server, time and date information, and authentication system information of the sender’s mail server .

The question asks for the exact moment the email was processed by the sender’s system. In an email header, this is best determined by examining the earliest relevant Received header added by the sender’s or originator’s mail infrastructure. That timestamp shows when the originator’s email server received or processed the message before forwarding it onward.

Option A. Sender’s mail server is incorrect because it identifies the system involved but does not by itself provide the processing time.

Option B. Date and time of message sent is less precise because the Date: header may be generated by the mail client and can be inaccurate or user-controlled.

Option C. Authentication system used by sender’s mail server is incorrect because SPF, DKIM, DMARC, or similar authentication details help validate sender authenticity, not the exact processing time.

Option D. Date and time received by the originator’s email servers is correct because it corresponds to the first trusted server-side timestamp in the message path.

Therefore, the best answer is D. Date and time received by the originator’s email servers.

CEH v13 classifies state-sponsored hackers as highly skilled professionals who operate under government direction to conduct espionage, intelligence gathering, sabotage, or cyber warfare. These attackers often target foreign governments, critical infrastructure, and strategic industries.

The defining characteristics are:

Government backing

National or geopolitical objectives

Advanced resources and long-term campaigns

Options B, C, and D do not fit. Organized hackers are typically financially motivated cybercriminal groups. Gray hats operate without authorization but not for national interests. Hacktivists pursue ideological or political causes independently.

CEH v13 explicitly associates covert intelligence operations with state-sponsored actors, making Option A correct.

In CEH’s Cloud Computing module, one of the most common real-world causes of cloud data exposure is misconfiguration, especially overly permissive network access controls. Cloud platforms commonly use constructs like security groups / firewall rules / network ACLs to define inbound and outbound access. CEH highlights that exposing sensitive services (databases, storage endpoints, admin panels) to the public internet—whether by “0.0.0.0/0” rules, overly broad ports, or unintended administrative access—frequently results in unauthorized access and data leakage even without sophisticated exploit chains.

Option D is therefore the most likely, because misconfigured security groups can directly expose customer data stores or management interfaces, enabling data theft through normal connectivity rather than exploiting a rare hypervisor flaw.

Option A (hypervisor side-channel attack) is advanced and less common; it typically requires high attacker capability and conditions not implied here. Option B (DoS) impacts availability, not confidentiality, so it doesn’t best explain data exposure. Option C (brute force passwords) is possible, but the question emphasizes an “unknown vulnerability” in the cloud environment—CEH teaching often frames “unknown vulnerability” in cloud incidents as misconfiguration or uncontrolled exposure rather than authentication guessing alone.

CEH countermeasures include least-privilege security group rules, segmentation, continuous configuration monitoring, cloud security posture management, and auditing publicly exposed resources.

Ransomware encrypts user data and extorts payment for restoration. CEH covers ransomware as a major threat in system hacking, highlighting encryption-based extortion as its defining behavior.

According to the CEH Cryptography module, strong symmetric encryption algorithms are essential for protecting data confidentiality and obscuring traffic content.

AES (Advanced Encryption Standard) is the industry-standard symmetric encryption algorithm approved by NIST and recommended by CEH for encrypting data in transit and at rest. AES provides strong resistance against cryptanalysis and prevents attackers from deriving meaningful information from encrypted traffic.

Option D is correct because AES is efficient, secure, and widely implemented.

Option A (HMAC) provides integrity and authentication, not encryption.

Option B (RSA) is computationally expensive and not suitable for bulk traffic encryption.

Option C (DES) is deprecated due to weak key length.

CEH materials clearly recommend AES over legacy algorithms.

The correct answer is C. MAC Flooding.

The scenario describes a switched network beginning to behave like a hub, with frames appearing across multiple switch ports. This happens when the switch’s CAM table is overwhelmed with many fake MAC address entries. Once the CAM table cannot reliably map destination MAC addresses to ports, the switch floods traffic out multiple ports.

CEH sniffing material explains that MAC flooding sends random MAC addresses mapped with random IP addresses to overflow the CAM table. When the CAM table is full, the switch acts like a hub and broadcasts packets to all ports, helping the attacker sniff packets more easily . Another CEH-aligned exam guide states that MAC flooding sends so many MAC addresses to the CAM table that it cannot keep up, effectively turning the switch into a hub .

Option A. Switch Port Stealing is incorrect because switch port stealing targets a specific victim MAC-to-port mapping through a race condition.

Option B. ARP Poisoning is incorrect because ARP poisoning manipulates ARP caches to redirect traffic through the attacker.

Option D. DNS Poisoning is incorrect because DNS poisoning manipulates name resolution, not switch forwarding behavior.

Therefore, the best answer is C. MAC Flooding.

CEH identifies insecure data transfer as a critical IoT weakness. Outdated encryption protocols such as SSLv2 fail to protect confidentiality or integrity. Without strong encryption and authentication, attackers can intercept, decrypt, and manipulate video feeds.

The most clearly demonstrated vulnerability is Lack of authentication. In CEH-aligned network device security principles, authentication is the fundamental control that verifies a user or device is permitted to access administrative functions or participate in trusted communications. The scenario states that the router allows external administrative access without requiring a password. That directly indicates that authentication is not being enforced for management access, meaning an unauthorized user could potentially gain administrative control simply by reaching the management interface.

The second observation reinforces the same core weakness in a different context: the router uses a protocol that provides neither encryption nor validation. In CEH terms, “validation” in routing and management protocols commonly refers to authentication and integrity checks, ensuring that updates or communications are sent by trusted peers and not altered in transit. When a protocol lacks validation, an attacker may be able to inject rogue updates, impersonate a trusted neighbor, or manipulate routing behavior, depending on the protocol and topology. While this could also be described as “insecure routing protocols,” the question asks what vulnerability is most clearly present based on both observations together. The common denominator is the absence of authentication controls: no password for admin access and no validation for device-to-device protocol exchanges.

“Lack of password protection” addresses only the first issue and is narrower. “Firewall vulnerabilities” is not evidenced. Therefore, the clearest and most comprehensive vulnerability indicated by the observations is Lack of authentication.

The highest-priority proactive control “to embed into the organization’s development lifecycle” is including quantum-resistance checks in the SDLC and code review processes. The scenario emphasizes a company-wide, long-term risk reduction strategy while development continues on a major refactor. In that context, the most scalable and durable control is governance and engineering hygiene: ensuring that new features and refactored components do not reintroduce weak or legacy cryptography and that teams consistently select algorithms and key sizes aligned with modern guidance and future migration plans.

Embedding checks into the SDLC means instituting standards and guardrails such as approved cryptographic libraries, banned algorithm lists (e.g., legacy RSA key sizes, deprecated curves, weak hashes), cryptography design reviews, automated dependency scanning for crypto usage, and CI/CD policy gates that flag noncompliant implementations. This approach reduces “crypto sprawl,” prevents new technical debt, and creates a structured path to transition toward post-quantum or quantum-resistant approaches as the organization modernizes systems.

Why the other choices are not the best “highest priority” SDLC-embedded control:

Encrypt stored data with quantum-resistant algorithms (B) may be appropriate for protecting long-lived sensitive data (“harvest now, decrypt later”), but it is a targeted technical control and may not be feasible immediately across many services during refactoring. It also does not by itself prevent developers from continuing to implement legacy public-key schemes elsewhere.

Quantum-specific firewalls (C) is not a realistic or standard control for post-quantum readiness in typical enterprise environments.

Fragmenting data across locations (D) can help resilience/confidentiality in some designs but does not address the core issue: preventing continued reliance on weak public-key cryptography.

Therefore, the best answer is A. Include quantum-resistance checks in SDLC and code review processes.

CEH v13 emphasizes that IoT and smart city environments are highly sensitive and safety-critical. When an IoT device shows anomalous outbound traffic and unauthorized open ports, this strongly indicates device compromise.

The correct immediate response is to isolate the affected device to prevent lateral movement and protect public safety. CEH v13 further stresses the importance of firmware analysis, as IoT malware often resides at the firmware level to maintain persistence.

Attempting reverse connections (Option A) is risky and may violate operational safety. Firewall changes alone (Option C) do not address an already compromised device. A full penetration test (Option D) is appropriate later but not as an immediate containment step.

Therefore, Option B aligns with CEH v13 incident handling best practices for IoT and OT environments.

Man-in-the-Cloud (MITC) attacks target cloud synchronization services such as Dropbox, Google Drive, and OneDrive by manipulating authentication tokens instead of user passwords. CEH courseware explains that cloud storage clients rely heavily on sync tokens stored locally, which authorize access without user interaction. If an attacker replaces or injects a malicious token, they can hijack the victim’s cloud account or redirect synced data to attacker-controlled locations. In this scenario, the EC2 instance continues to operate normally, but its Dropbox client silently synchronizes data to an external account using the attacker’s token. This bypasses traditional defenses such as perimeter firewalls, credential monitoring, or user behavior analytics, because the synchronization process appears legitimate and authenticated. MITC attacks are uniquely stealthy, as they require no further compromise once the sync token is stolen or replaced. Other choices, such as Cloud Snooper or cryptojacking, do not match the described behavior. Therefore, this attack clearly aligns with a Man-in-the-Cloud attack.

CEH v13 outlines insertion attacks as IDS evasion methods in which attackers send packets deliberately crafted so that the IDS processes them differently from the target host. In an insertion attack, malformed packets appear legitimate to the IDS—allowing malicious traffic to blend with benign inspection results—while the end host rejects or modifies the packets due to incorrect checksums, invalid flags, or protocol inconsistencies. As a result, the IDS sees one set of reconstructed data, while the actual host processes a different version or nothing at all. CEH emphasizes that intrusion detection systems may not follow full TCP/IP stack validation, making them susceptible to deception by malformed or borderline-conformant packets. Polymorphic shellcode (Option B) changes payload signatures, not packet structure. Session splicing (Option C) splits payload across packets to evade pattern matching but does not rely on checksum manipulation. Fragmentation attacks (Option D) divide traffic into smaller fragments, not alter validity fields. The described behavior fits insertion attacks precisely.

According to CEH v13 Security Operations and Incident Response, zero-day vulnerabilities pose one of the highest operational risks because exploits exist before official remediation is available. When active exploitation is observed and no vendor patch exists, immediate compensating controls must be deployed.

The first and most effective action is implementing virtual patching, typically through a Web Application Firewall (WAF) or Intrusion Prevention System (IPS). CEH v13 defines virtual patching as a security measure that blocks exploitation attempts at the network or application layer without modifying the vulnerable software. This approach allows organizations to maintain service availability while reducing exposure.

Shutting down the server (Option A) may prevent exploitation but introduces unacceptable business disruption and is not recommended as a first response. Backups and incident response planning (Option C) are critical but do not actively prevent exploitation. Passive monitoring (Option D) allows attackers to continue exploiting the vulnerability unchecked.

CEH v13 emphasizes that virtual patching is the preferred first response for zero-day threats, especially when systems are mission-critical. It provides immediate risk reduction while allowing time for vendor patch development and controlled deployment.

CEH v13 states that vulnerabilities with a CVSS score ≥ 9.0 are critical and require immediate containment. When remote code execution is possible, the system may already be compromised.

The recommended response is to isolate the affected system, preventing lateral movement, then perform a forensic audit before applying patches. Immediate patching without isolation may alert attackers or destroy evidence.

Thus, option D aligns with CEH incident response best practices.

The most likely missing BYOD guideline is reviewing application permissions before installation. In CEH mobile security guidance, a major risk in BYOD environments is the introduction of untrusted or malicious applications that abuse the mobile permission model to access corporate data, intercept authentication tokens, read storage, capture keystrokes via accessibility services, or communicate externally. When users install apps without scrutinizing requested permissions, they may unknowingly grant excessive privileges that enable data theft or access-control bypass, especially if the app leverages OS weaknesses or misconfigurations.

The scenario states Javier “installs a malicious app that bypasses access controls” and gains access to sensitive financial data because devices “lack a specific security measure to restrict app access.” This maps directly to a policy gap around controlling and validating apps and their permission requests. CEH emphasizes that organizations should reduce attack surface by limiting app privileges, avoiding sideloading from untrusted sources, and enforcing least privilege through user awareness and enterprise controls such as MDM application allowlisting and permission governance. Reviewing permissions is the user-facing guideline that prevents employees from granting dangerous access (for example, SMS, storage, contacts, accessibility, device admin, or VPN configuration permissions) that can enable credential theft or unauthorized data access.

Option B adds an extra layer for local access but does not stop a malicious app with granted permissions from accessing corporate data. Option C helps if a device is physically stolen, but it does not prevent malicious apps already running under the user context. Option D protects data at rest, yet a malicious app can still exfiltrate data once it is decrypted and accessed by the user session. Therefore, permission review is the most directly relevant missing BYOD guideline.

The correct answer is A because allowing execution from /tmp creates a direct risk that an attacker can place and run malicious binaries, scripts, droppers, or payloads from a temporary directory. In Linux, /tmp is commonly used for temporary files, and if execution is permitted, it becomes an attractive staging location after compromise. CEH malware concepts define malware as malicious software designed to gain access to target machines, steal information, harm systems, or give control to an attacker. CEH system-hacking concepts also describe malicious application execution after access, including installing malware, setting up backdoors, password crackers, and keyloggers. This risk is not SQL injection or XSS, because those are web application input attacks. It is also not primarily DoS, although malware could later cause denial of service. The immediate and best answer is malware execution because executable temporary directories let attackers run hostile code from a writable location.

The correct answer is D because Telnet is insecure by default. Telnet is an older remote access protocol that provides command-line access to remote systems, but it does not encrypt communication. This means usernames, passwords, commands, and keystrokes can travel across the network in clear text and may be captured through sniffing or man-in-the-middle attacks. The CEH-aligned material specifically states that Telnet sends usernames, passwords, and keystrokes over the network as clear text, making it easy to sniff. HTTPS is secure HTTP over TLS/SSL, SFTP is file transfer protected through SSH, and SSH is a secure replacement for Telnet that uses encryption and commonly operates on TCP port 22. Therefore, compared with HTTPS, SFTP, and SSH, Telnet is the protocol that is insecure by default because confidentiality and secure authentication protection are not built into its normal operation.

CEH v13 outlines a structured approach to vulnerability assessment and exploitation. After identifying a high-severity vulnerability, the next critical step is verification and research, not immediate exploitation. This ensures accuracy, reduces false positives, and avoids unnecessary risk. CEH emphasizes that testers must validate vulnerability details, confirm version applicability, assess exploit availability (e.g., Metasploit, Exploit-DB), and evaluate potential impact. Attempting DoS attacks (Option A) is prohibited unless explicitly scoped and does not align with responsible testing. Brute-force attacks (Option B) are unrelated to software version vulnerabilities. Ignoring the issue (Option D) violates CEH methodology. The correct process is to research and verify—ensuring exploitation is safe, relevant, and authorized. This aligns with CEH’s vulnerability management lifecycle: discovery → verification → prioritization → exploitation (when allowed) → reporting.

This scenario describes a Slowloris attack, a classic application-layer DoS attack covered in CEH v13 Network and Perimeter Hacking. Slowloris works by opening many HTTP connections and sending data very slowly, preventing the server from closing the connections.

Because the connections appear legitimate, the server keeps them open, eventually exhausting its connection pool. This causes legitimate users to experience timeouts and service unavailability—exactly as described.

ICMP and UDP floods consume bandwidth, which was ruled out. Fragmentation attacks target packet handling, not application-layer sessions.

CEH v13 highlights Slowloris as particularly dangerous because it requires minimal bandwidth and bypasses many traditional DoS defenses. Therefore, Option A is correct.

The correct answer is C. Scanning Modbus Devices.

The scenario describes a targeted scan against a TCP service used by industrial controllers that support function-code exchanges for reading and writing memory/register areas. This directly maps to Modbus/TCP, which commonly runs on TCP port 502 and uses function codes to read coils, read registers, write coils, and write registers.

The referenced OT/ICS material identifies Modbus as a protocol used in industrial control systems and shows Modbus scanning examples such as modscan.py -a < target > -p 502 and modpoll -m tcp, including the use of Modbus function codes for reading input registers . Another reference also lists ICS reconnaissance using nmap -p 102,502 -sV < target_ip > and identifies port:502 modbus as a search pattern for Modbus servers commonly used in ICS environments .

Option A. Capturing Modbus/TCP traffic using Wireshark is incorrect because the scenario describes an active targeted scan, not passive packet capture.

Option B. Scanning Siemens SIMATIC S7 PLCs is incorrect because Siemens S7 communication is commonly associated with TCP port 102, not the Modbus function-code pattern described here.

Option C. Scanning Modbus Devices is correct because Modbus/TCP uses TCP port 502 and function codes for reading and writing industrial data.

Option D. Scanning Omron PLC Devices is incorrect because Omron PLC reconnaissance commonly involves protocols such as FINS, not the Modbus/TCP function-code behavior described.

Therefore, the best answer is C. Scanning Modbus Devices.

Hacktivists are the most likely category because the scenario is driven by an ideological or political motive rather than direct financial gain. The attackers selectively accessed internal systems and leaked communications, then paired the leak with a manifesto accusing the agency of biased reporting. They also publicly claimed responsibility on social media and framed the intrusion as a fight against misinformation. In CEH-aligned terminology, hacktivism commonly involves unauthorized access, defacement, doxxing, or data leakage intended to influence public opinion, embarrass a target, or push a political or social agenda. The public messaging and justification are key indicators of hacktivist intent.

The other options do not fit as well. Script kiddies typically use ready-made tools with limited sophistication and usually do not produce coordinated ideological messaging or targeted, narrative-driven leaks. Black hat hackers are defined by malicious intent, but they are most commonly associated with theft for profit, extortion, fraud, or ransomware. This incident explicitly notes there was no ransomware and no financial tampering, reducing the likelihood that profit was the primary objective. White hat hackers operate with authorization and documented scope, and they do not leak sensitive whistleblower communications or publish manifestos.

Therefore, the combination of unauthorized access, selective exposure of sensitive information, and public ideological justification aligns most strongly with hacktivists.

The correct answer is C. VeraCrypt.

VeraCrypt is the best match because it supports encrypted containers, mounted encrypted volumes, strong encryption algorithms such as AES, and hidden volumes. CEH-aligned cryptography material lists VeraCrypt among tools used for encrypting files, folders, and protective storage services . The same reference identifies AES as a block cipher supporting key lengths of 128, 192, or 256 bits .

Option A. FileVault is incorrect because FileVault is Apple’s full-disk encryption solution for macOS and does not best match encrypted containers and hidden-volume requirements.

Option B. Rohos Disk Encryption can create encrypted disks, but the combination of AES-256 support, portable encrypted containers, and hidden-volume capability most strongly identifies VeraCrypt.

Option D. BitLocker Drive Encryption is incorrect because BitLocker is primarily a Windows full-volume encryption solution. It does not provide VeraCrypt-style hidden encrypted containers.

Therefore, the best answer is C. VeraCrypt.

The correct answer is D, BOLA, or Broken Object Level Authorization. This occurs when an API accepts an object identifier supplied by the user, such as an account ID, order ID, invoice ID, or user ID, but fails to verify whether the authenticated user is authorized to access that specific object. CEH web application hacking material describes this same weakness as an authorization flaw/insecure direct object reference: an application uses IDs to distinguish users, and an attacker changes an ID value in the request to access another user’s profile. CEH material also explains that unauthorized access to another user’s resources represents horizontal privilege escalation and that function-level access issues occur when the application does not check authorization before returning protected information. Mass assignment involves binding unexpected fields, XSS involves script injection, and SQLi involves malicious database queries. The key issue here is missing object-level authorization, so BOLA is the best answer.

The correct answer is D, Terms of engagement. In CEH penetration testing methodology, testing must be performed only within the boundaries agreed upon with the client before the assessment begins. The engagement terms define what systems, networks, applications, IP ranges, testing methods, time windows, attack types, and operational limits are authorized. CEH-aligned penetration testing guidance emphasizes that the pre-attack phase includes agreeing on rules of engagement, understanding client requirements, finalizing test scope, and signing contracts before testing begins. It also states that scope should be discussed, reviewed with the customer, and described in writing, including which assets and processes are tested and how testing is performed. PCI-DSS is a payment-card security standard, not a pen-test scope document. A nondisclosure agreement protects confidential information discovered during the test. A memorandum of understanding may describe cooperation between parties but is not the best answer for limiting specific testing activities. Therefore, the terms of engagement are the document that limits the scope of your activities.

NFS Enumeration is the correct choice because the scenario is centered on TCP port 2049 and the use of a standard utility to list exported remote file systems. In CEH-aligned reconnaissance and enumeration, port 2049 is the primary service port for Network File System NFS. When a tester identifies 2049 as open on a Linux or UNIX-like host, a common next step is to enumerate NFS exports to learn which directories are shared and what access rules apply. The “standard utility” described is consistent with tools such as showmount, which queries the target to retrieve a list of exported file systems and, in some cases, the clients allowed to mount them. This directly supports the stated objective of “requesting a list of remote file systems shared across the network” to map accessible resources.

The distractor checks mentioned in the scenario reinforce why the answer is NFS. Telnet enumeration would relate to TCP 23 and interactive plaintext terminal access, not file-share exports. NTP enumeration aligns to UDP 123 and focuses on time synchronization information and server behavior, not shared directories. SNMP enumeration typically involves UDP 161 and extracts device and system details via community strings and management information bases. NetBIOS enumeration is associated with Windows networking services such as UDP 137 and TCP 139, which are unrelated to NFS on 2049.

Therefore, the active enumeration method demonstrated is NFS enumeration through export listing on TCP port 2049.

AES is the industry-standard symmetric encryption algorithm endorsed by CEH v13. It provides strong confidentiality and resists traffic analysis when used with proper modes (e.g., CBC, GCM).

DES is obsolete, HMAC ensures integrity not encryption, PSA is not a standard encryption algorithm.

Thus, Option B is correct.

The Certified Ethical Hacker (CEH) Cloud Computing module emphasizes that serverless environments rely heavily on granular permission models. Attacks involving compromised APIs often succeed because functions are granted excessive privileges.

Option D is correct because enforcing function-level permissions and the principle of least privilege directly limits what a compromised function can execute. CEH documentation states this is the primary defense against serverless abuse.

Option A is beneficial but reactive.

Option B focuses on SaaS governance rather than FaaS execution control.

Option C provides visibility but does not directly prevent privilege misuse.

CEH highlights identity and access management (IAM) as critical in serverless security.

The activity described is passive session hijacking because Sarah is only observing and capturing session-related information without altering, injecting, or disrupting the live client server communication. In CEH coverage of session hijacking, the key distinction is whether the attacker merely eavesdrops to obtain session identifiers or actively takes control of the session in real time. Passive hijacking focuses on sniffing traffic to collect authentication material such as session IDs, cookies, bearer tokens, or other credentials transmitted in cleartext or exposed through weak transport protections. The prompt explicitly says she “quietly collects session data” and does so “without interfering,” which is the hallmark of passive hijacking.

This is commonly feasible when applications use unencrypted HTTP, weak TLS configurations, or when tokens are exposed in ways that can be captured on the network. Once obtained, the attacker can replay or reuse the stolen token to impersonate the victim, which matches Sarah’s plan to later use the captured tokens to demonstrate risk in a controlled environment. CEH emphasizes that session tokens effectively become the user’s identity after authentication; if an attacker can steal them, they can often bypass login entirely.

Option B, active session hijacking, would involve manipulating the connection, injecting packets, desynchronizing the client, or taking over the session live. Option A, session fixation, involves forcing a victim to use a session ID chosen by the attacker, not sniffing. Option C, man-in-the-browser, requires malware within the browser to intercept or modify transactions, which is not described. Therefore, Passive Session Hijacking is correct.

The correct answer is D. Brute force. A brute-force attack is a password-cracking method that systematically attempts every possible combination of characters until the correct password is discovered. Because it does not rely on precompiled wordlists, common passwords, or previously generated hash databases, it is considered the most exhaustive and time-consuming password-cracking technique.

In CEH password-attacking concepts, a dictionary attack is generally faster because it uses a predefined list of commonly used passwords and words. Rainbow tables are even faster in many situations because they rely on precomputed hash values that can be matched against captured password hashes. Shoulder surfing is not a technical password-cracking method; it involves directly observing a user entering credentials.

The effectiveness and duration of a brute-force attack depend on password complexity, length, character set, account lockout policies, and available computing power. Strong passwords containing uppercase letters, lowercase letters, numbers, and special characters significantly increase the number of possible combinations, making brute-force attacks far more difficult and time-consuming.

CEH Exam Tip:

Dictionary Attack = Faster, wordlist-based.

Rainbow Tables = Precomputed hash lookup.

Brute Force = Tries every possibility; most time and effort required.

Shoulder Surfing = Social engineering observation technique.

Therefore, Brute Force is the correct answer.

In CEH-aligned vulnerability assessment reporting, the Findings section is where the assessor documents what was discovered during scanning and validation in a clear, structured, and actionable way. This portion of the report typically contains the concrete results: identified assets, affected systems, vulnerability details, and evidence that supports each issue. The question states that Nikhil lists the IP addresses of scanned hosts, identifies which machines are affected, and includes tables categorizing vulnerabilities such as outdated software, default credentials, and open ports. These are classic “results” artifacts that belong in Findings because they communicate the observed security weaknesses and where they exist.

The Risk Assessment section generally builds on findings by assigning severity, likelihood, impact, and overall risk ratings, often mapping issues to business consequences and prioritization. While Nikhil may later rate default credentials as critical or open ports as medium depending on exposure, the act of enumerating vulnerabilities and associating them with specific hosts is the findings activity, not risk scoring.

Supporting Information usually contains appendices such as tool configurations, raw scan outputs, methodology references, assumptions, scope boundaries, and glossary items. Although IP lists and tables might appear in an appendix for completeness, the way the prompt describes them, they are being used as the primary categorized presentation of discovered vulnerabilities, which is consistent with the Findings section.

Assessment Overview is typically a high-level summary of scope, objectives, timeline, and approach, not detailed host-by-host vulnerability tables. Therefore, the correct section is Findings.

The correct answer is D. Set Passwords for Apps to Restrict Others from Accessing Them.

The device already has an operating system passcode, but the weakness appears after the phone is unlocked. The financial application opens directly to sensitive dashboards without requiring any additional application-level authentication. The most direct mitigation is to require a separate password, PIN, biometric prompt, or reauthentication control for sensitive corporate applications.

CEH mobile/BYOD material explains that BYOD introduces security and control challenges because personally owned smartphones and tablets access organizational resources. Mobile Device Management solutions commonly enforce policies such as passcodes, remote locking, remote wipe, root/jailbreak detection, application deployment, monitoring, and policy enforcement .

Option A. Use Encryption Mechanism to Store Data is important for protecting data at rest, especially if the device is lost, but it does not stop access after the phone is already unlocked.

Option B. Set a Strong Passcode on the Device and Change It Relatively Often is already partially implemented because the OS requires a passcode. The issue is lack of app-level verification.

Option C. Maintain a Clear Separation between Business and Personal Data is useful for BYOD governance, but it does not directly prevent an unlocked device from opening sensitive dashboards.

Option D. Set Passwords for Apps to Restrict Others from Accessing Them is correct because it directly mitigates unauthorized access to corporate apps after device unlock.

Therefore, the best answer is D. Set Passwords for Apps to Restrict Others from Accessing Them.

CEH teaches that ARP-based attacks vary in sophistication from basic poisoning to more specialized techniques such as switch port stealing. In environments where ARP poisoning defenses or inspection tools limit traditional attacks, attackers may exploit timing vulnerabilities in ARP reply behavior. Switch port stealing works by sending spoofed ARP replies at precisely the right moment—before the legitimate ARP response from the target host—causing the switch’s CAM table to update temporarily and associate the target’s IP address with the attacker’s MAC address. CEH emphasizes that switches trust the latest ARP update, so even brief timing windows enable partial packet interception. This is different from fully persistent ARP poisoning, which continuously overwrites ARP tables, and from passive sniffing, which cannot capture unicast traffic on a switched network. This attack is particularly useful when ARP spoofing is mitigated because it relies on opportunistic timing rather than full table poisoning. The intermittent nature of intercepted packets matches CEH’s description of switch port stealing behavior.

The correct answer is A. Footprinting through Social Networking Sites.

The scenario describes the collection of intelligence from platforms where employees publish professional profiles, technical competencies, workplace relationships, project references, and organizational terminology. This is a classic example of footprinting through social networking sites.

CEH reconnaissance material identifies Footprinting through Social Networking Sites as a specific footprinting methodology . It also explains that social networking platforms can provide information such as personal details, work details, technology-related information, employee lists, activities, interests, and the nature of business . This directly matches the scenario’s use of employee profiles, skills, conversations, and terminology to infer internal structure and technologies.

Option B. Footprinting through Internet Research Services is incorrect because that usually refers to using online lookup services, business intelligence sites, public directories, or specialized research platforms rather than employee social networking activity.

Option C. Footprinting through Social Engineering is incorrect because the scenario does not involve manipulating or deceiving people into revealing information. The information is collected passively from publicly available profiles and discussions.

Option D. Footprinting through Search Engines is incorrect because the scenario does not primarily describe Google/Bing search operators or cached search results. It focuses on social networking platforms.

Therefore, the best answer is A. Footprinting through Social Networking Sites.

The correct answer is C. Preparation.

The activity described occurs before credential abuse, lateral movement, persistence, or internal expansion. The adversary is gathering intelligence, mapping exposed services, preparing exploit frameworks, and testing malware against defensive tools. These actions represent the pre-attack preparation stage of an Advanced Persistent Threat.

APT activity is characterized by defined objectives, long-term probing, advanced resources, specialized skills and methods, and a high tolerance for remaining undetected . The scenario clearly describes these characteristics: the attacker spends months gathering intelligence, building tools, testing malware, and preparing a coordinated attack plan.

Option A. Persistence is incorrect because persistence occurs after initial access, when the attacker establishes a way to maintain access to the compromised environment.

Option B. Expansion is incorrect because expansion involves moving deeper into the environment, escalating privileges, or spreading laterally after compromise.

Option D. Initial Intrusion is incorrect because initial intrusion refers to the first successful compromise of the target environment. The scenario specifically states that these activities occurred before credential abuse or lateral movement.

Therefore, the best answer is C. Preparation.

According to CEH v13 System Hacking and Web Application Hacking, once reconnaissance and footprinting are complete, attackers typically move into controlled exploitation while maintaining stealth. Since the CEH has already identified a session hijacking vulnerability, leveraging that weakness is the most logical and stealthy progression.

Session hijacking allows attackers to impersonate legitimate users without triggering authentication alerts, making it significantly less detectable than brute-force or scanning activities. Option B aligns with CEH methodology: hijacking a valid session provides authorized-level access, which can then be abused to make configuration changes discreetly.

SQL injection (Option A) may trigger database errors and IDS alerts. Brute-force attacks (Option C) are noisy and easily logged. Automated vulnerability scanning (Option D) generates excessive traffic and is typically avoided once exploitation begins.

CEH v13 emphasizes using already-identified weaknesses and minimizing footprint during exploitation. Therefore, Option B is correct.

The correct answer is D. ADB Exploitation via TCP 5555.

The scenario describes Android devices accepting remote debugging connections over the network without USB. The high-numbered port commonly associated with Android Debug Bridge over TCP is 5555. When ADB is exposed over TCP, an attacker may interact with the device remotely, issue commands, install packages, forward ports, capture screenshots, and enumerate applications depending on device state and authorization controls.

CEH-aligned mobile testing material identifies ADB, or Android Debug Bridge, as the mechanism used to connect to Android devices for testing and control operations . The scenario’s description of wireless remote debugging and command execution aligns with exposed ADB over TCP.

Option A. Device Administration API Abuse is incorrect because the Device Administration API provides enterprise-style management controls such as policy enforcement or remote wipe, not open remote debugging over TCP 5555.

Option B. FRP Bypass is incorrect because Factory Reset Protection bypass concerns bypassing Google account protection after reset.

Option C. Android Rooting is incorrect because rooting grants privileged control locally, but the scenario specifically points to exposed remote debugging over the network.

Option D. ADB Exploitation via TCP 5555 is correct because the devices are accepting ADB-style remote control over the wireless network.

Therefore, the best answer is D. ADB Exploitation via TCP 5555.

The correct answer is C. MITRE ATT & CK. In CEH v13-aligned security operations and threat intelligence concepts, MITRE ATT & CK is used to understand and map adversary behavior during cyberattacks. ATT & CK stands for Adversarial Tactics, Techniques, and Common Knowledge. It organizes attacker actions into tactics, techniques, and sub-techniques, helping security teams understand what an attacker is trying to achieve and how the attacker may perform each step. Tactics represent the attacker’s objective, such as initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, command and control, exfiltration, and impact. Techniques describe the specific methods used to achieve those objectives. NIST CSF 2.0 is a cybersecurity risk management framework, not a detailed adversary TTP framework. ISSF is not the standard CEH answer for adversary behavior mapping, and ISC 28901 is not used for cataloging cyberattack TTPs. Therefore, MITRE ATT & CK is the best answer.

Untethered jailbreaking is the only option that matches all key characteristics described: the device can reboot normally without needing a computer, and the jailbreak remains active after the restart with kernel-level modifications still in effect. In CEH-aligned mobile security concepts, the main difference among jailbreak types is what happens after a reboot.

A tethered jailbreak requires a computer to boot the device at all. If the phone restarts without being connected to a computer, it will not complete the boot process. That contradicts the scenario, which explicitly says the device can fully restart without requiring a computer. A semi-tethered jailbreak allows the phone to reboot without a computer, but it boots into a non-jailbroken state, meaning elevated privileges and kernel patching are not active until re-enabled through a tool. A semi-untethered jailbreak is similar in that it can boot normally without a computer, but the jailbreak does not persist automatically; it typically requires re-activating the jailbreak after each reboot to regain kernel patching and privileged access.

The scenario states the restart occurs while still “maintaining a patched kernel” and continuing access to protected filesystem data, which indicates persistence across reboot. That persistence is the defining feature of an untethered jailbreak. From a defensive and assessment perspective, this is considered higher risk because it provides continuous post-reboot privileged access, increasing the window for data access, tampering, and persistence mechanisms compared with reboot-reset jailbreak states.

The CEH web server attack methodology describes reconnaissance as a key phase, where testers gather publicly available information before attempting exploitation. Robots.txt is commonly used by administrators to instruct web crawlers about which directories should not be indexed. CEH emphasizes that attackers regularly review robots.txt because it often exposes sensitive directories unintentionally, providing valuable intelligence about internal structure, configuration paths, administrative pages, and potential weak points. In this scenario, the tester observes “Disallow” entries and then discovers the directories are not protected by authentication, allowing direct access to sensitive files. This falls under information gathering through exposed indexing instructions rather than directory traversal, which involves path-manipulation exploits. The tester is not altering file paths or inserting traversal sequences; instead, they are reviewing publicly available indexing instructions and discovering misconfigured access controls. This perfectly aligns with the reconnaissance phase of the CEH methodology, where attackers learn about server architecture using passive or minimally intrusive techniques.

The KRACK (Key Reinstallation Attack) vulnerability is a critical WPA2 flaw covered extensively in CEH v13 Wireless Network Hacking. KRACK exploits weaknesses in the four-way handshake process, allowing attackers to force reinstallation of encryption keys.

This key reinstallation resets nonces and counters, enabling attackers to decrypt, replay, and forge packets, even on encrypted WPA2 networks. CEH v13 highlights that KRACK does not break encryption mathematically but exploits protocol logic flaws.

Hole196 affects GTK misuse, and WPS PIN attacks target authentication, not replay of encrypted traffic. Weak RNG issues are unrelated to WPA2 replay.

Thus, Option B is correct.

In CEH v13 Maintaining Access, stealth and persistence are key goals after compromise. Placing a backdoor in a file type excluded from resource maps (such as image metadata, configuration files, or uncommon extensions) reduces the likelihood of discovery by automated scanners and integrity checks.

Option D is correct because many security tools focus on executable or commonly accessed web files. Files excluded from resource maps are less likely to be scanned or monitored.

Option A increases detection risk due to frequent changes. Option B increases signature visibility. Option C still exposes the file to access logs and monitoring.

CEH v13 highlights that attackers often hide backdoors in non-obvious locations to avoid detection. Therefore, Option D is correct.

This scenario aligns with a Replay Attack against RF-based smart key systems, covered in CEH v13 IoT and OT Hacking. Attackers capture radio-frequency signals transmitted by key fobs and replay them to unlock vehicles.

CEH v13 emphasizes that detecting and preventing such attacks requires monitoring wireless RF signals for anomalies such as signal replay, interference, or jamming patterns. RF analysis helps confirm unauthorized signal capture and retransmission.

Firmware updates may mitigate future vulnerabilities, but confirmation requires RF monitoring. Physical surveillance and smartphone malware controls are unrelated to RF replay attacks. Therefore, option D is correct.

The correct answer is C. Reconnaissance. In CEH methodology, reconnaissance is the initial information-gathering phase where an ethical hacker collects details about the target before deeper testing begins. CEH-aligned material defines reconnaissance as gathering information about a target using active or passive means, and it commonly includes discovering network ranges, live hosts, open ports, operating system details, services, and organizational information. Active reconnaissance involves direct interaction with the target, such as sending probes, scans, or packets, which can provide accurate information but may be detected. Passive reconnaissance collects information without directly contacting the target, often using public sources such as websites, social media, WHOIS, DNS records, and search engines. Obfuscation is related to hiding activity, exploitation refers to using a vulnerability to gain access, and denial of service focuses on disrupting availability. Therefore, the step known for active and passive information gathering is Reconnaissance.

CEH v13 explains that Windows systems running older or default configurations often allow anonymous or null session connections to IPC$ shares, enabling attackers to enumerate users, groups, shares, and other system details without authentication. Null session enumeration is highlighted as a classic yet effective technique because it generates minimal detectable activity and does not require credentials, making it ideal for stealth operations. CEH stresses that SMB null sessions are frequently overlooked in legacy or poorly hardened environments, especially when default permissions remain unchanged. Packet sniffing (Option A) may provide some data but requires traffic visibility and may be detected through monitoring tools. DNS zone transfers (Option B) require misconfigurations and usually do not reveal user list details. SNMP queries (Option D) require community strings and often generate alerts. Therefore, exploiting null sessions is the most covert and effective method for enumerating Windows systems under default configurations.

The scenario describes an on-device, app-based rooting approach that does not rely on a PC connection, USB debugging, or a bootloader unlock workflow. In CEH mobile platform coverage, this aligns with “one-click” rooting tools that package exploits to elevate privileges directly from user space to root on the device. These tools typically target known vulnerabilities in the Android OS, vendor kernels, or system services to obtain root privileges and then install a management component to maintain elevated access.

KingoRoot is commonly cited in ethical hacking training contexts as a popular one-click rooting solution that can run as an Android application and attempt to root a device without a computer, depending on the device model, Android version, and patch level. This directly matches the prompt: Sofia installs a mobile application, it “exploits a system vulnerability,” and it achieves root “without requiring a PC.” The constraints given, USB debugging disabled and OEM unlock restrictions, make PC-assisted ADB workflows or bootloader-based rooting less feasible, which further supports an exploit-driven, on-device rooting tool.

Magisk Manager is primarily a root management and systemless modification framework and typically assumes the device is already rooted or that the user can patch the boot image and flash it, often requiring bootloader unlock steps that OEM restrictions would block. “One Click Root” is a generic label rather than a specific tool in many CEH-style question banks. RootMaster is another one-click tool, but KingoRoot is the most widely recognized and frequently referenced for direct APK-based rooting in this context.

The correct answer is Credentialed Scanning. CEH vulnerability assessment guidance explains that credentialed scans use authorized login access on the target system so the scanner can inspect the machine from the inside with a much higher level of accuracy and detail. That is why credentialed scanning can identify installed updates, local policy settings, configuration inconsistencies, file permissions, registry issues, and patch gaps that are not always visible from an external network perspective. The question specifically mentions granular host-level findings that required direct system-level inspection, which is a strong indicator that valid credentials were used to query the target systems. Non-credentialed scanning, by contrast, relies on remote observation and network-visible characteristics, so it generally cannot provide the same depth of internal host information. Automated scanning is too broad a label, and application scanning is limited to application-layer targets rather than host operating-system posture. CEH materials consistently note that credentialed scans produce more accurate vulnerability results and reduce false positives because the scanner can verify software versions, patch states, and security settings directly on the target machine rather than merely inferring them from banners or exposed services.

The correct answer is B because the question directly describes a web application deserializing untrusted data, which is the classic condition for insecure deserialization. Deserialization is the process of converting serialized data back into an object or usable program structure. When an application accepts serialized data from an untrusted source and processes it without proper validation, integrity checking, or type restrictions, an attacker may manipulate the serialized object and influence application logic. In serious cases, this can result in remote code execution, privilege escalation, authentication bypass, or application takeover. The CEH web application security material maps this issue to OWASP web risks, where insecure deserialization is identified as a flaw that can lead to remote code execution attacks, which are among the most severe application impacts. SSTI involves server-side template injection, SQLi targets database queries, and XSS executes script in a user’s browser. Since the question specifically mentions untrusted deserialized data causing RCE, the precise flaw is insecure deserialization.

The scenario describes user input being passed into system-level execution and causing “unintended operations at the system level,” which is the defining behavior of command injection in CEH web application hacking coverage. Command injection occurs when an application constructs or invokes operating system commands using unsanitized, user-controlled input. By inserting shell metacharacters or command separators such as ;, & & , |, or backticks, an attacker can cause the server to execute additional commands beyond what the developer intended. The impact often includes reading sensitive files, listing directories, creating users, downloading malware, pivoting, or otherwise interacting with restricted server resources, matching the prompt’s “access to restricted server resources.”

The question also rules out other injection families. LDAP injection targets directory service queries and manipulates LDAP filters, which the prompt explicitly excludes. CRLF injection involves inserting carriage return and line feed characters to manipulate HTTP headers or split responses; it does not primarily produce OS-level execution. “Shell Injection” is sometimes used informally to describe the same concept, but in CEH-style terminology and exam question patterns, the standard label for injecting into OS command execution is Command Injection, making option D the best and most precise answer.

Effective mitigations emphasized in CEH-aligned guidance include avoiding OS command calls where possible, using safe APIs that do not invoke shells, strict allowlisting and canonical validation of input, proper escaping for the target interpreter when needed, running services with least privilege, and applying segmentation and monitoring to limit blast radius.

\

CEH v13 explains that reflected XSS occurs when malicious input supplied by an attacker is immediately returned in the HTTP response without sanitization. This type of XSS is typically exploited through a crafted URL containing embedded JavaScript payloads. When a victim clicks the link, the vulnerable server reflects the injected script back to the browser, executing it within the user’s session context. CEH emphasizes that reflected XSS relies on social engineering to deliver the payload, often via links sent through email, messaging platforms, or compromised pages. The goal may include stealing session cookies, redirecting users, or manipulating page content. Brute-forcing credentials (Option A) has no relation to XSS. SQL injection (Option C) targets backend databases, not client-side script execution. Directory traversal (Option D) concerns file path manipulation, not dynamic script injection. Therefore, embedding a malicious script in a URL is the correct method to exploit reflected XSS.

CEH’s social engineering principles highlight psychological manipulation techniques such as authority, urgency, trust exploitation, and impersonation. In this scenario, the attacker leverages “perceived authority,” a powerful influence tactic where the social engineer poses as someone with legitimate power or sanctioned access—such as a technician, auditor, or vendor representative. CEH emphasizes that referencing real employee names, using technical terminology, and impersonating trusted third-party partners increases believability and reduces verification resistance. The receptionist’s acceptance of the attacker’s presence without verifying credentials matches classical authority-based exploitation. Leaked credentials, physical security logs, and network segmentation issues do not relate to human-layer social engineering. The situation clearly reflects the manipulation of trust and authority as described in CEH’s psychological attack vectors.

The risk described is increased attack surface caused by unnecessary services and protocols running on a web server—specifically NetBIOS and SMB. The most direct hardening action to mitigate this is to block/disable unnecessary ports and protocols so they are not exposed to the network and cannot be abused by attackers. Option D captures that principle: reduce exposure by closing ports and restricting protocols that are not required for the server’s role.

A well-hardened web server should run only the services needed to deliver its intended web functionality (e.g., HTTP/HTTPS and necessary management interfaces under strict control). Services like SMB (commonly TCP 445/139) and NetBIOS (UDP 137/138, TCP 139) are not normally required for public-facing web hosting and are frequent targets for enumeration and exploitation. Leaving such services open can enable attackers to perform credential attacks, exploit legacy vulnerabilities, access shared resources, or pivot further into the environment. By blocking or disabling these ports at the host firewall and/or perimeter firewall, the organization reduces reachable attack paths and limits what an external attacker can interact with.

Why the other options are less direct:

Dedicated machine (A) can help separation of duties, but if unnecessary services still run, the attack surface remains.

Risk assessment for patching (B) is important, but it doesn’t immediately remove the exposure created by unneeded services.

Eliminating unnecessary files (C) addresses file-system exposure, not open network services like SMB/NetBIOS.

Because the problem is explicitly about unnecessary open services/protocols, the best mitigation is D. Block all unnecessary ports, ICMP traffic, and protocols (i.e., minimize exposed services).

The correct answer is D, Least privilege. In Linux, sudo temporarily grants elevated/root-level privileges to execute administrative commands. The CEH-aligned principle of least privilege requires that users, services, and processes receive only the minimum permissions needed to perform their authorized tasks. Allowing passwordless sudo for multiple commands weakens this control because a normal user can execute privileged actions without reauthentication, increasing the risk of accidental misuse, insider abuse, credential compromise, or privilege escalation. CEH materials emphasize least privilege as an authorization control and also note that sudo provides temporary root privileges. Zero trust is broader and focuses on continuous verification, defense in depth uses layered controls, and CIA refers to confidentiality, integrity, and availability. The specific misconfiguration here is excessive privilege assignment, so the violated security principle is least privilege. A secure configuration should tightly scope sudo permissions to only required commands and users, require authentication where appropriate, and log privileged actions.

The correct answer is A, Static Network Address Translation. Static NAT creates a fixed one-to-one mapping between a public IP address and a specific private/internal IP address. This is the correct choice when an internal server must be reachable from outside the network using the same public address every time, which is commonly called server publishing or exposing a service through a firewall/router. CEH networking material explains that NAT is used at network borders and that basic NAT provides one-to-one mapping where each internal private IP maps to a unique public address; return traffic is translated back to the corresponding internal host. NAT also hides internal addressing while rerouting externally addressed packets to the proper internal system. Port Address Translation or NAT overload is different because many internal hosts share one public IP using ports/session IDs, so it does not guarantee one public IP always maps to one internal machine. Therefore, static NAT is the best answer.

This scenario demonstrates tailgating, which is gaining unauthorized physical access to a secure area by following an authorized person through an access-controlled entry point. Priya does not present credentials, swipe a badge, or otherwise authenticate; instead, she leverages normal human behavior and social assumptions during a busy shift change. Because employees assume she belongs there and do not challenge her, she successfully bypasses the physical access control.

Tailgating is common in workplaces with high traffic, open-plan culture, or weak enforcement of “no badge, no entry” rules. Attackers may exploit politeness, distraction, or the desire to hold doors open. It is especially effective during shift changes, deliveries, or when people are carrying items and appreciate someone holding the door. The security weakness being tested here is not the badge technology itself but the human factor: lack of challenge culture and inconsistent adherence to access policies.

Tailgating versus piggybacking: in many security references, piggybacking implies the authorized person knowingly allows the other to enter (e.g., holds the door intentionally after being asked). Tailgating typically implies the intruder enters without explicit permission, often by slipping in behind a group. In this scenario, no one confronts her and they “assume she belongs there,” indicating she is following them in without asking or being granted explicit permission—tailgating.

The other options are unrelated: shoulder surfing is visual observation of sensitive input; dumpster diving is retrieving information from trash. Therefore, the correct answer is C. Tailgating.

The correct answer is D. Post-Exploitation.

The scenario clearly occurs after initial access has already been obtained. The tester is no longer only discovering assets, identifying vulnerabilities, or exploiting the first weakness. Instead, the tester is modifying logging configurations, creating alternate access keys, maintaining persistence, and mapping privilege relationships inside the cloud tenant.

This aligns with the post-exploitation stage, where the tester evaluates what can be done after compromise, including maintaining access, enumerating privileges, understanding internal trust relationships, and documenting the impact of the compromise.

CEH-aligned methodology separates early activities such as information gathering and vulnerability scanning from later phases such as gaining access and maintaining access. The referenced methodology describes information gathering as collecting details such as IP addressing, protocols, open ports, device types, and vendor information, while later phases include gaining access, privilege escalation, backdoor installation, maintaining access, clearing logs, and covering tracks .

Option A. Exploitation is incorrect because exploitation is the phase where the initial vulnerability is actively used to gain access. In this scenario, the exposed credential has already been used.

Option B. Information Gathering is incorrect because the tester is not merely collecting external or pre-compromise information. The activity is taking place inside the cloud tenant after compromise.

Option C. Vulnerability Assessment is incorrect because vulnerability assessment focuses on identifying and validating weaknesses, not persistence, access key creation, or internal privilege mapping.

Option D. Post-Exploitation is correct because the tester is operating after compromise to maintain access and assess the internal impact.

Therefore, the best answer is D. Post-Exploitation.

Once the base DN is identified through LDAP namingContexts, CEH teaches that the next step in enumeration is to query the directory tree using this DN. This allows retrieval of users, groups, computers, and other AD objects. LDAP-based enumeration requires valid search filters rooted in the base DN.

The correct answer is Search Engine Phishing. CEH social engineering material explains that search engine phishing involves creating fraudulent websites and manipulating search visibility so that victims discover and visit the malicious site through search results rather than through a direct email or message lure. In this scenario, patients searching for the clinic’s appointment system are led to a fake portal that closely resembles the official one and is positioned prominently in search engine results. That is the defining pattern of search engine phishing. Pharming would involve silently redirecting users to a fraudulent site through DNS or host-resolution manipulation, but the question specifically states that internal DNS servers were not altered and that users voluntarily navigated there through search results. Spear phishing would require targeted communications sent directly to victims, and whaling is aimed at high-profile executives. CEH guidance emphasizes that search engine phishing can be especially effective because users believe they are independently finding the legitimate service. Since the attacker relied on a cloned portal and manipulated search visibility rather than direct messaging or DNS tampering, Search Engine Phishing is the best answer.

The correct answer is D, Rules of engagement. In CEH pre-engagement concepts, the rules of engagement document defines the authorized boundaries of a penetration test before any testing begins. It specifies what testing techniques are permitted, which systems or networks may be tested, when testing may occur, what actions are prohibited, whom to contact during emergencies, and how incidents such as service disruption should be handled. It also helps protect the penetration tester by documenting client approval and limiting liability when the tester acts within the agreed boundaries. A project scope may list targets, IP ranges, applications, or business units included in testing, but it does not fully cover operational permissions and liability terms by itself. A nondisclosure agreement protects confidential information discovered during the engagement. A service-level agreement defines service expectations such as uptime, response time, or support obligations. Therefore, the document that best matches allowed testing, timing, and tester liability limits is the Rules of engagement.

The correct answer is C. Sequential Tokens.

The scenario states that session identifiers contain constant portions and other portions that change in a predictable progression. The tester can anticipate future valid identifiers by analyzing an incremental pattern. That is the defining characteristic of sequential token generation.

CEH web application material identifies session token prediction as a session management attack used to impersonate legitimate users when predictable session values can be guessed or derived .

Option A is incorrect because small token space means there are too few possible token values, making brute-force guessing easier.

Option B is incorrect because timestamp-based tokens are derived mainly from time values. The scenario emphasizes an incremental sequence, not direct timestamp derivation.

Option D is incorrect because a weak PRNG may produce predictable values, but the question specifically describes a sequential pattern.

Therefore, the best answer is C. Sequential Tokens.

The technique described is RST hijacking because the attacker sends spoofed TCP packets with the RST (reset) flag to forcibly terminate established TCP sessions. In TCP, an RST packet is used to immediately abort a connection. If an attacker can craft packets that appear to belong to an existing session (matching the 4-tuple and using plausible sequence/acknowledgment values), the receiving endpoint may accept the reset and tear down the connection. This creates disruption—sessions drop, users are disconnected, and applications experience errors—without the attacker needing to fully take over the session or inject meaningful application data.

The scenario matches this exactly: “spoofed TCP packets carrying the reset flag,” followed by “active sessions…abruptly terminated.” That is the hallmark outcome of RST-based session disruption. It is often used as a demonstration of how fragile sessions can be when attackers can spoof traffic within a path (or on the same network segment) and when defensive controls do not validate or protect sessions adequately.

Why the other options are incorrect:

UDP hijacking (A) doesn’t apply because UDP is connectionless and has no RST flag or session teardown mechanism like TCP.

Blind hijacking (C) refers to injecting traffic without seeing responses (guessing sequence numbers), but the specific mechanism asked here is the reset-flag termination; “blind” could be a property of how it’s done, not the named technique.

TCP/IP hijacking (D) is a broader category that includes multiple methods of taking over or manipulating TCP sessions. The question is specifically about using RST packets to kill sessions, which is most precisely called RST hijacking.

Therefore, the correct answer is B. RST Hijacking.

The correct answer is C. Overwriting Data/Metadata.

The key clue is that the file contents could not be reconstructed because the physical sectors no longer contained recognizable fragments of the original material. Simple deletion removes file references from directory structures, but the underlying data may still remain recoverable until overwritten. Here, the original sector contents were replaced, which indicates overwriting.

Option A. Data Hiding in File System Structures is incorrect because the data was not hidden in alternate file system locations or metadata structures.

Option B. Data/File Deletion is incorrect because ordinary deletion would usually leave recoverable data remnants.

Option D. Artifact Wiping is broader and often refers to removing traces such as logs, history, temporary files, or forensic artifacts. The scenario specifically describes replacement of file-sector contents.

Therefore, the best answer is C. Overwriting Data/Metadata.

The correct answer is B, Hacktivists. In CEH hacker-classification concepts, hacktivists are attackers who use hacking techniques to support a social, religious, ideological, or political cause. CEH-aligned material describes hacktivism as actions intended to put forward a cause or political agenda, affect societal change, or highlight perceived political injustice. Another CEH-aligned explanation states that these individuals may hack servers, deface websites, create viruses, and cause disruption because they believe their actions will force social change or bring attention to an issue. Gray hat hackers may reveal vulnerabilities without permission, but their primary motivation is not necessarily social change. Ethical hackers, or white hats, work defensively with authorization and prior consent, not through illegal defacement. Black hat hackers usually act for malicious intent, personal gain, data theft, or service disruption. Therefore, the group specifically associated with hacking and website defacement to promote social or political change is Hacktivists.

CEH v13 explains that cryptographic consistency is essential for secure session management. Variable token lengths can leak information about encryption methods, key sizes, or user privilege levels, making sessions vulnerable to cryptanalysis or targeted attacks.

The most effective mitigation is implementing uniform encryption strength across all roles, ensuring consistent key sizes, algorithms, and token formats. While MFA improves authentication and key rotation improves lifecycle management, neither directly resolves cryptographic inconsistency.

CEH v13 stresses that encryption should be role-agnostic and standardized. Therefore, Option C is correct.

The correct answer is A. Passive attack because the activity described involves monitoring and capturing information without altering data, system resources, or communications. In CEH-aligned information security concepts, passive attacks are defined by the attacker’s goal of eavesdropping— observing traffic to collect intelligence such as usernames/passwords, session identifiers, network patterns, or sensitive content—while making minimal changes that would trigger detection. The scenario explicitly states that the actor is “silently capturing clear-text credentials” and “analyzing unencrypted traffic,” and that “no modifications have been made to the data.” These are signature indicators of passive attacks such as packet sniffing and traffic analysis.

On an internal Wi-Fi network, passive attacks are particularly effective when encryption is weak or absent, or when users access services that transmit credentials in clear text. An attacker can capture packets and reconstruct sensitive information, especially where legacy protocols or misconfigurations exist. Because passive attackers do not need to inject or modify packets, they often avoid generating anomalies such as retransmissions, spoofed responses, or unexpected routing changes—helping them remain undetected, consistent with the prompt.

Why the other options do not fit: Distribution attack is not the standard classification for this behavior and does not specifically describe silent observation of traffic. Close-in attack refers to attacks that depend on physical proximity (e.g., shoulder surfing, physical tapping, local interception near the target). While Wi-Fi sniffing can require proximity, the defining characteristic in the question is the non-invasive observation with no data modification—i.e., passive attack. Insider attack relates to the attacker’s identity/role (a trusted internal person), which is not established here; the scenario only describes behavior, not who the actor is.

Therefore, the described credential capture and traffic analysis without modification most clearly indicates a passive attack.

The correct answer is B because encryption, decryption, translation, compression, and data formatting are core functions of the OSI Presentation layer, which is Layer 6. The CEH networking material states that the Presentation layer formats data for the Application layer, translates data into a common format, and that data compression and encryption occur at this layer. In the scenario, PKI is used to protect a sensitive email so that only user B can read it. CEH cryptography concepts explain that asymmetric encryption uses separate keys: the recipient’s public key is used to encrypt the data, and the recipient’s private key is used to decrypt it. Although email itself is an application-layer service, the OSI function of encoding, encrypting, and decrypting message data maps to the Presentation layer. Transport handles end-to-end delivery, Session manages conversations, and Application provides user-facing network services. Therefore, the best answer is Presentation.

The described bypass is most consistent with using an in-line comment technique. Many simplistic SQL injection filters look for specific “blocked” keywords such as SELECT, UNION, OR, or DROP as contiguous strings. If the tester breaks a keyword apart by inserting tokens the database will ignore—most commonly comment delimiters—the filter may fail to match the forbidden keyword, while the SQL parser still reconstructs the intended meaning. For example, inserting comment markers inside a keyword can cause the application-layer filter to miss the pattern, yet the database can still process the statement depending on the DBMS and parsing rules. This is why comment-based obfuscation is a common SQLi evasion approach against weak signature filters.

The scenario’s wording “broken apart with unexpected symbols” maps well to comment markers such as /**/ (or other DBMS-specific comment forms). These characters look “unexpected” to a naïve filter, but to the SQL engine they are treated as comments/whitespace and effectively ignored during parsing, allowing the attacker’s intended keyword to be interpreted correctly.

Why the other options are less aligned:

String concatenation (A) is an obfuscation approach where attackers build keywords/strings using concatenation operators or functions (DBMS-specific). The scenario emphasizes splitting keywords with symbols that the DB interprets correctly as separators/ignored content, which more directly matches comment insertion.

Hex encoding (B) encodes parts of a payload (strings, sometimes function names) in hexadecimal form. That is a different technique than splitting keywords with inserted symbols.

Null byte (D) is historically used to terminate strings in certain contexts (more common in older file/path handling bugs) and is not the primary technique for bypassing keyword filters in modern SQL parsing.

Therefore, the SQL injection evasion technique is C. In-line Comment.

This scenario most clearly illustrates shoulder surfing, a social engineering technique where an attacker obtains sensitive information by observing a victim’s screen, keystrokes, or written notes—often from a nearby position—without directly interacting with the victim or their device. The key indicators are that the tester is “discreetly watching their screens and hand movements” during login and is able to capture “usernames and partial passwords” without touching anything. That is the defining pattern of shoulder surfing: passive observation to harvest credentials or other confidential information.

Shoulder surfing is particularly effective in open-plan offices, shared workspaces, airports, cafés, or any environment where people can be observed entering credentials. Attackers may watch directly, use reflections (e.g., glass surfaces), or position themselves to see the keyboard and screen. Even partial password capture can be valuable when combined with other information (usernames, password patterns, reset questions, or subsequent observation), and it can help an attacker craft more convincing follow-on social engineering attempts.

Why the other options do not fit:

Dumpster diving (B) involves retrieving sensitive information from trash (printed documents, media, badges, notes), not observing logins in real time.

Impersonation (C) requires actively posing as a trusted person (IT staff, vendor, employee) to persuade someone to disclose information or grant access; the scenario explicitly avoids interaction with staff.

Tailgating (D) is physically following someone through a secure door to gain unauthorized entry; it’s about bypassing physical access controls rather than capturing credentials.

Because the technique relies on visual observation of screens and keystrokes to obtain login details, the correct answer is A. Shoulder Surfing.

CEH v13 highlights that multi-vector DDoS attacks require multi-layer DDoS mitigation services, often cloud-based, capable of analyzing, filtering, and scrubbing traffic across network, transport, and application layers. These providers maintain massive bandwidth capacity, global scrubbing centers, and behavioral analysis engines that distinguish legitimate sessions from malicious floods. SYN floods and HTTP GET floods require different mitigation techniques simultaneously, which typical firewalls or WAFs cannot handle without dropping legitimate traffic. Blocking SYN packets (Option A) would disrupt normal users. A WAF (Option C) handles only Layer 7 traffic and does not mitigate network-layer volumetric attacks. Increasing bandwidth (Option D) is ineffective against large botnet attacks. Therefore, deploying a multi-layer cloud DDoS protection service is the most effective solution for resilient, real-time mitigation.

Once initial access is obtained—especially through weak or default credentials—the CEH system hacking methodology directs the tester to proceed to privilege escalation. The objective is to elevate user-level access to administrative or system-level privileges so the attacker can perform unrestricted actions such as installing tools, modifying configurations, accessing protected files, and pivoting laterally. CEH materials emphasize using privilege escalation vulnerabilities, such as misconfigured services, kernel exploits, unpatched local privilege escalation flaws, weak file permissions, and token impersonation. A denial-of-service attack is counterproductive and does not support post-exploitation goals. XSS is a web application attack vector and unrelated to operating system privilege manipulation. Brute-forcing the root password is noisy, slow, and unnecessary when authenticated access is already established. Therefore, exploiting a known local privilege escalation vulnerability is the appropriate CEH-aligned next step.

WPA with TKIP suffers from vulnerabilities inherited from WEP, particularly the use of weak Initialization Vectors (IVs). CEH v13 explains that these weaknesses allow attackers to perform packet injection and partial decryption attacks.

Although WPA improved upon WEP, TKIP was designed as a temporary solution and still relies on predictable IV behavior. This makes Option C correct.

Lack of AES (Option A) explains why WPA is weaker than WPA2 but does not directly describe the exploit mechanism. Weak passwords (Option D) affect authentication, not packet injection. GTK predictability (Option B) is relevant but not the primary cause here.

CEH v13 explicitly states that IV reuse and predictability in TKIP enable practical attacks. Therefore, Option C is correct.

RST hijacking is a TCP session hijacking technique emphasized in CEH materials under network attacks against established communications. In TCP, a Reset flag packet is used to abruptly tear down a connection. If an attacker can observe the session and determine the correct parameters such as IP addresses, ports, and an in-window sequence number, they can forge a TCP RST packet that appears to come from one endpoint. This can force the victim side to drop the session, making the legitimate client suddenly lose responsiveness.

The key clue in the scenario is that Rachel “observes a client-server communication” and then injects crafted packets that disrupt the client while the server continues to communicate with Rachel’s system. That behavior matches the practical use of RST hijacking in demonstrations: terminate or desynchronize the victim endpoint while keeping the server-side session usable long enough for the attacker to inject traffic with valid sequence and acknowledgment values. In a switched LAN, this is often paired with sniffing or traffic visibility to reliably craft the reset packet and subsequent injected packets.

Blind hijacking is different because the attacker cannot see the traffic and must guess sequence numbers, which contradicts the “observes communication” detail. UDP hijacking is not applicable because UDP is connectionless and does not use session state or RST flags. “TCP/IP hijacking” is a broad category, but the question asks for the specific technique used to disrupt the client via crafted packets, which is best identified as RST hijacking.

The correct answer is A. IMDS Attack.

The scenario describes an attacker executing code from inside a cloud instance and retrieving temporary credentials associated with the instance role. This is characteristic of an Instance Metadata Service (IMDS) attack. Cloud platforms expose metadata services to instances so applications can retrieve configuration and role credentials. If an attacker gains code execution on the instance, they may query IMDS and steal temporary credentials.

A cloud security reference explains that when an EC2 instance is associated with an instance profile, temporary security credentials are automatically provided to the instance through the Instance Metadata Service (IMDS) . In the scenario, the tester abuses this behavior after gaining code execution through the vulnerable web application.

Option B. CPDoS Attack is incorrect because Cache Poisoned Denial-of-Service targets caching behavior to cause service denial.

Option C. Cloud Snooper Attack is incorrect because Cloud Snooper refers to bypassing firewall controls and command-and-control through cloud infrastructure paths.

Option D. Wrapping Attack is incorrect because wrapping attacks commonly target SOAP/XML signatures or request manipulation, not cloud instance metadata credentials.

Therefore, the best answer is A. IMDS Attack.

The correct answer is A. Broken Object Level Authorization (BOLA).

The scenario describes an authenticated user changing an object identifier in an API request and gaining access to another client’s dashboard data. The user remains authenticated, but the application fails to verify whether that user is authorized to access the specific object referenced by the identifier.

This is the API security equivalent of an insecure direct object reference. CEH-aligned web application material explains that applications often use objects or IDs to distinguish user records and that if a user can change an identifier, such as id=1 to id=2, and access another user’s data, the flaw is an insecure direct object reference . In OWASP API Security terminology, this is classified as Broken Object Level Authorization (BOLA).

Option B. Broken Object Property Level Authorization is incorrect because that involves unauthorized access to specific object properties or fields, not the entire object identified by an ID.

Option C. Broken Function Level Authorization is incorrect because the user is not accessing an unauthorized function or administrative endpoint; they are accessing another object through the same function.

Option D. Broken Authentication is incorrect because the session remains valid and authentication is not bypassed. The failure is authorization at the object level.

Therefore, the best answer is A. Broken Object Level Authorization (BOLA).

According to the Certified Ethical Hacker (CEH) attack methodology, once reconnaissance, footprinting, and website mirroring have been completed, the attacker proceeds cautiously to exploitation while maintaining stealth. CEH documentation emphasizes that low-noise, application-layer attacks are preferable when the objective is to minimize detection.

Option B, attempting SQL Injection, aligns directly with CEH’s Web Application Hacking module. SQL Injection is a server-side attack that can often be executed through normal-looking HTTP requests, making it less likely to trigger intrusion detection systems (IDS) or security alerts. CEH materials highlight SQL injection as a common and effective technique for extracting sensitive data such as usernames, passwords, and business-critical information without disrupting server operations.

Option A is incorrect because immediately modifying server configuration files after session hijacking significantly increases the risk of detection. CEH guidelines stress post-exploitation restraint, especially during red team operations.

Option C is not ideal at this stage because automated vulnerability scanners generate substantial traffic and are highly detectable. CEH explicitly notes that vulnerability scanning is noisy and often logged.

Option D is the least stealthy option. Brute-force attacks generate numerous failed authentication attempts, triggering security alerts and account lockouts. CEH classifies brute-force attacks as high-risk and easily detectable.

Therefore, SQL Injection represents the most effective and stealthy next step in accordance with CEH’s structured attack lifecycle.

The correct answer is A. --spoof-mac 0.

Nmap supports MAC address spoofing as a firewall-evasion and scan-obfuscation option. The available reference material lists Nmap firewall evasion options and identifies --spoof-mac mac as the option used to spoof the MAC address .

The value 0 tells Nmap to generate a random MAC address. Because the question states that the recorded hardware address changes automatically each time, the random MAC option is the correct match.

Option B. --spoof-mac Dell is incorrect because this selects a MAC address associated with a specific vendor prefix, not the fully random behavior described.

Option C. --spoof-mac 00:01:02:25:56:AE is incorrect because it uses a fixed MAC address. Repeated scans would show the same spoofed address, not a new one each time.

Option D. --spoof-mac Dell 10.10.1.11 is incorrect because it is not the correct Nmap option format for this behavior.

Therefore, the best answer is A. --spoof-mac 0.

A Rogue DHCP Server attack best fits the symptoms because it directly explains unexpected gateway changes, IP conflicts, and traffic redirection to deceptive portals. In CEH network attack coverage, DHCP is a foundational service that automatically provides clients with IP configuration such as IP address, subnet mask, default gateway, and DNS servers. If an attacker introduces a rogue DHCP server on the same broadcast domain, clients may accept leases from the rogue server—especially if it responds faster than the legitimate DHCP infrastructure. Once that happens, the attacker can push a malicious default gateway or DNS server to victims. This allows redirection of traffic, man-in-the-middle positioning, and phishing-style interception, which matches the “unfamiliar gateway settings” and “misleading login portals” described.

The mention of “temporary IP address conflicts” also aligns: a rogue server can hand out addresses that overlap with legitimate allocations, causing intermittent connectivity issues and failed connection attempts. While a DHCP starvation attack can create disruption by exhausting the DHCP pool, the key difference is outcome: starvation primarily denies service until a rogue server takes over. Here, the defining observable behavior is not just outage—it is misconfiguration and redirection, which points to the presence of a rogue DHCP server actively issuing malicious leases.

Packet sniffing alone would not change gateway settings, and MAC flooding is aimed at forcing switches to behave like hubs, not issuing IP configuration. Defensive controls include DHCP snooping, port security, network segmentation, and monitoring for unauthorized DHCP offers and anomalous lease patterns.

The correct answer is C. Botnet Trojan.

The scenario describes systems infected through a phishing attachment, silently connecting to a centralized command-and-control server, waiting for instructions, and executing distributed traffic bursts. This is characteristic of a botnet.

CEH-aligned material explains that a botnet is commonly established by installing a bot on a victim system using a Trojan horse. Once executed, the victim system becomes infected and waits for instructions from a command-and-control handler. The handler then sends instructions to infected systems, or bots, to perform attacks such as distributed denial-of-service activity . Another reference also defines botnet Trojans as Trojans used to infect many systems and then use the compromised systems together to attack a victim system, commonly for distributed denial-of-service attacks .

Option A. E-banking Trojan is incorrect because e-banking Trojans focus on stealing banking credentials or manipulating financial transactions.

Option B. Rootkit Trojan is incorrect because a rootkit Trojan focuses on hiding malicious activity or maintaining stealth at a low system level.

Option D. Backdoor Trojan is incorrect because a backdoor Trojan provides unauthorized remote access, but the coordinated command-and-control behavior across multiple infected systems best matches a botnet Trojan.

Therefore, the best answer is C. Botnet Trojan.

According to the CEH Network Scanning module, Idle Scanning (Zombie Scanning) is one of the most stealthy reconnaissance techniques. In this method, the attacker uses an idle third-party host (zombie) to probe the target indirectly.

Because all scan packets appear to originate from the zombie system, the true attacker remains hidden. CEH highlights that idle scans:

Are extremely stealthy

Generate minimal traffic from the attacker

Make attribution very difficult

Option B is correct.

Option A (FIN scan) is stealthy but still traceable.

Option C is noisy and easily detected.

Option D describes a Xmas scan, which is detectable.

CEH classifies idle scanning as one of the hardest scanning techniques to trace.

This is a SYN flood because the attack floods the target with TCP SYN packets (connection initiation). The server responds by allocating resources and sending SYN-ACK replies, moving each connection into a half-open state while it waits for the client’s final ACK to complete the three-way handshake. In a SYN flood, that final ACK never arrives (often because the source addresses are spoofed or because the attacker deliberately does not complete the handshake). As a result, the server’s backlog queue of pending connections fills up, consuming memory/connection slots and preventing legitimate users from establishing new sessions.

The scenario’s language matches the mechanics precisely: “flood of TCP connection initiation packets,” “exhausting the server’s backlog of half-open connections,” and “never receives the final ACK .” Those are the classic identifiers of SYN flooding.

Why the other options are incorrect:

ACK flood (A) involves flooding with TCP ACK packets; it does not primarily create half-open handshakes because ACKs are not the connection-initiation step.

TCP SACK Panic (B) refers to a specific vulnerability/issue related to TCP Selective Acknowledgment processing, not a generic handshake backlog exhaustion attack pattern.

APT attack (C) is not a DoS attack type; it refers to advanced persistent threat campaigns and is unrelated to TCP handshake flooding.

Therefore, Aisha is simulating D. SYN Flood Attack.

The correct answer is C. Sherlock.

Sherlock is used to search for a username across many social networking and online platforms. Its primary purpose is cross-platform username correlation. It does not natively provide geolocation tracking like Creepy, and it does not provide relationship-graph visualization like Maltego.

CEH-aligned reconnaissance material describes Maltego as a tool that gathers information from different sources and represents relationships through graph-based analysis . Another reference explains that OSINT username-correlation tools can verify whether a username or profile exists across hundreds of platforms . Sherlock matches that username-correlation function.

Option A. Maltego is incorrect because Maltego is used for relationship graphing and visual investigation.

Option B. Creepy is incorrect because Creepy is associated with geolocation intelligence from social media and image metadata.

Option D. Social Searcher is incorrect because it is mainly used for searching and monitoring social media content, not broad username enumeration across hundreds of sites.

Option C. Sherlock is correct because it specializes in checking whether a username exists across many online platforms.

Therefore, the best answer is C. Sherlock.

According to the CEH Network Scanning module, a SYN scan works by analyzing TCP handshake responses.

SYN → SYN/ACK = Port OPEN

SYN → RST = Port CLOSED

No response = FILTERED

Option A is correct.

CEH emphasizes SYN scanning as stealthy because the handshake is never completed.

The correct answer is D. This message shows classic social engineering and smishing indicators: it arrives by mobile text, claims urgency with a “vital transaction,” impersonates a trusted organization, and asks Bob to contact a free public email address. A legitimate bank or financial institution would normally use an official corporate domain, not a generic @yahoo.com mailbox. Option A is weak because not knowing Scott alone does not prove fraud; the stronger evidence is the suspicious sender identity and unofficial contact channel. Option B is incorrect because the message only claims to represent a respectable organization; attackers often impersonate trusted brands. Option C is unsafe because replying to the provided address validates Bob as a target and may continue the scam. CEH social engineering guidance emphasizes verifying requests through trusted, independent channels and recognizing phishing/smishing attempts that exploit urgency, authority, and user trust. Therefore, the best answer is D.

In CEH v13 Wireless Hacking, brute-force attacks against Secure Simple Pairing (SSP) exploit repeated attempts to guess cryptographic values. The most effective defense is rate limiting, which restricts how many pairing attempts can be made in a given timeframe.

Increasing key length does not stop brute-force attempts if unlimited tries are allowed. BLE still uses pairing mechanisms and is not immune. Whitelisting controls access but does not prevent cryptographic attacks during pairing.

CEH v13 explicitly recommends rate limiting and pairing attempt thresholds as primary mitigations. Therefore, Option C is correct.

CEH documentation explains that WPA-TKIP was a transitional security protocol and does not use AES encryption, relying instead on RC4-based mechanisms.

The lack of AES-based encryption makes WPA-TKIP vulnerable to injection and replay attacks.

Option C is correct.

Options A applies to WEP.

Option B affects authentication, not TKIP weakness.

Option D is not the primary TKIP flaw.

CEH recommends WPA2/WPA3 with AES.

The correct answer is B. Testing String because the scenario describes a classic SQL injection detection approach where the tester submits special characters and malformed input strings—most notably single quotes ( ' )—to observe how the application processes them and whether it produces database error feedback. In SQL injection discovery, inserting a single quote (or multiple quotes) into a parameter commonly breaks the intended SQL syntax if the input is concatenated into a query without proper validation/escaping or parameterization. When this happens, the backend database often returns error messages that may disclose critical information such as the DBMS type (e.g., MySQL, Microsoft SQL Server, Oracle), query fragments, and sometimes references to table/column names. That is exactly what you observed: “system feedback that unexpectedly reveals the database type and internal query structure.”

This method is specifically called “testing strings” in CEH-style SQL injection identification: using quote characters, delimiters, comment markers, and other metacharacters to see whether the application is vulnerable and whether errors or abnormal behavior occur. The goal is not to fully exploit the injection immediately, but to confirm whether input is being interpreted as part of an SQL statement and to collect clues that help the tester model the backend query and proceed with safe, authorized validation steps.

Why the other options are less accurate: Function testing is a broader web-testing concept and is not the specific SQLi detection tactic shown. Dynamic testing generally refers to testing an application while it is running to observe behavior, but it does not name this specific SQLi discovery technique. Fuzz testing involves sending large volumes of random or semi-random unexpected inputs to trigger crashes or errors; while multiple quotes could be part of fuzzing, the described method is the targeted, well-known SQLi testing string approach used to elicit informative SQL errors.

Therefore, the method being employed is Testing String.

The correct answer is D, SMB enumeration. RID cycling is a Windows/SMB enumeration technique used to discover valid user and group accounts by cycling through Relative Identifiers, or RIDs, within Windows Security Identifiers, or SIDs. In Windows, a SID identifies a user, group, or computer account, while the RID is the final portion of the SID that identifies the specific account. CEH-related material explains that RIDs such as 500 identify the Administrator account, 501 identifies Guest, and normal user accounts commonly begin around 1000. During SMB or NetBIOS enumeration, attackers query SMB-accessible systems to retrieve users, groups, shares, machines, and SIDs. RID cycling uses this SID/RID structure to test sequential RID values and map them back to account names. It is not SQL injection, denial of service, or a DNS attack. Therefore, RID cycling belongs to SMB enumeration.

CEH v13 explains that mobile antivirus solutions rely heavily on signatures and known exploit patterns. A custom exploit using obfuscation is far more likely to evade detection.

Metasploit payloads and rootkits are commonly flagged, and SMS phishing relies on user interaction. Therefore, custom obfuscated exploit code is the most stealthy and effective method.

The correct answer is C, Preparation. In the incident response lifecycle, preparation is the stage performed before an actual incident occurs. This phase focuses on making the organization ready to respond effectively by creating the incident response plan, forming the incident response team, assigning roles and responsibilities, defining escalation paths, and testing communication procedures. CEH incident management material lists “Preparation for Incident Response” as the first incident response process before detection, classification, notification, containment, investigation, eradication, recovery, and post-incident activities. It also emphasizes setting up an incident response team, identifying the people who should be contacted during an intrusion, and defining lines of communication. Containment occurs after an incident is detected and aims to limit damage. Notification involves informing affected users or stakeholders. Recovery restores affected systems to normal operation. Since building the team and testing communication happen before an incident, the correct phase is Preparation.

The correct answer is A because the description matches promiscuous mode. In normal operation, a network interface card processes frames addressed to its own MAC address, broadcast frames, or relevant multicast frames, while ignoring frames not intended for it. In promiscuous mode, the NIC passes all received frames up to the operating system or packet-capture tool for inspection. CEH sniffing concepts describe this as a key requirement for sniffers: the NIC is placed into promiscuous mode so it can listen to all data transmitted on its segment, even when the traffic is not addressed to that NIC. CEH-aligned material also states that a sniffer needs the card to run in promiscuous mode so the NIC grabs frames regardless of address. Port forwarding redirects traffic between ports or hosts, WEM is not the described network-interface behavior, and multicast mode only handles multicast traffic.

CEH v13 explains that steganography-based exfiltration hides data within benign-looking files, making it extremely difficult to detect via firewalls or IPS alone. Blocking all outbound traffic is impractical, and IPS systems are not designed to analyze file content deeply for hidden data.

The most effective countermeasure is steganalysis, which involves inspecting files for statistical anomalies, altered pixel distributions, or hidden payload patterns. CEH v13 identifies steganalysis tools as the only reliable method to detect and decode hidden data.

Traffic monitoring (Option C) helps identify suspicious transfers but cannot confirm steganography. Therefore, Option D is correct.

CEH v13 explains that directory traversal (also called path traversal) occurs when an application improperly handles user-supplied input used for file path generation. Attackers exploit this by inserting traversal sequences such as ../ beyond the intended directories, gaining access to sensitive files like /etc/passwd, configuration data, or source code. The vulnerability arises from missing input validation and failure to restrict file access to safe directories. CEH stresses that directory traversal is common in file handling functions such as view, download, or include operations. Brute-forcing credentials (Option A) is unrelated. XSS (Option C) targets script injection into web pages, not file access. Buffer overflow (Option D) manipulates memory, not file paths. Therefore, the scenario represents classic directory traversal exploitation.

The correct answer is C. Insecure Data Storage because the vulnerability described is the storage of sensitive information locally on the mobile device in a manner that is not encrypted and is accessible by simply browsing the file system. In mobile application security, this is a classic risk category: when an app stores confidential data (case notes, client records, tokens, documents, cached responses, databases, logs, or exported files) in clear text or in insecure locations, an attacker who gains device access—or uses backup extraction, file explorers, rooted/jailbroken access, or malware with storage permissions—may retrieve that data without needing to authenticate to the application.

The scenario makes the weakness unmistakable: Daniel can use a “standard explorer tool” to open sensitive records “without any authentication.” This indicates the app is failing to apply appropriate protections such as encryption at rest, secure key handling, proper file permissions, and secure storage mechanisms. In secure mobile design, sensitive records should be encrypted using platform-supported protections (e.g., using OS keystores/keychains for keys, encrypting databases/files, and minimizing local retention). Additionally, apps should avoid storing highly sensitive regulated data unless essential, and should implement secure session controls and data lifecycle management (cache control, expiration, remote wipe support in enterprise settings).

Why the other options are not the best fit: Insecure communication concerns data exposure while transmitted over networks (e.g., lack of TLS, weak TLS, MITM susceptibility), whereas the issue here is purely local storage. Improper credential usage relates to mishandling passwords, tokens, or authentication secrets (hard-coded credentials, weak storage of credentials), but the prompt focuses on stored records themselves. Inadequate privacy controls is broader and typically involves over-collection, improper disclosure, or weak user privacy settings, not direct clear-text storage exposure.

Therefore, the most clearly present OWASP Top 10 Mobile Risk is Insecure Data Storage.

The correct answer is MX. CEH reconnaissance material explains that MX, or Mail Exchange, records identify the mail servers responsible for receiving email for a domain. When a tester wants to understand how an organization handles incoming email traffic, MX records are the most relevant DNS data source because they reveal the designated mail infrastructure and often the priority order of mail servers. In this scenario, the objective is to gather passive intelligence about communication infrastructure without performing active network probing, so querying DNS records is appropriate. SOA records provide domain authority and zone administration information, TXT records often contain verification or policy-related text such as SPF details, and NS records identify authoritative name servers. While those can all contribute to broader reconnaissance, they do not directly answer which systems are responsible for receiving mail. CEH emphasizes that MX records are commonly used during footprinting to identify email infrastructure, support phishing simulations, analyze third-party mail providers, or map communication dependencies. Because the question explicitly asks for the DNS record type that reveals mail server configuration, MX is the correct choice.

Comprehensive Explanation from CEH v13 Courseware:

CEH v13 identifies XML Signature Wrapping (XSW) attacks, also known simply as Wrapping attacks, as a major threat against SOAP-based web services. These attacks exploit weak XML parsing and insufficient validation of signed message components. SOAP messages often include digitally signed sections, but if the server validates the signature without confirming the correct position or structure of the signed elements, attackers can duplicate, move, or wrap signed content inside a modified XML envelope. This allows an attacker to inject malicious payloads while still presenting a valid signature. CEH details how this can lead to unauthorized execution, privilege escalation, or bypassing authentication controls in SOAP APIs. Cloud snooping, cryptanalysis, and IMDS abuse do not involve message duplication or signature misplacement. The scenario precisely matches CEH’s definition of a Wrapping Attack in SOAP/XML security.

Comprehensive and Detailed Explanation From CEH v13 Guide Topics:

The correct answer is D. nmap -T4 -F 10.10.0.0/24. The objective is to quickly enumerate hosts within the same subnet as the compromised server (10.10.0.5), which belongs to the 10.10.0.0/24 network.

In Nmap, the -F (Fast Scan) option scans only the most commonly used ports instead of the full port range, significantly reducing scan time. Combined with -T4, which increases scan speed through a more aggressive timing template, it is the fastest option among the choices provided for rapidly identifying active systems and services on the subnet.

Option A (-q) does not perform host enumeration and is not a standard Nmap host-discovery optimization. Option B (-O) performs OS detection, which generates additional probes and takes longer than necessary when the goal is simply to identify systems quickly. Option C (-r) scans ports sequentially and targets the wrong subnet (10.10.1.0/24), making it incorrect.

From a CEH reconnaissance and network scanning perspective, when speed is important, security professionals commonly use optimized Nmap scans such as Fast Scan and aggressive timing templates to identify live hosts efficiently before conducting deeper enumeration activities.

Comprehensive and Detailed Explanation From CEH v13 Guide Topics:

The correct answer is D. Multipartite Virus. A multipartite virus is a sophisticated type of malware that infects multiple parts of a computer system simultaneously, most commonly the boot sector and executable files. Because it attacks more than one target, it can spread rapidly and is often more difficult to remove than single-vector viruses. Even if infected executable files are cleaned, the virus may remain active in the boot sector and reinfect the system during startup. Likewise, cleaning only the boot sector may leave infected files that can later reinfect the boot area.

Option A (Stealth Virus) is designed to hide its presence by manipulating operating system functions and returning false information to security tools. Option B (Polymorphic Virus) changes its code or signature each time it infects a system to evade detection by antivirus software. Option C (Macro Virus) primarily infects documents and applications that support macro languages, such as Microsoft Office files.

From a CEH malware analysis perspective, malware is often classified by its infection method, propagation technique, and concealment strategy. The defining characteristic of a multipartite virus is its ability to infect both the boot sector and executable files simultaneously, making D the correct answer.

CEH defines spyware as malware designed to covertly observe user behavior and transmit sensitive information to attackers without the victim’s knowledge. Spyware commonly records keystrokes, browser activity, form submissions, application usage, and other personally identifiable information. CEH highlights that spyware often operates silently and may disguise itself as legitimate software, making detection difficult. Unlike rootkits—which hide processes and files—or worms that self-replicate, spyware focuses exclusively on monitoring and data exfiltration. It is frequently installed through phishing, drive-by downloads, browser vulnerabilities, or malicious installers. Spyware can serve as a stepping stone for further system compromise by providing attackers with credentials for privilege escalation, lateral movement, or financial theft. CEH emphasizes the need for endpoint hardening, updated anti-malware engines, and behavioral analysis tools to detect such stealthy monitoring programs.

The correct answer is A. Insecure Design.

The issue is not just a single input validation bug. The scenario describes recurring weaknesses across multiple applications, inconsistent controls between teams, and the need to standardize security requirements across future development efforts. That points to a design-level problem, not just a patching or configuration issue.

CEH-aligned secure development material emphasizes that threat modeling identifies and reviews threats, trust boundaries, data flows, vulnerabilities, and weaknesses in application security design . Web application mitigation guidance also identifies server-side validation, whitelisting or blacklisting of input characters, sanitization, output validation, encoding, prepared statements, parameterized queries, and bind variables as mitigations for input validation flaws .

Option B. Broken Access Control is incorrect because the scenario focuses on inconsistent input-handling and validation design, not unauthorized access to functions or objects.

Option C. Security Misconfiguration is incorrect because the root problem is not an incorrectly configured server or framework setting.

Option D. Cryptographic Failures / Sensitive Data Exposure is incorrect because the issue is not about weak encryption or exposure of protected data through cryptographic failure.

Therefore, the best answer is A. Insecure Design.

The evidence points to a User Account Control bypass. In CEH coverage of Windows privilege escalation, UAC is a protection mechanism intended to prevent silent elevation of privileges, typically prompting the user when an action requires administrative rights. However, certain Windows binaries are “auto-elevate” (often trusted, signed Microsoft executables) and can run with elevated privileges under specific conditions without showing a UAC prompt. Attackers abuse this behavior by manipulating user-writable registry locations—commonly under the current user hive—to influence how these trusted binaries launch other components.

The scenario describes exactly that pattern: a non-elevated process starts an auto-elevate executable such as fodhelper.exe, eventvwr.exe, or sdclt.exe, and the system executes unauthorized code with no prompt. The key forensic clue is “manipulation of shell-related keys under the current user hive,” which is a hallmark of UAC bypass techniques that hijack file association or shell open commands so the trusted binary invokes an attacker-controlled payload instead of the intended system action. Because the modification occurs in HKCU, it can often be performed without administrator privileges, making it attractive for stealthy elevation.

The other options do not match as well. Kernel exploitation involves abusing OS kernel vulnerabilities and would not hinge on shell registry hijacks. Scheduled tasks typically leave task artifacts and are a persistence/execution method rather than this specific auto-elevate redirection behavior. DLL hijacking focuses on search-order abuse for loading malicious DLLs, not shell key redirection tied to UAC auto-elevation.

The activity described is active footprinting because you are not merely listening for wireless broadcasts; you are transmitting crafted 802.11 management frames to elicit responses and gather information. In Wi-Fi reconnaissance, passive methods rely on monitoring beacon frames and other naturally occurring traffic. Active methods, by contrast, deliberately interact with the environment—often by sending probe requests or other management frames—to prompt access points or client devices to respond with details such as SSID, supported data rates, security capabilities, and other parameters.

The scenario explicitly states you “actively send crafted management frames” and then log “immediate responses (including probe responses and capability information).” That is the defining difference between active and passive wireless footprinting. Active footprinting can reveal SSIDs that may not be visible through beacons alone (for example, networks that do not broadcast SSID in beacons may still respond under certain conditions), and it can speed discovery by forcing responses rather than waiting for periodic broadcasts or client activity.

Why the other options are less accurate:

Passive footprinting (B) contradicts the scenario because passive recon involves no transmissions from the auditor’s device.

Wash command (C) refers to a specific tool/command typically associated with WPS enumeration workflows, not the general technique classification being asked here.

Network discovery software (A) is too generic; the question is asking for the technique (active vs passive), and the described behavior is clearly active.

Therefore, the correct answer is D. Active Footprinting.

A wrapper is the most accurate choice because it describes a technique where a legitimate program is bundled together with a malicious payload so that, when the user launches what appears to be a normal installer or application, both the real software and the malware run. CEH materials commonly explain wrappers in the context of Trojanization: the attacker “wraps” a trusted executable or installer with an additional hidden component. This preserves normal functionality to avoid suspicion while still achieving covert execution of the malicious code. In the scenario, the PDF converter installs and works as expected, but a hidden executable runs silently and begins outbound communication—this is classic wrapper behavior designed to maintain user trust and reduce detection through normal user experience.

The other options do not fit as well. A downloader is malware whose primary purpose is to fetch additional payloads from the network; while outbound communication occurs here, the scenario emphasizes bundling and simultaneous execution with a legitimate installer, not primarily downloading. A packer is used to compress/obfuscate an executable to evade signature-based detection; it changes how a binary looks, but it does not inherently describe combining a legitimate installer with another payload. A dropper is designed to deliver and install malware onto a system, often extracting the payload; however, the hallmark detail here is that the legitimate application runs normally while the malicious component is hidden within the same package, which aligns more precisely with a wrapper/Trojanized installer.

Defensively, CEH recommends controls such as application allowlisting, verifying digital signatures and hashes, using trusted software repositories, endpoint detection and response, and monitoring unusual outbound connections after software installation

According to the Certified Ethical Hacker (CEH) Reconnaissance and Footprinting module, DNS cache snooping is a passive information-gathering technique used to determine whether a specific DNS record exists in a server’s cache. Attackers commonly use the dig +norecurse option to prevent the DNS server from querying other DNS servers, thereby revealing only cached results.

When a DNS server responds with NOERROR but does not return an answer, it indicates that the domain name itself is valid, but the requested record is not present in the DNS cache. CEH documentation explains that this situation usually occurs when no internal client has recently queried that domain, so the DNS server has no cached entry for it.

Option A is incorrect because a cached record would return a valid answer section.

Option B is incorrect because NOERROR explicitly means the DNS query was processed successfully.

Option D is incorrect because an expired or non-existent domain would typically return NXDOMAIN, not NOERROR.

CEH materials highlight that attackers use DNS cache snooping to infer user behavior, internal browsing habits, and potential target systems within an organization—making option C the correct conclusion.

The CEH Network Scanning module explains that ICMP Echo Requests are often filtered or blocked by firewalls, routers, or host-based security controls as a defensive measure to reduce reconnaissance exposure.

When systems fail to respond to ICMP Echo Requests but continue to function normally for other services, CEH indicates that this behavior typically means ICMP traffic is being blocked, not that the host is offline or compromised.

Option B is correct.

Option A would affect all services.

Option C lacks supporting indicators.

Option D is speculative and unreliable.

CEH emphasizes that ICMP filtering is common in hardened networks.

The correct answer is B. HTTP/2 Stream Memory Not Reclaimed on RST.

The scenario describes an Apache web service using a multiplexed protocol, which points to HTTP/2. The important symptoms are steadily increasing memory consumption, normal client disconnects, repeated stream activity, and memory not returning to baseline. This strongly indicates that HTTP/2 stream-related memory is not being properly reclaimed after stream reset or termination events.

CEH-aligned web server material emphasizes that Apache web servers, like other web servers, can contain bugs and implementation vulnerabilities that require fixes and secure configuration review . The described behavior is not a generic misconfiguration; it is a protocol-specific memory-management issue associated with HTTP/2 stream handling.

Option A. DoS in HTTP/2 with Initial Window Size 0 is incorrect because that issue centers on abusing flow-control window behavior, not unreclaimed memory after stream resets.

Option C. Insecure Default Configuration is incorrect because the issue only appears when HTTP/2 multiplexed mode is enabled and is tied to stream memory behavior.

Option D. mod_macro Buffer Over-read is incorrect because the scenario does not involve mod_macro, buffer over-read behavior, or disclosure from memory.

Therefore, the best answer is B. HTTP/2 Stream Memory Not Reclaimed on RST.

The scenario describes a jailbreak that boots normally without requiring a computer, but after a reboot the device loses the jailbroken (elevated) state until the user runs an on-device app to re-enable jailbreak features. That behavior matches semi-untethered jailbreaking.

In iOS jailbreaking terminology, the key differentiator is what happens after a restart and whether a computer is required to regain jailbroken functionality. With a semi-untethered jailbreak, the device can reboot on its own into a normal, usable iOS state (so it is not “bricked” or stuck at boot), but jailbreak features such as elevated privileges, unsigned code execution, and tweaks are not active immediately after reboot. To reapply the jailbreak, the user launches a jailbreak app installed on the device, which triggers the exploit chain again and re-enables the modified state until the next reboot. This aligns exactly with “temporarily lost after restart until the user launches a special on-device app.”

Why the other choices don’t match:

Tethered jailbreaking (A) requires the device to be connected to a computer to boot; without tethering, the device cannot boot properly or remains unusable. The scenario explicitly says it can “boot normally without a computer,” so it is not tethered.

Untethered jailbreaking (B) persists across reboots; the device remains jailbroken after restarting with no extra steps. That contradicts the described need to reapply modifications after restart.

Semi-tethered jailbreaking (D) is similar in that the device can boot without a computer, but typically the device boots into a non-jailbroken mode and may require a computer or additional steps to return to a jailbroken state depending on the method; the scenario specifically highlights re-enabling via an on-device app, which is the hallmark most commonly associated with semi-untethered jailbreaks.

Therefore, the jailbreaking method shown is C. Semi-untethered Jailbreaking.

CEH v13 explains that NTP (UDP port 123) can leak sensitive network information if misconfigured. When an NTP daemon allows unrestricted external queries (e.g., monlist or ntpq commands), attackers can enumerate internal IP addresses and hostnames.

This exposure is a known reconnaissance weakness and has been exploited in both information disclosure and amplification attacks. CEH v13 strongly recommends restricting NTP query access using access control lists.

DNS poisoning and honeypots do not explain legitimate NTP enumeration responses. Therefore, option D is correct.

The correct answer is C. Impersonation.

The scenario’s central action is that the assessor pretends to be a third-party IT technician to gain trust and physical access. CEH-aligned social engineering material defines impersonation as a technique where the social engineer pretends to be someone or something he or she is not, such as an employee, valid user, repairman, executive, help desk person, or IT security expert. This can result in physical access to restricted areas and disclosure of sensitive information, including credentials .

Option A. Shoulder Surfing is incorrect because shoulder surfing specifically involves looking over a user’s shoulder to observe credentials or sensitive activity. Although the assessor observes the environment, the primary technique used to gain access is impersonation.

Option B. Eavesdropping is incorrect because eavesdropping involves covertly listening to conversations or communications.

Option D. Dumpster Diving is incorrect because dumpster diving involves searching through trash or discarded materials for useful information. Sticky notes and printouts are mentioned, but the defining technique is the assumed identity of an IT technician.

Therefore, the best answer is C. Impersonation.

Insufficient logging and monitoring is the most direct threat highlighted by the scenario. In CEH-aligned cloud security concepts, visibility is foundational: without adequate telemetry, security teams cannot detect, investigate, or respond to malicious activity in time. The question explicitly states attackers “remained undetected” because the organization lacked mechanisms to track function-level activity and capture anomalous events. In a serverless architecture, this visibility gap can be especially damaging because there are no traditional servers for defenders to log into, and many security signals must be collected from cloud-native sources such as function invocation logs, API gateway logs, identity events, and centralized monitoring pipelines.

While privilege escalation is a common cloud threat, the question’s root cause is not described as excessive permissions or role abuse; it is the lack of detection capability. Loss of governance refers to weak policies, mismanaged accounts, and lack of control over cloud resources, which may contribute indirectly but is not the immediate failure described. Side-channel attacks are specialized and do not match the evidence of missed alerts and absent operational telemetry.

CEH guidance emphasizes implementing centralized logging, continuous monitoring, alerting, and anomaly detection as core controls. For serverless, this includes capturing detailed function execution logs, tracing, identity and access events, and integrating them into a SIEM/SOAR workflow. Effective monitoring enables rapid detection of abnormal invocation patterns, suspicious API calls, unusual data access, and persistence attempts—reducing dwell time and preventing small compromises from becoming major outages.

Session Replay Attacks are highlighted in CEH v13 Web Application Hacking as one of the most sophisticated and difficult-to-detect session hijacking techniques. In this attack, adversaries capture valid session tokens or encrypted session identifiers and replay them to impersonate legitimate users.

Unlike credential stuffing, which relies on login attempts and can be detected through authentication anomalies, session replay occurs after authentication, using legitimate session artifacts. Clickjacking and CSRF manipulate user interactions but do not directly hijack session tokens.

CEH v13 explains that session replay attacks are especially dangerous in environments where session tokens are predictable, long-lived, or improperly bound to client attributes such as IP address or device fingerprint. Because the attacker reuses valid session data, traditional detection mechanisms often fail.

The replayed session appears legitimate to the server, making fraud detection extremely difficult without advanced behavioral analytics. This makes session replay attacks particularly effective in online retail environments where transactions are frequent and time-sensitive.

Thus, Option D correctly identifies the most challenging attack.

This scenario precisely matches Time-Based Blind SQL Injection, a technique detailed in CEH v13 Web Application Hacking. When applications suppress error messages and sanitize outputs, attackers rely on response timing to infer whether injected SQL statements are executed.

In time-based SQL injection, the attacker injects database-specific delay functions (such as WAITFOR DELAY, DBMS_LOCK.SLEEP, or SLEEP()). If the injected condition is true, the database pauses execution, causing a noticeable delay.

The key indicators described—no visible output but increased response time—are classic signs of time-based SQL injection. CEH v13 explains that this method is particularly useful when:

Errors are hidden

UNION queries fail

Output is not reflected

Union-based and out-of-band SQL injections require data exfiltration channels or visible outputs, which are absent here. “Heavy query-based” is not a formal CEH classification.

Thus, Option A is the correct answer.

The correct answer is A. Stateful Multilayer Inspection Firewall.

The firewall is tracking established TCP communications and allowing packets only when they correspond to known active sessions. This is stateful inspection behavior.

CEH-aligned firewall material states that a Stateful Multilayer Inspection Firewall saves the state of current sessions in a stateful database and uses that session state to filter unexpected traffic . Another CEH-aligned reference explains that stateful inspection firewalls track the entire status of a connection and that EC-Council also refers to these as stateful multilayer inspection firewalls .

Option B. Circuit-Level Gateway Firewall is incorrect because circuit-level gateways validate session establishment, such as TCP handshakes, but do not provide the same multilayer stateful packet inspection described here.

Option C. Application-Level Firewall is incorrect because application firewalls operate as proxies and inspect application-layer content.

Option D. Packet Filtering Firewall is incorrect because basic packet filters evaluate packet headers statelessly and do not track established connection state.

Therefore, the best answer is A. Stateful Multilayer Inspection Firewall.

CEH’s approach to suspected compromise aligns with an incident-handling mindset: containment first, then analysis and remediation. In IoT and OT-adjacent environments (smart city infrastructure, SCADA-like components, embedded controllers), CEH emphasizes that suspicious external communications and unexplained open ports may indicate compromise, misconfiguration, exposed management services, or implanted malware/backdoors. Because IoT endpoints often have limited logging and are difficult to reimage safely, the safest next step is to isolate the suspected device to prevent further data exfiltration, command-and-control activity, or lateral movement to other city systems.

Option A best matches CEH guidance: isolate the device and investigate its firmware, services, and configuration, including checking for unauthorized binaries, altered firmware images, insecure default services, and hardcoded credentials. This also preserves evidence and reduces the blast radius.

Option C (blocking the external IP) can be helpful, but it’s a partial control: attackers can rotate infrastructure, and the device could still be compromised internally. Option B (full network pen test) is too broad and delays containment when a specific high-risk indicator is already present. Option D (attempting a reverse connection) crosses into active exploitation behavior and is not an appropriate “next step” in a defensive investigation; CEH methodology stresses authorized, controlled testing and prioritizes risk reduction over interacting with suspicious external hosts.

Thus, CEH-aligned best practice is immediate isolation and firmware-level investigation.

CEH v13 identifies ARP spoofing/poisoning as a primary MitM technique in local networks. In such attacks, a single IP address maps to multiple MAC addresses, indicating ARP table manipulation.

This anomaly allows attackers to intercept traffic between victims and gateways. Increased traffic or DNS activity may occur but are not definitive indicators. Thus, IP-to-MAC inconsistencies are the most reliable confirmation of MitM activity.

The described evasion relies on preventing the IDS from correctly reassembling packets, which points directly to packet fragmentation. In fragmentation-based evasion, the attacker breaks the probe payload into multiple IP fragments. Some IDS sensors—especially if misconfigured, overloaded, or using limited reassembly logic—may fail to fully reconstruct the original packet stream, causing the malicious or suspicious content to evade signature matching and detection. Meanwhile, the target host (or a downstream device) may correctly reassemble the fragments and process the probe normally. This mismatch between what the IDS “sees” and what the target ultimately receives is the core concept behind fragmentation evasion.

The scenario explicitly says “IDS devices are unable to reassemble the packets correctly,” which is essentially the textbook rationale for fragmentation as an IDS evasion method. Attackers may vary fragment size, overlap fragments, or manipulate offsets to stress or confuse reassembly engines. Even when modern IDS systems support reassembly, fragmentation can still be used to reduce detection reliability if sensors are under resource pressure or if traffic normalization is not enforced.

Why the other options don’t match:

Source routing (B) attempts to influence the path packets take through the network; it does not inherently prevent IDS reassembly.

Decoy scanning (C) floods the target/IDS with scans from multiple spoofed addresses to obscure the true scanner source. This is about attribution noise, not packet reassembly failure.

IP spoofing (D) for scanning can disguise origin, but it does not inherently cause IDS reassembly problems.

Therefore, Maria is applying A. Packet Fragmentation.

The correct answer is B, Clickjacking Attack. Clickjacking is a web application attack in which an attacker tricks a victim into clicking on a hidden or disguised element different from what the victim perceives on the screen. The most common technique involves placing a transparent or invisible iframe over legitimate-looking content. When the victim clicks the visible button, image, or link, the click is actually directed to the hidden iframe controlled by the attacker.

In CEH web application hacking topics, clickjacking is considered a user-interface redress attack because it manipulates the user’s perception of the web page. Attackers use this technique to force users to perform unintended actions such as changing account settings, authorizing transactions, enabling webcams, downloading malware, or granting permissions on trusted websites while remaining unaware of the action being performed.

HTTP Parameter Pollution involves manipulating application parameters, HTML Injection inserts malicious HTML into a web page, and Session Fixation forces a user to use a predefined session identifier. Since the scenario specifically describes a transparent iframe tricking the victim into clicking hidden content, the attack is Clickjacking.

Answer: B QUESTION NO: 25 [Malware Threats]

What kind of detection technique is being used in antivirus software that identifies malware by collecting data from multiple protected systems and instead of analyzing files locally it ' s made on the provider ' s environment?

A. Heuristics based

B. Honeypot based

C. Behavioral based

D. Cloud based

Answer: D

The correct answer is D. Cloud based because the question describes an antivirus architecture where suspicious files, metadata, reputation information, and threat intelligence are collected from multiple protected endpoints and analyzed within the vendor’s cloud infrastructure rather than exclusively on the local machine. In CEH malware defense concepts, cloud-based detection leverages centralized analysis engines, reputation services, machine learning models, and global threat intelligence gathered from many endpoints. This approach enables rapid identification of emerging malware and zero-day threats because intelligence learned from one protected system can immediately benefit all other protected systems.

Heuristic-based detection focuses on identifying suspicious code characteristics and malware-like patterns. Behavioral-based detection monitors how a program behaves on a system, such as unauthorized registry changes, process injection, or unusual network activity. Honeypot-based solutions use decoy systems to attract and study attackers. None of these specifically describe offloading analysis to the antivirus provider’s environment. The key phrase in the question is that malware analysis is performed in the provider’s environment using information collected from many protected systems, which is the defining characteristic of cloud-based malware detection. Therefore, option D is the most accurate CEH-aligned answer.

The correct answer is A, Lateral movement. Lateral movement occurs after initial compromise, when an attacker moves from one system to other internal hosts, accounts, or resources. This phase is especially difficult to detect without centralized logging because evidence is scattered across many endpoints, servers, authentication systems, and network devices. CEH incident response and SOC concepts emphasize SIEM functions such as identifying, monitoring, recording, auditing, and analyzing security incidents, which depend heavily on centralized log collection and correlation. CEH foundation material also notes that when audit/event logs are not properly configured or maintained, incident investigation becomes extremely difficult. In hacking methodology, expanding control from one host to other hosts in the network is described as takeover, which maps closely to lateral movement. Recon, delivery, and initial access may be visible at perimeter or endpoint controls, but lateral movement requires cross-system correlation, making it the hardest phase to detect without centralized logs.

An Evil Twin access point is a malicious wireless access point that impersonates a legitimate Wi-Fi network by copying its SSID and often mimicking other observable characteristics such as security settings and signal behavior. In CEH-aligned wireless attack coverage, the goal is to trick users into connecting to the attacker-controlled AP instead of the real one. Once a victim device associates, the attacker can perform man in the middle interception, capture credentials, observe sensitive traffic, and potentially downgrade protections if the victim is not properly validating the network.

This scenario strongly matches an Evil Twin because the tablet connects to an access point “broadcasting a name and signal similar to the hospital’s secure Wi-Fi,” and Sarah finds an unauthorized device capturing sensitive traffic from connected systems. That combination indicates active impersonation and client deception, not merely an accidental device. A rogue AP is typically an unauthorized access point connected to the internal network, often deployed by employees for convenience, and may not be designed to impersonate the official SSID to lure clients. A misconfigured AP refers to an access point with weak settings or improper security controls, not an attacker-created clone. A honeypot AP is a deliberate decoy set up by defenders to attract attackers, which is the opposite of what is described.

Mitigations emphasized in CEH best practices include using WPA2 Enterprise or WPA3 Enterprise with certificate validation, enabling protected management frames where supported, deploying wireless intrusion detection and prevention to identify spoofed SSIDs and BSSID anomalies, disabling auto-join where possible, and training users to report suspicious network prompts or unexpected reconnect behavior.

The technique being used is Error Message Analysis, because the tester is intentionally supplying a special character payload and then interpreting the application’s returned database or SQL parsing error to infer the presence of an injection point. In CEH-aligned SQL injection methodology, one of the earliest indicators of SQL injection is when crafted input causes the application to generate a database error, such as syntax errors, unclosed quotation marks, type conversion failures, or context-related messages that reveal how the input is being embedded into a query. A long series of single quotes is a classic trigger: if user input is concatenated into a SQL statement without proper sanitization or parameterization, the quotes can break the query structure and force the database engine or ORM layer to throw an error that exposes the query context.

The scenario explicitly states the response is an error message indicating the application cannot handle the input “in the current SQL context.” That means the application is leaking information through error responses, which CEH highlights as both a detection opportunity for testers and a security weakness because detailed errors can guide attackers toward successful payload construction.

This is not primarily “Detecting SQL Modification,” which focuses on confirming changes in query logic or results, often using boolean-based techniques. It is not “Function Testing,” which validates application functions rather than probing input handling at the SQL layer. While the input resembles fuzzing, fuzz testing is broader and does not specifically depend on interpreting SQL error messages as the detection signal. Here, the decisive evidence is the SQL-context error returned, making Error Message Analysis the correct technique.

String concatenation is the best match because the technique described is breaking a recognizable SQL keyword or payload into separate pieces so a signature-based WAF rule does not see the full malicious token in one continuous pattern. In CEH-aligned web application testing, many WAF detections rely on matching known strings such as UNION SELECT, OR 1=1, and other classic patterns. If an attacker can cause the database parser to interpret the same meaning while the input appears different at the inspection layer, the WAF may fail to match its rule and the payload can reach the backend.

The prompt explicitly says you “split the query into multiple parts” to avoid detection as “a single signature.” That is the core idea of concatenation-based evasion: represent the same instruction through separated fragments that are recombined or tolerated by the SQL parser, depending on the database and application behavior. This differs from in-line comments, which would typically insert comment markers inside keywords to break signatures while preserving parsing, and differs from hex encoding, which replaces characters or strings with hexadecimal representations. A null byte technique is usually associated with string-termination tricks in older contexts and does not align with splitting SQL keywords for WAF bypass.

Defensively, CEH guidance emphasizes that relying on WAF signatures alone is insufficient. Strong prevention requires parameterized queries, strict server-side input validation, least-privilege database accounts, and monitoring for anomalous query patterns and error behaviors even when obvious signatures are not present.

This question describes a classic example of Tautology-Based SQL Injection, a subcategory of SQL Injection attacks which fall under Web Application Hacking in the CEH curriculum.

In a tautology-based SQL injection, the attacker injects a SQL fragment that always evaluates to true, thus bypassing the authentication mechanism. The string ' C ' ll-T; — is a malformed variant, possibly meant to represent ' OR ' 1 ' = ' 1 ' ; --, which is one of the most basic and widely recognized tautology-based injection payloads. When injected into a vulnerable SQL query, this kind of input manipulates the WHERE clause of the query so that it always evaluates to true, regardless of the original conditions.

Here’s how it works:

If the SQL query is:

SELECT * FROM users WHERE username = ' $username ' AND password = ' $password ' ;

And the attacker inputs:

' OR ' 1 ' = ' 1 ' ; --

The query becomes:

SELECT * FROM users WHERE username = ' ' OR ' 1 ' = ' 1 ' ; -- ' AND password = ' ' ;

This results in the execution of:

SELECT * FROM users WHERE ' 1 ' = ' 1 ' ;

Which always evaluates to true, thereby bypassing authentication and allowing unauthorized access.

This method does not rely on error messages (Error-Based), timing delays (Time-Based Blind), or UNION statements (Union-Based). Its goal is to exploit logic within the query structure itself using boolean-based manipulation.

According to EC-Council ' s CEH v13 Module: Web Application Hacking, understanding tautology-based injection is critical because it ' s one of the most common ways attackers bypass login forms on poorly secured web applications.

The correct answer is B. CRIME Attack.

The scenario describes a compression-based side-channel attack against encrypted HTTPS traffic. The attacker observes differences in compressed response sizes and uses those differences to infer protected authentication values, such as cookies or session tokens.

CRIME, or Compression Ratio Info-leak Made Easy, abuses TLS/SPDY-level compression behavior. When attacker-controlled input is compressed together with secret values, response-size differences can reveal information about the secret. The CEH cryptography/session-hijacking context discusses attacks against SSL/TLS and secure communications, including man-in-the-middle positioning and cryptographic weaknesses affecting encrypted channels .

Option A. Forbidden Attack is incorrect because it is not the recognized compression side-channel attack described.

Option C. Man-in-the-Browser (MITB) Attack is incorrect because MITB requires malware inside the browser to intercept or modify browser transactions.

Option D. Man-in-the-Middle (MITM) Attack describes the attacker’s position, but not the specific compression-based technique.

Option B. CRIME Attack is correct because the attack extracts secrets by analyzing compressed encrypted response sizes.

Therefore, the best answer is B. CRIME Attack.

The correct answer is B. Distributed Reflection Denial-of-Service (DRDoS) because the scenario describes the two defining elements of DRDoS: reflection and amplification at scale using third-party systems. Maria “forges requests” (i.e., spoofs the victim’s IP address as the source) to “multiple open services across the internet.” Those services then send their replies to the spoofed source—the victim—so the victim receives a large volume of unsolicited responses. This is reflection: the attacker does not attack the victim directly; instead, the attacker reflects traffic off other servers. The “multiplying the amount of traffic” indicates amplification: many protocols/services respond with packets significantly larger than the request, so the attacker’s small outbound traffic results in a much larger inbound flood against the target.

The mention of “multiple open services” and being overwhelmed by a “flood of responses” is classic DRDoS behavior. From a defender’s perspective, DRDoS attacks are difficult because the traffic often appears to come from legitimate servers, and the victim is receiving replies to requests it never sent. Mitigations include source address validation (BCP 38 anti-spoofing), rate limiting, filtering/ACLs for abused UDP services, and upstream scrubbing/CDN or DDoS protection.

Why the other options are less accurate: Smurf is a specific reflection/amplification attack using ICMP to a broadcast address (now largely mitigated by disabling directed broadcasts). Botnet describes the attacker’s infrastructure (many compromised machines) but not the reflection/amplification mechanism; a botnet can be used to launch many types of DDoS attacks. NTP amplification is one specific DRDoS variant using misconfigured NTP servers (UDP/123). The question describes the broader technique across “multiple open services” rather than naming NTP specifically, so the best match is the general category DRDoS.

Therefore, Maria is demonstrating a Distributed Reflection Denial-of-Service (DRDoS) attack.

The correct option is B because it uses vendor-based MAC spoofing, which is the most direct way to make traffic appear to come from a device manufactured by a specific, recognizable vendor (in this case, “Dell”). In MAC addressing, the first portion of the MAC address is the OUI (Organizationally Unique Identifier), which identifies the vendor/manufacturer. Many security and asset tools perform lightweight device profiling by correlating observed OUIs with known vendors, and MAC-based logs may record or flag devices based on whether their OUIs match expected corporate endpoints.

Nmap supports MAC spoofing in a way that allows specifying a vendor name so the resulting MAC address is generated with an OUI associated with that vendor. This matches the requirement in the scenario: the tester wants the scan traffic to “blend in with legitimate devices” by adopting a vendor-associated identifier rather than using a random or obviously unusual MAC prefix.

Why the other options are less appropriate:

A provides only a partial prefix-like value (not a full MAC), and it does not explicitly map to a vendor name, making it less aligned with “specific hardware vendor” blending.

C uses 0 (zero), which is commonly associated with generating a random MAC rather than selecting a specific vendor identity; randomization does not guarantee blending with a chosen vendor’s footprint.

D supplies a full explicit MAC address; while this can spoof a MAC, it does not inherently express the intent to “appear as a specific vendor” unless you already know that exact MAC’s OUI belongs to the desired vendor. The question emphasizes selecting a vendor-associated identifier directly, which is exactly what option B does.

So, the best match for vendor-based disguise is B.

The correct answer is A, DoS. If a Python API allows unlimited file upload size, an attacker can upload extremely large files or repeatedly upload many files until server resources are exhausted. This can consume disk space, memory, CPU, application worker threads, temporary storage, or bandwidth, causing the API or hosting server to slow down, crash, or become unavailable to legitimate users. CEH web application security guidance emphasizes validating input and applying file-upload controls such as content-type checks and malware scanning. It also notes that system resources can be depleted, such as by filling disk space, leading to denial of service. In CEH DoS concepts, a denial-of-service attack restricts or blocks authorized users from accessing system resources; flooding servers or exhausting resources prevents genuine requests from being served. XSS involves script injection, SQLi targets database queries, and CSRF forces authenticated users to perform actions. The issue here is resource exhaustion, so DoS is the best answer.

According to the Certified Ethical Hacker (CEH) System Hacking and Session Hijacking module, sidejacking is a form of session hijacking where an attacker passively intercepts network traffic to capture unencrypted session cookies. These cookies are then reused to impersonate the authenticated user without needing credentials.

CEH documentation explains that sidejacking commonly occurs on unencrypted HTTP connections, public Wi-Fi networks, or improperly secured internal networks. Once the session cookie is stolen, the attacker can replay it to gain access to the victim’s active session.

Option B correctly describes this mechanism and directly matches CEH’s definition of sidejacking.

Option A refers to perimeter exploitation, not session hijacking.

Option C describes social engineering, which is unrelated to sidejacking.

Option D is an example of cross-site scripting (XSS), not sidejacking.

CEH emphasizes HTTPS enforcement and secure cookie attributes as key countermeasures.

The scenario points directly to information gathering from the robots.txt file. A robots.txt file is typically located at the root of a website (e.g., https://example.com/robots.txt) and is intended to instruct search engine crawlers which paths should or should not be indexed. During web reconnaissance, testers often review robots.txt because it can unintentionally disclose sensitive directories, administrative panels, staging paths, backup locations, or restricted areas that the organization hoped would remain obscure. The scenario explicitly says Sofia found “a crawler directive at the server’s root” that “allows unintended indexing of restricted areas,” and that this “reveals internal paths.” That is exactly the kind of leakage that can come from misconfigured or overly revealing crawler directives.

This is considered an early-stage reconnaissance / information gathering technique because it does not require exploitation. It leverages publicly accessible configuration hints to map the application’s hidden structure. Even when robots.txt is used correctly, the listed disallowed entries can still serve as a roadmap of interesting targets; if configured incorrectly (for example, allowing indexing or exposing sensitive paths), it can increase exposure by helping those paths surface in search results or be discovered faster by attackers.

Why the other options are less accurate:

Vulnerability Scanning (A) implies using scanners to identify known flaws; here, the tester is manually/strategically inspecting a crawler directive for exposed paths.

Web Server Footprinting/Banner Grabbing (C) focuses on identifying server type/version and technologies via headers or responses, not discovering hidden paths from crawler directives.

Directory Brute Forcing (D) uses wordlists to guess directories; Sofia’s discovery comes from a disclosed list of paths, not brute-force guessing.

Therefore, the technique is B. Information Gathering from robots.txt File.

CEH v13 identifies Man-in-the-Browser (MitB) attacks as one of the most dangerous and difficult-to-detect session hijacking techniques, especially in online banking environments. In MitB attacks, malware operates inside the user’s browser, intercepting and manipulating transactions in real time.

Unlike XSS or session fixation attacks, MitB bypasses server-side security controls entirely. Even strong encryption, multi-factor authentication, and secure cookies are ineffective because the attack occurs after authentication, within a trusted session.

Passive sniffing is limited by encryption, and session fixation relies on poor session management. Covert XSS requires injection points and is more easily mitigated.

CEH v13 emphasizes that MitB attacks can modify transaction details without user awareness, making detection extremely difficult. Therefore, Option B is correct.

CEH v13 details that fragmentation attacks are a common IDS evasion strategy. Signature-based IDS systems depend on reassembling packets to detect malicious patterns. When attackers fragment TCP headers into smaller segments, the IDS may be unable to reconstruct the original packet sequence, especially if the fragments are intentionally crafted to confuse reassembly buffers. Meanwhile, the target host typically recombines the fragments correctly, allowing the scan or payload to pass undetected. This technique is specifically discussed under IDS evasion methods, where fragmentation prevents complete packet inspection. Options A and B describe unrelated evasion mechanisms such as IP spoofing and MAC spoofing, and Option C does not fundamentally affect IDS reconstruction. The tester is clearly using packet fragmentation to evade detection while still mapping open ports successfully.

According to CEH v13 Social Engineering, social engineering attacks manipulate human trust rather than technical vulnerabilities. Option A describes a classic pretexting attack, where the attacker impersonates IT staff and fabricates a false issue to trick a victim into revealing credentials.

This scenario aligns perfectly with CEH definitions because:

The attacker relies on authority impersonation

The victim is socially manipulated

No technical exploitation is required

Option B is a legitimate security activity.

Option C is accidental malware introduction, not social engineering.

Option D is physical negligence exploitation, not direct social engineering interaction.

CEH v13 stresses that pretexting attacks are extremely effective against new employees who lack familiarity with procedures. Therefore, Option A is correct.

The correct answer is Deauthentication Attack. CEH wireless security coverage explains that deauthentication attacks abuse 802.11 management frames to force wireless clients to disconnect from an access point. When spoofed deauthentication frames are transmitted, client devices believe they have been instructed to terminate the association and must reconnect manually or automatically. That matches the scenario exactly: carefully crafted management frames are sent, connected laptops immediately lose association, and the disruptions occur only while those frames are being transmitted. Jamming is different because it disrupts wireless communication through radio-frequency interference rather than valid-looking 802.11 management messages. Eavesdropping is passive interception, and an evil twin involves a rogue access point impersonating a legitimate one. CEH materials describe deauthentication attacks as common wireless denial and disruption techniques and also note that they may be used to force reconnects for handshake capture during broader wireless attacks. Because the question focuses on targeted disconnects caused by crafted management frames, the most accurate classification is Deauthentication Attack.

ISO/IEC 27001:2022 is the correct choice because it is the core standard that defines the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). In CEH-aligned governance and security management concepts, an ISMS is the overarching management framework that ensures information security is handled systematically through policy, defined roles, risk-driven planning, implementation of controls, monitoring, internal audits, and continual improvement. ISO/IEC 27001 is the “structure” standard—meaning it specifies what an organization must do to run an information security program end-to-end and is the primary standard against which organizations can be formally certified.

The other standards are supporting standards rather than the overarching framework. ISO/IEC 27002:2022 provides guidance and best practices for information security controls (the “control catalog” and implementation guidance), but it does not define ISMS requirements. ISO/IEC 27005:2022 focuses on information security risk management—how to identify, analyze, evaluate, and treat risks—supporting the risk-based approach used by an ISMS, but it is not the ISMS framework itself. ISO/IEC 27701:2019 extends ISO/IEC 27001 and 27002 for privacy information management (PIMS), helping organizations manage personally identifiable information, but it is an extension, not the foundational ISMS standard.

Therefore, when asked for the standard that defines the overarching structure for managing information security across the organization, CEH governance principles align with selecting ISO/IEC 27001:2022.

The correct answer is B. Transforming Query Structure to Evade Pattern-Based Inspection.

The scenario describes a pattern-based security control blocking conventional injection payloads. The tester then changes the request’s format and composition while preserving the intended database action. This is a classic SQL injection/WAF evasion concept: changing how the query looks so that the security control no longer matches the malicious pattern, while the backend database still interprets the request successfully.

CEH-aligned SQL injection material explains that signature-based detection compares input strings against known signatures and that attackers may evade these signatures through techniques such as inline comments, character encoding, string concatenation, obfuscated code, manipulating white spaces, hex encoding, and sophisticated matches .

Option A is incorrect because HTTP Parameter Fragmentation specifically splits payload components across parameters; the scenario does not describe fragmentation.

Option C is incorrect because no combined or integrated multi-method evasion is described.

Option D is incorrect because HTTP Parameter Pollution involves duplicate or conflicting parameters; the scenario does not describe overriding query parameters.

Therefore, the best answer is B. Transforming Query Structure to Evade Pattern-Based Inspection.

A smart card is something you have, because it is a physical possession used for authentication. A PIN is something you know, because it is secret knowledge remembered by the user. Together, they form two-factor authentication by combining two different authentication factor categories. Fingerprints, retina scans, or facial recognition would be something you are, but those are not used in this question. Therefore, the correct answer is B.

In CEH v13 Cloud Computing, serverless architectures introduce unique security challenges, particularly around Function-as-a-Service (FaaS) permissions. When a serverless function is compromised through an insecure third-party API, the damage depends largely on what the function is allowed to do.

Implementing function-level permission models and enforcing the principle of least privilege ensures that even if a function is exploited, its ability to execute malicious actions is strictly limited. CEH v13 strongly emphasizes granular IAM controls in serverless environments.

While cloud-native security platforms (Option A) and CASBs (Option C) provide visibility and governance, they do not directly prevent excessive permissions. Regular patching (Option D) is important but does not mitigate permission abuse.

CEH v13 identifies least privilege as the single most critical control in preventing serverless abuse and privilege escalation. Therefore, Option B is the correct answer.

CEH v13 explains that WPA2-PSK security relies on the strength of the pre-shared key. Once the 4-way handshake is captured, the attacker must attempt offline cracking. CEH emphasizes that the dictionary attack is the most efficient and commonly used cracking method because it tests structured wordlists, human-derived passwords, and hybrid permutations, dramatically reducing time compared to full brute force. Brute forcing (Option B) is computationally heavy and often impractical unless the password is extremely short. XSS (Option A) and SQL injection (Option D) have no relevance to WPA2 authentication, which occurs at the wireless protocol level, not the router’s web interface. The dictionary attack is highlighted in CEH as the principal technique used with tools like aircrack-ng, hashcat, and pyrit, allowing rapid key testing using optimized GPU or CPU cracking. Thus, Option C is the most effective and CEH-aligned method.