The scenario best matches Traffic IQ Professional because it describes a tool used to generate and replay diverse traffic patterns through a firewall to validate rule enforcement and detection under simulated attack conditions. The key functions here are traffic generation, replay, and the ability to model both legitimate and malicious flows to test whether the firewall correctly handles evasion attempts and policy enforcement. Traffic generation/replay platforms are used in security validation and firewall testing to emulate real-world network behaviors at scale and to assess how devices respond to crafted or replayed traffic profiles.

Why the other tools are less suitable:

Nmap (A) is primarily a scanner for host discovery, port scanning, and service enumeration, with some scripting capabilities. It is not chiefly a traffic generation/replay system for exercising a firewall with diverse controlled flows.

Colasoft Packet Builder (C) can craft packets and build custom traffic at the packet level, which is useful for creating specific test packets. However, the scenario emphasizes broader “diverse traffic patterns” and replay of flows in a way typically associated with traffic modeling/validation suites rather than single-packet construction.

Metasploit (D) is an exploitation framework used to develop and execute exploits and payloads. While it can generate certain traffic, its primary purpose is not comprehensive traffic generation and replay to validate firewall policies under many traffic types.

Traffic IQ Professional is the best fit because it aligns with a firewall test plan focused on simulating legitimate and malicious traffic profiles, including evasion-style patterns, and demonstrating how the perimeter device behaves under controlled conditions. This approach is often used to evaluate whether a firewall can consistently enforce security policies, detect anomalies, and resist evasion techniques without overblocking legitimate traffic.

Therefore, the most likely tool is B. Traffic IQ Professional.

Directory Traversal, also called path traversal, is a web attack in which an attacker manipulates file path input so the server accesses files outside the intended web directory. In CEH guidance on web application attacks, this commonly happens when an application builds a file path from user-controlled input such as a URL parameter that indicates a filename, folder, language pack, template, or download resource. If the server does not properly validate and normalize the supplied path, an attacker can inject traversal sequences such as dot-dot-slash patterns or encoded equivalents to move up directories and retrieve sensitive files.

The scenario describes Ethan changing URL parameters and receiving “data from areas of the system that should be restricted,” specifically “configuration files not intended for public access.” That is the hallmark outcome of directory traversal: unauthorized read access to files like application configs, environment settings, keys, or server configuration that can later enable deeper compromise. This is not password cracking because no credential guessing or authentication attack is involved. It is not web cache poisoning, which targets shared caching infrastructure to serve poisoned content to other users. It is not HTTP response splitting, which relies on injecting CRLF characters to manipulate response headers and potentially cause caching or XSS side effects.

CEH-aligned remediation focuses on strict allowlisting of permitted file resources, canonicalizing paths before access, rejecting traversal tokens and their encoded forms, using indirect object references instead of raw file paths, and enforcing least-privilege permissions so sensitive configuration files are not web-accessible even if a validation mistake occurs.

CEH teaches that ARP-based attacks vary in sophistication from basic poisoning to more specialized techniques such as switch port stealing. In environments where ARP poisoning defenses or inspection tools limit traditional attacks, attackers may exploit timing vulnerabilities in ARP reply behavior. Switch port stealing works by sending spoofed ARP replies at precisely the right moment—before the legitimate ARP response from the target host—causing the switch’s CAM table to update temporarily and associate the target’s IP address with the attacker’s MAC address. CEH emphasizes that switches trust the latest ARP update, so even brief timing windows enable partial packet interception. This is different from fully persistent ARP poisoning, which continuously overwrites ARP tables, and from passive sniffing, which cannot capture unicast traffic on a switched network. This attack is particularly useful when ARP spoofing is mitigated because it relies on opportunistic timing rather than full table poisoning. The intermittent nature of intercepted packets matches CEH’s description of switch port stealing behavior.

The requirements map most directly to WPA3, because WPA3-Personal replaces the legacy WPA2-PSK handshake with SAE (Simultaneous Authentication of Equals). SAE is designed to resist offline dictionary attacks: even if an attacker captures the handshake, they cannot simply take it offline and test password guesses at high speed the way they can with WPA2-PSK handshakes. This directly addresses management’s concern that a captured handshake plus a weak passphrase could enable offline cracking and eventual session key recovery.

WPA3 also strengthens per-session protection by improving how keys are established and by supporting stronger cryptographic defaults. In enterprise contexts, WPA3 aligns with stronger authentication and encryption suites, and in IoT scenarios it supports modern onboarding and improved security posture compared to older WPA2/TKIP-era configurations. The “per-session encryption” and “stronger protection” goals are consistent with WPA3’s modern design focus.

Why the other options are less suitable:

MAC address filtering (A) is not a security control against credential capture or offline attacks; MACs are easily spoofed and do not provide cryptographic protection.

802.1X authentication (B) (WPA2/WPA3-Enterprise) is very strong and removes reliance on a single shared PSK by using per-user/device credentials and dynamic keys. However, the question’s key requirement explicitly calls out preventing offline dictionary attacks even if a handshake is captured—this is most directly the hallmark improvement of WPA3-Personal (SAE). (In practice, WPA3-Enterprise with 802.1X is also excellent, but “upgrade to WPA3” is the single best match to the stated offline dictionary concern.)

Disabling TKIP (D) is good hygiene (prefer AES/CCMP), but it does not prevent WPA2-PSK handshake capture and offline cracking if PSK is used.

Therefore, the best measure to meet the stated modernization goals is C. Upgrade to WPA3.

CEH methodology emphasizes validating and researching identified vulnerabilities to determine exploitability, patch status, and business impact. Even medium-risk findings require investigation to assess their real severity.

The correct answer is C. MAC Flooding.

The scenario describes a switched network beginning to behave like a hub, with frames appearing across multiple switch ports. This happens when the switch’s CAM table is overwhelmed with many fake MAC address entries. Once the CAM table cannot reliably map destination MAC addresses to ports, the switch floods traffic out multiple ports.

CEH sniffing material explains that MAC flooding sends random MAC addresses mapped with random IP addresses to overflow the CAM table. When the CAM table is full, the switch acts like a hub and broadcasts packets to all ports, helping the attacker sniff packets more easily . Another CEH-aligned exam guide states that MAC flooding sends so many MAC addresses to the CAM table that it cannot keep up, effectively turning the switch into a hub .

Option A. Switch Port Stealing is incorrect because switch port stealing targets a specific victim MAC-to-port mapping through a race condition.

Option B. ARP Poisoning is incorrect because ARP poisoning manipulates ARP caches to redirect traffic through the attacker.

Option D. DNS Poisoning is incorrect because DNS poisoning manipulates name resolution, not switch forwarding behavior.

Therefore, the best answer is C. MAC Flooding.

The CEH Enumeration module explains that SMTP supports commands such as VRFY, EXPN, and RCPT TO, which can be abused to enumerate valid email users if not properly restricted.

In this scenario, the smtp-enum-users Nmap script successfully uses EXPN and RCPT, indicating that the server responds differently to valid and invalid usernames.

Option C is correct because unrestricted SMTP user verification allows attackers to harvest usernames for further attacks such as phishing or brute force.

Option A involves authentication, not enumeration.

Option B affects confidentiality, not user discovery.

Option D is unrelated to SMTP enumeration.

CEH strongly recommends disabling or restricting these SMTP commands.

The correct answer is A, Anti-forensics. Disabling logging services after compromising an administrator account is an attempt to hide evidence, prevent detection, and make later investigation harder. In CEH system hacking phases, this aligns with covering tracks, where an attacker removes or modifies evidence after gaining access. The CEH material describes covering tracks as wiping evidence, removing event logs, error messages, and other indicators so the attack is not easily discovered. It also lists disabling auditing, clearing logs, and manipulating logs as common techniques used by attackers. CEH hacking methodology also explains that clearing tracks helps attackers remain undetected by overwriting system, application, and related logs to avoid suspicion. This is not exfiltration, because no data theft is described. It is not reconnaissance, because the attacker is not gathering information. It is not privilege escalation, because the account is already administrative. Therefore, disabling logging services is best classified as anti-forensics or covering tracks.

Comprehensive and Detailed Explanation From CEH v13 Guide Topics:

The correct answer is D. SYN. TCP (Transmission Control Protocol) establishes reliable communication between a client and a server through a process known as the three-way handshake. This mechanism ensures that both parties are ready to communicate and agree on sequence numbers before data transfer begins.

The three steps are:

SYN (Synchronize): The client initiates the connection by sending a TCP packet with the SYN flag set to the server. This packet contains the client ' s initial sequence number (ISN).

SYN-ACK (Synchronize-Acknowledge): The server responds with a packet containing both SYN and ACK flags. This acknowledges the client ' s request and provides the server ' s own sequence number.

ACK (Acknowledge): The client sends an ACK packet back to the server, confirming receipt of the server ' s sequence number. At this point, the TCP connection is established and data transmission can begin.

Option A (RST) is used to reset or terminate a connection. Option B (ACK) is used to acknowledge received packets but does not initiate a connection. Option C (SYN-ACK) is sent by the server as the second step of the handshake, not by the client to begin it.

Understanding the TCP three-way handshake is fundamental in CEH network security topics because many attacks, such as SYN flooding, exploit this connection establishment process. Therefore, the client begins the negotiation by sending a SYN packet.

The scenario describes an on-device, app-based rooting approach that does not rely on a PC connection, USB debugging, or a bootloader unlock workflow. In CEH mobile platform coverage, this aligns with “one-click” rooting tools that package exploits to elevate privileges directly from user space to root on the device. These tools typically target known vulnerabilities in the Android OS, vendor kernels, or system services to obtain root privileges and then install a management component to maintain elevated access.

KingoRoot is commonly cited in ethical hacking training contexts as a popular one-click rooting solution that can run as an Android application and attempt to root a device without a computer, depending on the device model, Android version, and patch level. This directly matches the prompt: Sofia installs a mobile application, it “exploits a system vulnerability,” and it achieves root “without requiring a PC.” The constraints given, USB debugging disabled and OEM unlock restrictions, make PC-assisted ADB workflows or bootloader-based rooting less feasible, which further supports an exploit-driven, on-device rooting tool.

Magisk Manager is primarily a root management and systemless modification framework and typically assumes the device is already rooted or that the user can patch the boot image and flash it, often requiring bootloader unlock steps that OEM restrictions would block. “One Click Root” is a generic label rather than a specific tool in many CEH-style question banks. RootMaster is another one-click tool, but KingoRoot is the most widely recognized and frequently referenced for direct APK-based rooting in this context.

The correct answer is A. Sending special characters to detect SQL modification behavior.

The scenario describes a black-box SQL injection discovery technique. The tester does not see the application source code or database query, so she submits SQL-significant characters and observes how the application responds. CEH-aligned SQL injection material explains that SQL injection involves injecting malicious SQL into existing queries and that vulnerability detection can involve injecting code into input fields and observing application responses or errors .

The important clue is that the application shows irregular behavior even without detailed error messages. That indicates the input may be modifying the backend SQL statement.

Option B is incorrect because truncation testing checks whether long or unexpected values are cut off, not whether SQL logic is affected.

Option C is too specific to identifier or database syntax handling and does not best match the general SQL injection probe described.

Option D is related, but it is narrower than the actual technique. The broader and more accurate black-box technique is sending special SQL-significant characters and observing behavior.

Therefore, the best answer is A. Sending special characters to detect SQL modification behavior.

Side-channel attacks, as explained in CEH v13 OT and SCADA Security, extract sensitive information by observing physical characteristics of a system rather than exploiting software flaws directly. These characteristics may include power consumption, electromagnetic emissions, timing variations, or thermal output.

In SCADA environments, side-channel attacks are especially dangerous because they bypass traditional network defenses. The most reliable way to confirm such an attack is by analyzing hardware-level anomalies—such as unexpected power usage spikes or irregular signal emissions during normal device operations.

Option B directly aligns with CEH v13 guidance.

Options A, C, and D focus on software, cryptography, or network behavior, which are not primary indicators of side-channel exploitation.

Therefore, Option B is correct.

The symptoms point directly to a Slowloris attack, which CEH materials classify as an application-layer denial-of-service technique that targets web servers by exhausting their available concurrent connection slots rather than saturating bandwidth. In a Slowloris attack, the attacker opens many HTTP or HTTPS connections to the server and then keeps them alive as long as possible by sending partial, incomplete HTTP requests or very slow header transmissions at timed intervals. Because the requests are never fully completed, the server keeps the connections open, waiting for the remainder of the request. Over time, the server’s maximum connection limit is consumed, and legitimate users cannot establish new sessions, even though overall network traffic may remain relatively low.

That exact pattern is described in the scenario: the server is “struggling to accept new connections,” the “maximum connection limit is nearly reached,” and there is “no significant spike in overall network traffic.” This is a classic indicator of low-and-slow DoS behavior, which can be harder to detect because it does not resemble a high-volume flood.

A SYN Flood attack can also exhaust connection resources, but it typically creates a large number of half-open TCP connections and is usually more apparent in network-level telemetry and SYN backlog behavior. A UDP Flood generally causes a noticeable traffic spike. “Peer-to-Peer Attack” describes a botnet architecture style, not the specific technique used here. Therefore, the attack being simulated is Slowloris.

The symptoms strongly match MAC flooding, a classic Layer 2 sniffing-related attack discussed in CEH under switch-based network attacks. Ethernet switches maintain a CAM table that maps MAC addresses to physical switch ports. This table allows the switch to forward frames only to the correct destination port, preventing other hosts from seeing traffic not intended for them. In a MAC flooding attack, an attacker generates a very large number of frames with spoofed, random source MAC addresses. The goal is to overflow the switch CAM table so it can no longer reliably store legitimate MAC-to-port mappings.

When the CAM table is full or unstable, many switches fail open by flooding frames out of multiple ports, behaving more like a hub for unknown destinations. That leads to exactly what Marcus observes: devices on segments that should be isolated start receiving traffic they normally would not see, and overall performance degrades due to excessive broadcast-like forwarding. The prompt also mentions “abnormal traffic patterns overwhelming the network,” which aligns with the high-volume frame injection required to poison or overflow the CAM table.

ARP poisoning would primarily redirect traffic through the attacker by manipulating IP-to-MAC mappings within a VLAN, but it would not typically cause widespread flooding and generalized delays across multiple VLANs. DNS cache poisoning affects name resolution rather than Layer 2 forwarding behavior. Switch port stealing targets a specific victim MAC entry to redirect that host’s traffic, but the widespread flooding and overload indicators are more characteristic of MAC flooding. Therefore, MAC flooding is the most likely technique in this scenario.

The correct answer is B. CRIME Attack.

The scenario describes a compression-based side-channel attack against encrypted HTTPS traffic. The attacker observes differences in compressed response sizes and uses those differences to infer protected authentication values, such as cookies or session tokens.

CRIME, or Compression Ratio Info-leak Made Easy, abuses TLS/SPDY-level compression behavior. When attacker-controlled input is compressed together with secret values, response-size differences can reveal information about the secret. The CEH cryptography/session-hijacking context discusses attacks against SSL/TLS and secure communications, including man-in-the-middle positioning and cryptographic weaknesses affecting encrypted channels .

Option A. Forbidden Attack is incorrect because it is not the recognized compression side-channel attack described.

Option C. Man-in-the-Browser (MITB) Attack is incorrect because MITB requires malware inside the browser to intercept or modify browser transactions.

Option D. Man-in-the-Middle (MITM) Attack describes the attacker’s position, but not the specific compression-based technique.

Option B. CRIME Attack is correct because the attack extracts secrets by analyzing compressed encrypted response sizes.

Therefore, the best answer is B. CRIME Attack.