The correct answer is Spearphone Attack. CEH mobile platform coverage describes Spearphone as a side-channel attack in which motion sensors, such as accelerometers or gyroscopes, are abused to infer or reconstruct audio from vibrations produced by a phone’s loudspeaker. A key feature of this technique is that it may not require direct microphone access, which helps explain why no microphone permission changes or visible recording indicators appeared on the device. That detail is central to the scenario. The installed app continuously collected motion sensor data while speakerphone conversations occurred, and the information was later analyzed remotely to reconstruct acoustic content. That behavior is a textbook match for Spearphone. Android camera hijack attacks involve camera access, not speaker vibration analysis. Camfecting refers to webcam compromise, and Storm Breaker Abuse does not describe this sensor-based audio inference method. CEH materials use this example to show that seemingly low-risk sensors can still create serious privacy and espionage threats when correlated with physical effects such as sound-induced vibration. Because the attack depends on speaker-generated motion data rather than direct audio recording, Spearphone is the best answer.

The correct answer is LLMNR/NBT-NS Poisoning. CEH system hacking coverage explains that when a Windows host cannot resolve a name through normal DNS, it may fall back to Link-Local Multicast Name Resolution or NetBIOS Name Service. An attacker on the local network can answer those broadcasts and falsely claim to be the requested resource. If the victim then attempts authentication, NTLM or NTLMv2 challenge-response data can be captured and later cracked offline. That is exactly what this question describes: a non-existent host lookup, a quick malicious response, capture of NTLMv2 hashes, and later credential cracking. Kerberoasting targets service tickets in Active Directory, not broadcast name resolution. Pass-the-Ticket involves Kerberos tickets, and Internal Monologue abuse is a different authentication abuse pattern. CEH materials specifically connect LLMNR/NBT-NS poisoning with tools such as Responder and highlight that these protocols can be abused to collect hashes for lateral movement or privilege escalation. The scenario’s sequence of name-resolution spoofing followed by hash capture is the defining signature of an LLMNR/NBT-NS poisoning attack.

This scenario clearly describes the need for Time-Based Blind SQL Injection, an advanced SQL injection technique covered in the CEH v13 Web Application Hacking module. Blind SQL injection is used when an application does not return database errors or visible output, making traditional techniques ineffective.

According to CEH v13, Time-Based Blind SQL Injection is particularly useful when:

The backend database type is unknown

Error messages are suppressed

UNION queries fail

No direct data is returned in responses

In this technique, attackers inject SQL statements that deliberately introduce time delays using database-specific functions such as SLEEP(), WAITFOR DELAY, or BENCHMARK(). The ethical hacker then observes the application’s response time to determine whether the injected condition is true or false.

For example:

' OR IF(1=1, SLEEP(5), 0) --

If the application response is delayed, it confirms that the injected SQL statement was executed successfully. CEH v13 categorizes this method as behavioral-based inference, where the attacker extracts information one bit at a time by analyzing timing differences.

Other options are incorrect because:

Content-Based Blind SQL Injection relies on visible differences in responses, which the question states are unavailable.

Union-Based SQL Injection requires knowing column count and data types.

Error-Based SQL Injection depends on database error messages being displayed.

CEH v13 emphasizes Time-Based Blind SQL Injection as a last-resort yet highly effective technique when dealing with hardened applications that suppress output, making it a frequent exam-tested concept.

The correct answer is C because banner grabbing is used for identification during reconnaissance, scanning, and enumeration. Banner grabbing collects information returned by a service when a connection is made to an open port. This banner may disclose the application name, service type, operating system, software version, web server details, mail server details, or firmware/vendor information. CEH scanning methodology associates banner grabbing and OS fingerprinting with identifying the operating system and services running on target machines. The material also defines banner grabbing as an enumeration technique used to provide information about a computer system, generally for operating system identification or fingerprinting. It is not sniffing, because sniffing captures network traffic. It is not cracking, because cracking attempts to break passwords or protections. It is also not exploitation, although the information discovered may later help select an exploit. Therefore, the main purpose of banner grabbing is identification.

The correct answer is C, Preparation. In the incident response lifecycle, preparation is the stage performed before an actual incident occurs. This phase focuses on making the organization ready to respond effectively by creating the incident response plan, forming the incident response team, assigning roles and responsibilities, defining escalation paths, and testing communication procedures. CEH incident management material lists “Preparation for Incident Response” as the first incident response process before detection, classification, notification, containment, investigation, eradication, recovery, and post-incident activities. It also emphasizes setting up an incident response team, identifying the people who should be contacted during an intrusion, and defining lines of communication. Containment occurs after an incident is detected and aims to limit damage. Notification involves informing affected users or stakeholders. Recovery restores affected systems to normal operation. Since building the team and testing communication happen before an incident, the correct phase is Preparation.

CEH v13 identifies kernel-level rootkits as among the most dangerous malware types. Because they operate at the lowest OS level, they can hide processes, files, and system calls.

CEH v13 states that the only guaranteed remediation is a complete system wipe and clean OS reinstallation from a trusted source. Attempting removal risks incomplete eradication.

Powering down alone does not remove the rootkit. Honeypots are for detection, not remediation. Tailored removal tools may fail at kernel depth.

Thus, Option C is correct.

The correct answer is D. Ethical hackers use the same methods but strive to do no harm. CEH-aligned guidance emphasizes that a Certified Ethical Hacker understands weaknesses and vulnerabilities and uses the same knowledge and tools as a malicious hacker, but in a lawful and legitimate manner to assess the security posture of target systems. The key difference is not the toolset or technical method; it is authorization, purpose, scope, and intent. Ethical hackers operate with the customer’s approval, follow rules of engagement, document findings, and work to improve security. Malicious hackers use similar skills and tools for personal gain, destruction, data theft, or activity outside the owner’s interest. Option A is incorrect because ethical and malicious hackers may use the same tools. Option B is misleading because ethical hackers do not obtain permission to steal data or intentionally bring down systems outside agreed scope. Option C is incorrect because malicious hackers are not inherently more advanced. Therefore, D is the best answer.

The correct answer is C, tcpdump. Passive OS fingerprinting identifies the operating system of a target by observing and analyzing network traffic without actively sending probe packets to the target system. Tools such as tcpdump capture packets traversing a network and allow analysts to inspect characteristics like TCP window size, Time-To-Live (TTL) values, TCP options, and packet behavior that can reveal the operating system in use. Because the target is not directly interrogated, passive fingerprinting is stealthier and less likely to trigger alerts.

Nmap is primarily associated with active OS fingerprinting because it sends specially crafted packets and analyzes the responses to determine the target operating system. Ping is used mainly to verify host availability, while tracert (traceroute) identifies network paths and intermediate hops between systems. Neither ping nor tracert performs OS fingerprinting.

In CEH reconnaissance and enumeration topics, passive information gathering focuses on observing existing communications rather than generating new traffic. Therefore, among the given options, tcpdump is the most appropriate tool for passive OS fingerprinting because it captures and analyzes network traffic without directly probing the target.

This question describes a classic example of Tautology-Based SQL Injection, a subcategory of SQL Injection attacks which fall under Web Application Hacking in the CEH curriculum.

In a tautology-based SQL injection, the attacker injects a SQL fragment that always evaluates to true, thus bypassing the authentication mechanism. The string ' C ' ll-T; — is a malformed variant, possibly meant to represent ' OR ' 1 ' = ' 1 ' ; --, which is one of the most basic and widely recognized tautology-based injection payloads. When injected into a vulnerable SQL query, this kind of input manipulates the WHERE clause of the query so that it always evaluates to true, regardless of the original conditions.

Here’s how it works:

If the SQL query is:

SELECT * FROM users WHERE username = ' $username ' AND password = ' $password ' ;

And the attacker inputs:

' OR ' 1 ' = ' 1 ' ; --

The query becomes:

SELECT * FROM users WHERE username = ' ' OR ' 1 ' = ' 1 ' ; -- ' AND password = ' ' ;

This results in the execution of:

SELECT * FROM users WHERE ' 1 ' = ' 1 ' ;

Which always evaluates to true, thereby bypassing authentication and allowing unauthorized access.

This method does not rely on error messages (Error-Based), timing delays (Time-Based Blind), or UNION statements (Union-Based). Its goal is to exploit logic within the query structure itself using boolean-based manipulation.

According to EC-Council ' s CEH v13 Module: Web Application Hacking, understanding tautology-based injection is critical because it ' s one of the most common ways attackers bypass login forms on poorly secured web applications.

The best answer is B. Cryptographic Failures because the scenario centers on weak protection of sensitive data in transit, enabling an attacker to intercept and manipulate the information. In CEH-aligned web and application security concepts (and consistent with modern web risk categories), cryptographic failures occur when an application does not properly use cryptography or secure transport protections to ensure confidentiality and integrity of sensitive data. If transport encryption is missing, weak, or incorrectly configured, attackers can perform man-in-the-middle style interception, tamper with traffic, steal session material, and exfiltrate regulated data—leading to outcomes like identity theft and payment card fraud, exactly as described.

The references to cookie snooping and downgrade attacks further reinforce this. Cookie snooping is commonly associated with session cookies being exposed due to insecure transport (for example, lack of HTTPS, mixed content, or cookies missing secure attributes), allowing an attacker on the network path to capture session identifiers and hijack accounts. Downgrade attacks occur when an attacker forces a connection to use weaker security settings (such as older TLS versions or insecure cipher suites) or coerces a fallback from HTTPS to HTTP when protections like HSTS are absent or misapplied. Both issues are tightly linked to improper cryptographic configuration and transport-layer security weaknesses.

Why the other options are not the best match: Broken Access Control concerns authorization—what users are allowed to access—not interception/manipulation of traffic. Identification and Authentication Failures focus on login/session identity mechanisms (passwords, MFA, session handling) but the key failure here is the weakness of cryptographic protection for data in transit. Security Misconfiguration can be a contributing cause (e.g., misconfigured TLS), but the question emphasizes the resulting weakness category—insufficient cryptographic/transport protections—making Cryptographic Failures the most precise answer.

Therefore, MediVault’s exposure to interception, manipulation, cookie snooping, and downgrade attacks most clearly indicates Cryptographic Failures.

The correct answer is C because the activity described is specifically known as dumpster diving. In CEH social engineering and reconnaissance concepts, dumpster diving refers to searching through an organization’s discarded materials to obtain sensitive or useful information. Attackers may look for printed documents, network diagrams, employee lists, invoices, sticky notes, password reminders, hardware labels, old storage media, or other items that reveal details about the target environment. Although this activity can support intelligence gathering and reconnaissance, those terms are broader phases or objectives. Social engineering is also a broader category that includes manipulating people or exploiting human behavior, and dumpster diving is commonly treated as one technique within that area. The question asks what best describes the exact activity of going through a company’s garbage, so the most precise option is dumpster diving. Organizations reduce this risk by enforcing secure disposal practices such as shredding documents, sanitizing media, locking trash areas, and training employees on information handling.

This is a textbook case of Intranet DNS Poisoning, often combined with ARP spoofing, as described in CEH v13 Network Sniffing and MITM Attacks. The attacker positions themselves inside the local network, intercepts DNS requests, and responds faster than the legitimate DNS server.

ARP spoofing enables the attacker to perform a Man-in-the-Middle attack, allowing sniffing and modification of DNS traffic. CEH v13 notes that faster rogue responses are a strong indicator of local DNS poisoning.

When partial root access exists, preventing further privilege abuse is the immediate priority. CEH v13 explains that Mobile Application Management (MAM) enforces granular access control, application isolation, and permission enforcement—even on compromised devices.

Secure coding (Option A) and testing (Option C) are preventative measures but do not contain an active compromise. Certificate pinning (Option B) protects communications, not application control.

MAM solutions allow administrators to revoke access, enforce policies, and isolate apps, limiting attacker capabilities post-compromise. Therefore, Option D is correct.

This scenario best illustrates impersonation. In CEH-aligned social engineering concepts, impersonation occurs when an attacker assumes the identity of a legitimate person, such as an employee, contractor, executive, or vendor, to exploit trust and bypass established procedures. Rachel explicitly “poses as a stressed employee named Laura Bennett” and uses a believable workplace pretext such as a slow laptop and a tight deadline. This is a classic pressure-and-urgency tactic used to lower skepticism and push the target into breaking policy, such as skipping identity verification or accepting unsafe troubleshooting steps.

Although the interaction happens over the phone, the defining technique being tested is not merely the communication channel but the identity deception. Vishing is phone-based phishing, and while the call could be described as vishing in a broad sense, the prompt emphasizes the assumed identity and the help desk’s verification controls, which is the hallmark of impersonation. Quid pro quo typically involves offering a benefit or service in exchange for information; here, the core mechanic is Rachel’s false identity and her attempt to get the help desk to accept credential sharing as part of support. Shoulder surfing is unrelated because it involves physically observing someone’s screen or keystrokes.

CEH best practices to mitigate impersonation include strict caller verification, callback procedures to known numbers, ticket validation, prohibiting password sharing, requiring multi-factor authentication resets via approved workflows, and training help desk staff to recognize urgency-based manipulation and escalate suspicious requests.

The Certified Ethical Hacker (CEH) Cloud Computing and Data Protection module emphasizes the importance of resilient backup strategies to protect against data tampering, ransomware, and unauthorized modification.

The 3-2-1 backup model is a widely recommended best practice referenced in CEH materials. It requires maintaining:

3 copies of data

Stored on 2 different media types

With 1 copy stored offsite

This approach ensures that even if cloud backups are compromised or altered, clean and uncompromised versions remain available. CEH documentation highlights this model as a core defense against data integrity attacks in cloud environments.

Option D directly mitigates the risk of backup tampering.

Options A, B, and C address unrelated security concerns and do not protect backup integrity.