The correct answer is B, Reconnaissance. In CEH methodology, reconnaissance is the initial information-gathering phase where an attacker or ethical hacker collects as much data as possible about a target before deeper technical testing or attack activity. The retrieved CEH-related material describes reconnaissance as gathering information about the target using active or passive means, and it specifically includes collecting initial information about the target system or organization. Visiting an organization’s public website to collect employee names, email addresses, and phone numbers is passive information gathering because the tester is using publicly available sources rather than directly probing systems. Footprinting, which is part of reconnaissance, can include gathering employee information, phone numbers, and emails. Fingerprinting is more specific to identifying systems, services, or operating systems. Scanning and enumeration involve actively probing hosts, ports, and services. Gaining access occurs later, when vulnerabilities are exploited. Therefore, this activity corresponds to reconnaissance.

The correct answer is C, Bypass filters. In wireless network security, access points may use MAC address filtering to allow only devices whose MAC addresses are listed in the access point’s whitelist. CEH wireless-hacking material explains that MAC spoofing can be used to change a wireless adapter’s MAC address so it matches an allowed MAC address in the access point’s whitelist, thereby bypassing the MAC filter. This does not provide encryption, because encryption protects data confidentiality using cryptographic algorithms. It is also not IDS, because an intrusion detection system monitors and alerts on suspicious activity. Logging records events and activities, which is unrelated to changing a MAC address. MAC spoofing is an impersonation technique: the attacker observes or obtains a valid MAC address and configures their own interface to use it. Therefore, in the context of CEH wireless attacks and access control weaknesses, MAC spoofing is primarily used to bypass MAC-based access filters.

The correct answer is B. High-Interaction Honeypot.

The environment contains realistic systems, real services, identity structures, databases, and internal hosts. Attackers are allowed to interact with the environment for an extended period, escalate privileges, move laterally, and perform deeper activities while all actions are recorded. This is the defining behavior of a high-interaction honeypot.

CEH-aligned honeypot material explains that high-interaction honeypots consist of highly controlled networks running various services, where attackers can connect, attempt deeper compromise, and have their activities recorded for analysis. It also states that these environments often use real applications and services, making the honeypot harder for attackers to detect .

Option A. Low-Interaction Honeypot is incorrect because low-interaction honeypots emulate limited services and do not allow deep compromise.

Option C. Pure Honeypot is less accurate here because the scenario emphasizes a controlled research VLAN designed for interaction and instrumentation, not a normal production system passively monitored as a pure honeypot.

Option D. Medium-Interaction Honeypot is incorrect because the attackers are interacting with realistic internal services and performing extended post-compromise activity, which goes beyond medium interaction.

Therefore, the best answer is B. High-Interaction Honeypot.

This technique is known as Boolean-Based Blind SQL Injection, as defined in CEH v13 Web Application Hacking. When applications suppress database errors and return generic responses, attackers use conditional statements to infer database behavior.

By comparing responses to true (1=1) and false (1=2) conditions, the attacker deduces whether injected SQL is being executed successfully.

CEH v13 distinguishes this from:

Error-based SQLi (visible DB errors)

UNION-based SQLi (data extraction)

Time-based SQLi (response delays)

Boolean-based blind SQL injection relies solely on content differences, making option C correct.

The correct answer is WPA2. CEH wireless security material explains that WPA2 uses AES-based encryption together with CCMP, which provides confidentiality and message integrity protection. The scenario also mentions a structured four-message key negotiation process before protected traffic begins, which aligns with the well-known four-way handshake used in WPA and WPA2 environments. The deciding factor is the encryption and integrity combination: AES with CCMP is strongly associated with WPA2 in CEH guidance. WEP is far weaker and based on RC4, while WPA originally relied on TKIP as its hallmark improvement over WEP. WPA3 introduces newer protections and a different exam emphasis, but the classic CEH mapping for four-way handshake plus AES/CCMP is WPA2. CEH references also note that WPA2 was designed to improve enterprise-grade wireless security and that CCMP addresses integrity concerns more effectively than earlier approaches. Because the packet capture shows AES-based counter mode encryption with integrated integrity checks after the handshake sequence, the observed standard is best identified as WPA2.

CEH v13 emphasizes that well-secured applications use HTTPS, secure cookies, and session regeneration to defend against common session hijacking techniques. In such hardened environments, traditional attacks like session fixation or simple XSS-based token theft often fail because session IDs change at login and secure flags prevent exposure. The remaining viable approach is session token prediction, an advanced attack that analyzes statistical patterns, entropy weaknesses, or timing issues in session ID generation algorithms. CEH discusses that weak pseudorandom number generators (PRNGs) or predictable sequences can allow attackers to compute a valid session ID without intercepting traffic. This method bypasses cookie security and does not rely on manipulating user input, making it suitable for environments with strong defenses. MITM attacks (Option A) require certificate compromise, which is impractical. Session fixation (Option B) fails because the application regenerates tokens. XSS (Option D) is ineffective when secure flags prevent JavaScript access to cookies. Thus, token prediction is the correct answer.

TCP port 1433 is the well-known default port for Microsoft SQL Server, formally registered as ms-sql-s. In CEH network and perimeter security coverage, identifying services by their default port assignments is a critical reconnaissance and defensive skill. When reviewing firewall rules and exposed services, analysts correlate open ports with their associated protocols to determine risk exposure. Port 1433 is widely recognized as the primary listening port for Microsoft SQL Server instances configured with default settings.

The presence of an undocumented virtual machine actively handling traffic on port 1433 is particularly concerning because database services often store sensitive operational or customer data. If exposed unnecessarily, SQL Server can be targeted for brute-force authentication attacks, SQL injection exploitation, misconfiguration abuse, or exploitation of unpatched vulnerabilities. CEH materials emphasize that database services should not be directly exposed to the internet unless absolutely necessary and must be protected by strict access controls, segmentation, encryption, and monitoring.

Option B, SqlNet, typically refers to Oracle database communication over port 1521. Option D, ms-sql-m, is associated with SQL Server Browser service over UDP 1434, not TCP 1433. Option A, sqlsrv, is not the formal IANA-registered service name for port 1433. Because ms-sql-s is the standard designation for Microsoft SQL Server on TCP port 1433, and given the risk of exposing database services, this finding warrants immediate escalation and review.

In the Aircrack-ng suite referenced throughout CEH wireless hacking coverage, Aireplay-ng is the tool used to inject frames into a wireless network. The key phrase in the question is “transmit packets that force client devices to disconnect and reconnect.” That describes a deauthentication attack, where the tester sends 802.11 deauth frames to a client or to the access point, causing the client to drop its association and then reconnect. When a WPA2 client reconnects, the WPA2 four-way handshake is performed again. By forcing this reconnection, an ethical hacker can capture the handshake and later attempt password recovery in an offline process.

Airodump-ng is primarily a passive capture and monitoring tool used to list access points and clients, hop channels, and capture packets and handshakes, but it does not perform packet injection itself. Aircrack-ng is the cracking component that attempts to recover the WPA/WPA2 pre-shared key from a captured handshake using a wordlist or other offline techniques; it is not the tool that kicks clients off the network. Airbase-ng is used for creating a rogue access point or conducting evil twin style attacks, which is different from transmitting deauthentication frames to trigger a handshake.

Therefore, the tool that matches the described action of actively sending frames to force disconnect and reconnect is Aireplay-ng.

The correct answer is A. Sending an email to a non-existent address during an authorized penetration test can trigger a bounce-back or non-delivery report. These responses may reveal useful reconnaissance information such as mail server names, IP addresses, SMTP banners, internal hostnames, anti-spam gateways, mail routing behavior, and how the organization handles undeliverable messages. This technique supports the CEH reconnaissance and footprinting phase, where testers gather publicly or externally exposed information before deeper testing. It is not intended to create spam, identify root users, test antivirus directly, or perform a denial-of-service attack.

CEH defines spyware as malware designed to covertly observe user behavior and transmit sensitive information to attackers without the victim’s knowledge. Spyware commonly records keystrokes, browser activity, form submissions, application usage, and other personally identifiable information. CEH highlights that spyware often operates silently and may disguise itself as legitimate software, making detection difficult. Unlike rootkits—which hide processes and files—or worms that self-replicate, spyware focuses exclusively on monitoring and data exfiltration. It is frequently installed through phishing, drive-by downloads, browser vulnerabilities, or malicious installers. Spyware can serve as a stepping stone for further system compromise by providing attackers with credentials for privilege escalation, lateral movement, or financial theft. CEH emphasizes the need for endpoint hardening, updated anti-malware engines, and behavioral analysis tools to detect such stealthy monitoring programs.

This scenario describes steganographic sniffing, a highly sophisticated technique covered in CEH v13 Network Sniffing and Steganography. By embedding sensitive data inside legitimate image files—such as CT scans—attackers can intercept or exfiltrate patient information while avoiding detection.

Option D represents a steganography-based covert channel, which is extremely difficult to identify because:

The file appears legitimate

Standard encryption and IDS tools do not flag it

Medical images naturally contain large data volumes

Options A and B involve malware, which is more detectable. Option C involves text-based covert channels, which are easier to analyze than binary image embedding.

CEH v13 identifies steganography as one of the hardest data-hiding techniques to detect, making Option D correct.

The correct answer is D. IPsec (Internet Protocol Security). The question specifically asks for a Layer 3 protocol that can provide end-to-end encryption for FTP traffic. IPsec operates at the Network Layer (Layer 3) of the OSI model and secures IP communications by providing confidentiality, integrity, authentication, and anti-replay protection.

Since standard FTP transmits usernames, passwords, and data in plaintext, it is vulnerable to packet sniffing and man-in-the-middle attacks. By implementing IPsec, all IP packets exchanged between the client and server can be encrypted regardless of the application being used. This means FTP traffic can be protected without modifying the FTP application itself.

Option A (FTPS) uses SSL/TLS to secure FTP but operates at higher layers. Option B (SFTP) is a secure file transfer protocol that runs over SSH and is considered an application-layer solution rather than a Layer 3 protocol. Option C (SSL) provides transport/session-layer encryption and is not a Layer 3 protocol.

CEH Exam Tip:

IPsec = Layer 3 (Network Layer) Encryption

SSL/TLS = Higher-layer Encryption

SFTP = SSH-based Secure File Transfer

FTPS = FTP over SSL/TLS

Therefore, the best answer is D. IPsec.

CEH v13 stresses that IoT-to-OT convergence is one of the most dangerous architectures in critical infrastructure environments. IoT devices often lack strong security controls and become ideal entry points for lateral movement into OT systems controlling physical processes.

The immediate priority is to secure the communication boundary between IoT and OT systems. Implementing strong encryption, authentication, and access control ensures that even if an IoT device is compromised, it cannot be used as a pivot point. CEH v13 explicitly recommends network segmentation and secure communication channels as first-response containment measures.

Penetration testing (Option A) is valuable but time-consuming and not an immediate mitigation. ML-based tools (Option C) require training time and are not instant safeguards. IPS deployment (Option D) helps detect attacks but does not prevent credential abuse or trusted-path exploitation between IoT and OT layers.

By enforcing secure protocols, certificates, and authentication mechanisms, the organization reduces attack surface immediately. Thus, Option B is correct.

The correct answer is D. XMAS Scan.

An XMAS scan sends TCP packets with multiple flags set, commonly FIN, URG, and PSH. In RFC 793-style behavior, closed ports respond with RST, while open ports often return no response.

CEH scanning material describes inverse TCP flag scanning as sending TCP probes with flags such as FIN, URG, and PSH. It identifies probes with these flags as XMAS scanning and explains that a closed port responds with an RST packet, while open ports may ignore or drop the abnormal packet combination .

Option A. FIN Scan is incorrect because a FIN scan uses only the FIN flag, while the scenario specifies an uncommon combination of multiple TCP control bits.

Option B. UDP Scan is incorrect because the probes are TCP packets, not UDP packets.

Option C. TCP Connect Scan is incorrect because a TCP connect scan completes the normal three-way handshake.

Option D. XMAS Scan is correct because it uses multiple TCP flags and produces the open/closed behavior described.

Therefore, the best answer is D. XMAS Scan.

The correct answer is HTTP Server Core because the scenario describes the primary module of a web server that processes incoming requests and coordinates with additional modules responsible for encryption, URL rewriting, and authentication. In CEH-aligned web server architecture concepts, the core HTTP engine is responsible for handling client requests, managing connections, parsing HTTP headers, and passing requests to the appropriate modules for further processing.

Modern web servers such as Apache HTTP Server or Nginx operate using a modular architecture. The core component manages the fundamental HTTP protocol operations, while optional or loadable modules extend functionality. For example, SSL or TLS modules handle encryption, rewrite modules manage URL manipulation, and authentication modules enforce access controls. The description in the question clearly aligns with this architecture, where a central processing unit works in conjunction with supporting modules.

The other options do not fit. The Document Root refers only to the directory location from which web content is served. A Virtual Document Tree relates to how URLs are logically mapped to file paths. An Application Server is a separate server component that processes business logic, often interacting with backend systems, rather than directly managing HTTP request parsing at the core level.

Therefore, Jake is analyzing the HTTP Server Core, which is responsible for handling incoming requests and integrating modular security and performance features within the web server environment.