The correct classification is Potentially Unwanted Applications (PUAs). In CEH malware taxonomy, PUAs refer to software that is not strictly malicious in the traditional sense but exhibits undesirable behavior such as displaying intrusive advertisements, modifying browser settings, collecting user data, degrading system performance, or bundling with other freeware without clear user awareness. In this scenario, the toolbar and optimization tool were bundled with a legitimate utility installer and presented with vague descriptions—an extremely common PUA distribution method known as software bundling.

The symptoms described—pop-up ads, homepage modification, sluggish performance, and background data transfers—are consistent with adware or browser hijackers, which fall under the broader PUA classification. Importantly, the question specifies there is no immediate file encryption (which would suggest ransomware) and no self-replication (which would suggest a worm). Botnet agents typically establish command-and-control communication and are designed for coordinated malicious activity such as DDoS or spam campaigns; while unexplained traffic may raise suspicion, the described behavior aligns more closely with adware-style monetization rather than structured botnet activity. Logic bombs are dormant code triggered by specific conditions, which is not indicated here.

From a defensive perspective, CEH recommends secure software acquisition policies, user awareness training, disabling unnecessary bundled installations, implementing endpoint protection with PUA detection enabled, and enforcing application allowlisting to prevent unauthorized or bundled software from executing within the enterprise environment.

The correct answer is D. tcptrace. Tcptrace is a specialized network analysis tool designed to examine and analyze packet capture (PCAP) files generated by packet-sniffing and packet-capture applications such as tcpdump, WinDump, Wireshark, and EtherPeek. It provides detailed information about TCP connections, including throughput, round-trip times, retransmissions, packet loss, connection duration, and communication statistics.

In CEH network traffic analysis and packet-sniffing topics, captured network traffic is often stored in PCAP files for later examination. Tools such as tcptrace help security professionals, penetration testers, and incident responders analyze network communications, troubleshoot performance issues, identify anomalies, and investigate security incidents.

Option A (OpenVAS) and Option B (Nessus) are vulnerability scanners used to identify security weaknesses in systems and networks. Option C (tcptraceroute) is a network path discovery tool that traces routes using TCP packets rather than ICMP packets. Neither is intended for analyzing packet-capture files.

CEH Exam Tip:

tcpdump/Wireshark = Capture network traffic.

tcptrace = Analyze captured traffic (PCAP files).

Nessus/OpenVAS = Vulnerability assessment tools.

Therefore, tcptrace is the correct tool for analyzing packet-capture files created by multiple packet-capture applications.

The correct answer is B, It replaces legitimate programs. A rootkit is malicious software used after compromise to hide the attacker’s presence, maintain privileged access, and avoid detection. CEH-aligned material describes rootkits as tools that obscure system compromise by replacing or substituting administrator utilities with modified versions that hide malicious activity. Linux rootkit material also states that rootkits contain replacement executables for critical operating system components, used to hide evidence and provide backdoor access. Therefore, among the options, replacing legitimate programs is the best match. Option A describes a backdoor concept more generally. Option C describes a vulnerability/exploitation condition, not a rootkit’s purpose. Option D may describe one possible backdoor behavior, but it is not the primary rootkit objective. Rootkits commonly hide files, processes, registry entries, logs, and malicious services, making detection and removal difficult.

The CEH Footprinting and Reconnaissance module describes DNS interrogation as a valuable technique for extracting publicly available infrastructure information such as A records, MX records, NS records, and subdomains.

DNS can reveal:

Subdomains (via zone transfers, brute forcing, or enumeration)

Mail server IP addresses (MX records)

Server locations inferred from IP geolocation

However, DNS does not store authentication credentials. Usernames and passwords are protected within authentication systems and directories, not DNS records.

Therefore, option A is correct.

CEH clearly states that DNS reconnaissance is limited to infrastructure metadata, not sensitive user credentials.

CEH methodology stresses prioritization based on risk, exploitability, and business impact. High-severity vulnerabilities—especially those related to outdated or unsupported server software—are frequently associated with known, publicly documented exploits. The proper next step after identifying such vulnerabilities is to confirm exploitability safely, typically by researching available exploit code, validating version-specific weaknesses, and determining whether the vulnerability can be successfully leveraged under the defined scope of engagement. CEH highlights that exploitation attempts must be evidence-driven, not arbitrary, and focusing on high-risk vulnerabilities allows testers to demonstrate meaningful security impacts. Brute-forcing (Option A) is unnecessary and high-noise. Ignoring or deprioritizing the high-risk finding (Options B and C) contradicts CEH risk-based assessment principles. Therefore, verifying exploitability of the high-risk vulnerability is the correct step.

CEH v13 explains that a keylogger is a type of spyware designed to capture user input covertly, often storing or transmitting captured data—such as passwords, emails, chat messages, and financial information—to an attacker. Keyloggers can be implemented as software, firmware, or hardware, and they operate silently in the background without affecting system performance, making them ideal for credential theft. CEH categorizes keyloggers under spying and monitoring malware frequently used in the System Hacking phase to escalate privileges or move laterally once credentials are harvested. Unlike rootkits, which hide processes, or ransomware, which encrypts files, a keylogger’s main purpose is passive surveillance. CEH emphasizes how attackers deploy keyloggers post-compromise or use phishing/social engineering to trick victims into installing them. Their covert nature and ability to bypass traditional AV solutions by masquerading as legitimate processes make identifying them crucial during forensics and incident response activities.

The correct answer is A. Website Mirroring.

The scenario describes downloading publicly accessible pages, scripts, media files, and directory references so the team can analyze the site offline. This is exactly website mirroring.

CEH-aligned material explains that mirroring a website means copying the entire website to a local system. The downloaded copy allows the tester to inspect directory structure and identify vulnerabilities in an offline environment, reducing repeated interaction with the live web server . The same material lists website mirroring tools such as WinHTTrack, SurfOffline, BlackWidow, Teleport Pro, Offline Explorer, and Wget .

Option B. Information Gathering is broader and can include many collection methods, but the specific activity described is local copying of site content.

Option C. Web Server Footprinting focuses more on server details such as banners, technologies, operating system, and architecture.

Option D. Vulnerability Scanning is incorrect because the team is not yet actively testing for known vulnerabilities.

Therefore, the best answer is A. Website Mirroring.

The correct answer is D. Brute force. A brute-force attack is a password-cracking method that systematically attempts every possible combination of characters until the correct password is discovered. Because it does not rely on precompiled wordlists, common passwords, or previously generated hash databases, it is considered the most exhaustive and time-consuming password-cracking technique.

In CEH password-attacking concepts, a dictionary attack is generally faster because it uses a predefined list of commonly used passwords and words. Rainbow tables are even faster in many situations because they rely on precomputed hash values that can be matched against captured password hashes. Shoulder surfing is not a technical password-cracking method; it involves directly observing a user entering credentials.

The effectiveness and duration of a brute-force attack depend on password complexity, length, character set, account lockout policies, and available computing power. Strong passwords containing uppercase letters, lowercase letters, numbers, and special characters significantly increase the number of possible combinations, making brute-force attacks far more difficult and time-consuming.

CEH Exam Tip:

Dictionary Attack = Faster, wordlist-based.

Rainbow Tables = Precomputed hash lookup.

Brute Force = Tries every possibility; most time and effort required.

Shoulder Surfing = Social engineering observation technique.

Therefore, Brute Force is the correct answer.

The correct answer is D, Terms of engagement. In CEH penetration testing methodology, testing must be performed only within the boundaries agreed upon with the client before the assessment begins. The engagement terms define what systems, networks, applications, IP ranges, testing methods, time windows, attack types, and operational limits are authorized. CEH-aligned penetration testing guidance emphasizes that the pre-attack phase includes agreeing on rules of engagement, understanding client requirements, finalizing test scope, and signing contracts before testing begins. It also states that scope should be discussed, reviewed with the customer, and described in writing, including which assets and processes are tested and how testing is performed. PCI-DSS is a payment-card security standard, not a pen-test scope document. A nondisclosure agreement protects confidential information discovered during the test. A memorandum of understanding may describe cooperation between parties but is not the best answer for limiting specific testing activities. Therefore, the terms of engagement are the document that limits the scope of your activities.

The correct answer is C, Parameter tampering. In web application hacking, hidden fields are HTML form fields used to pass values back to the server, but they are only hidden from normal browser display, not from the user or attacker. CEH web application material explains that hidden fields are embedded in HTML forms to maintain values sent back to the server, and attacks challenge the assumption that hidden fields cannot be viewed or modified by examining the HTML source and changing the request before it reaches the server. This directly matches parameter tampering because the attacker modifies client-side parameters such as form fields, cookies, query strings, or URL parameters to alter application behavior. CEH material also describes parameter/form tampering as manipulating parameters during client-server communication, including URL values and web page form fields. SQL injection targets database queries, XSS injects script into pages, and CSRF tricks authenticated users into submitting unwanted requests. Hidden-field manipulation is therefore a form of parameter tampering.

The correct answer is B. Cryptographically binding authentication tokens to the TLS connection context.

The scenario describes a defense against session token replay. The attacker/tester has a valid authentication identifier, but the application rejects it when it is reused from a different machine and a different encrypted channel. This indicates that the token is not accepted by itself; it is tied to the original TLS-secured session context.

CEH-aligned session hijacking material explains that session replay occurs when an attacker captures an authentication token and replays the request to obtain unauthorized access. It also describes session hijacking as taking over an authenticated session after authentication has already completed . TLS material explains that TLS provides secure communication, peer authentication, shared-secret generation, and secure session establishment between endpoints . Binding the token to the TLS context prevents a captured token from being reused over a different TLS connection.

Option A. Encrypting DNS resolution traffic using DNS over HTTPS is incorrect because DNS over HTTPS protects DNS lookups, not application session tokens.

Option C. Applying IPsec protection at the network layer is incorrect because IPsec protects traffic at the network layer. The question specifically describes an application-issued authentication identifier being validated against the original secure exchange.

Option D. Enforcing HTTP Strict Transport Security is incorrect because HSTS forces browsers to use HTTPS, but it does not cryptographically bind a token to a specific TLS channel.

Therefore, the best answer is B. Cryptographically binding authentication tokens to the TLS connection context.

The correct answer is C. Overwriting Data/Metadata.

The key clue is that the file contents could not be reconstructed because the physical sectors no longer contained recognizable fragments of the original material. Simple deletion removes file references from directory structures, but the underlying data may still remain recoverable until overwritten. Here, the original sector contents were replaced, which indicates overwriting.

Option A. Data Hiding in File System Structures is incorrect because the data was not hidden in alternate file system locations or metadata structures.

Option B. Data/File Deletion is incorrect because ordinary deletion would usually leave recoverable data remnants.

Option D. Artifact Wiping is broader and often refers to removing traces such as logs, history, temporary files, or forensic artifacts. The scenario specifically describes replacement of file-sector contents.

Therefore, the best answer is C. Overwriting Data/Metadata.

CEH’s approach to suspected compromise aligns with an incident-handling mindset: containment first, then analysis and remediation. In IoT and OT-adjacent environments (smart city infrastructure, SCADA-like components, embedded controllers), CEH emphasizes that suspicious external communications and unexplained open ports may indicate compromise, misconfiguration, exposed management services, or implanted malware/backdoors. Because IoT endpoints often have limited logging and are difficult to reimage safely, the safest next step is to isolate the suspected device to prevent further data exfiltration, command-and-control activity, or lateral movement to other city systems.

Option A best matches CEH guidance: isolate the device and investigate its firmware, services, and configuration, including checking for unauthorized binaries, altered firmware images, insecure default services, and hardcoded credentials. This also preserves evidence and reduces the blast radius.

Option C (blocking the external IP) can be helpful, but it’s a partial control: attackers can rotate infrastructure, and the device could still be compromised internally. Option B (full network pen test) is too broad and delays containment when a specific high-risk indicator is already present. Option D (attempting a reverse connection) crosses into active exploitation behavior and is not an appropriate “next step” in a defensive investigation; CEH methodology stresses authorized, controlled testing and prioritizes risk reduction over interacting with suspicious external hosts.

Thus, CEH-aligned best practice is immediate isolation and firmware-level investigation.

In CEH v13, IDS effectiveness is closely tied to proper signature tuning and sensitivity thresholds. When IDS alerts are triggered by legitimate user behavior, the most common cause is overly sensitive configuration, resulting in false positives.

False positives occur when normal traffic patterns match intrusion signatures. CEH v13 emphasizes that IDS systems must be calibrated to the organization’s baseline traffic profile. Without tuning, IDS logs become noisy and reduce analyst effectiveness.

Firewall issues (Option A) and outdated IDS signatures (Option B) can cause missed detections, not excessive alerts. Users unintentionally triggering protocols (Option D) is not a root cause but a symptom of misconfiguration.

Thus, excessive IDS sensitivity is the correct explanation.

The correct answer is D. ICMP Timestamp Ping Scan.

An ICMP Timestamp Ping Scan uses ICMP timestamp request messages to query a target system’s clock value. If the target responds, the returned timestamp information can confirm that the host is alive and can also help infer timing characteristics such as round-trip delay.

CEH scanning material explains that ICMP scanning is used to identify live hosts by sending ICMP requests and observing replies. ICMP echo replies verify that a host is live, and ICMP-based discovery can also help determine network behavior and host characteristics .

Option A. UDP Ping Scan is incorrect because UDP scanning uses UDP probes, not ICMP timestamp requests.

Option B. ICMP Echo Ping Sweep is incorrect because echo ping sweeps use ICMP Echo Request and Echo Reply, not timestamp request/reply.

Option C. IP Protocol Scan is incorrect because IP protocol scanning tests supported IP protocols rather than querying clock values.

Option D. ICMP Timestamp Ping Scan is correct because the packet requests the target’s internal clock value.

Therefore, the best answer is D. ICMP Timestamp Ping Scan.