CEH v13 identifies misconfigured cloud security groups as the leading cause of cloud data exposure. Open ports, public storage buckets, and overly permissive firewall rules frequently expose sensitive data.

Brute force and DoS do not directly expose stored data, and side-channel attacks are rare and advanced.

The correct answer is A, Misconfiguration. A cloud storage bucket such as Amazon S3 becomes vulnerable when permissions, access policies, logging, encryption, or public exposure settings are incorrectly configured. In this scenario, the attacker is not exploiting a newly discovered software flaw or using malware; instead, they are taking advantage of an improperly configured cloud resource that exposes sensitive backup data and database credentials. CEH cloud-computing security topics emphasize that cloud security requires control policies, hardening, Identity and Access Management, and configuration management to control secure access to resources. The materials also identify cloud threats such as data loss/breach, insecure interfaces/APIs, privilege escalation, and unauthorized access to credentials. S3 bucket misconfigurations are specifically associated with checking whether a bucket is publicly accessible, whether logging is enabled, and whether server-side encryption is enabled. Therefore, the failure category is misconfiguration, with potential consequences including credential exposure, data breach, and account compromise.

IoT devices that transmit data without encryption expose all communication to interception. CEH explains that attackers can position themselves between the IoT device and cloud service to manipulate or capture traffic. A MitM attack enables interception of commands, credentials, and firmware data due to the absence of TLS protections.

The correct answer is A, Worm-like propagation. In CEH malware-threat concepts, a worm is malware that self-replicates and uses a computer network to send copies of itself to other systems without requiring human action. CEH-related material describes worms as self-replicating malware that use networks to spread to other systems and commonly consume resources while duplicating themselves. The scenario specifically says attackers exploit SMBv1 to spread malware across hosts, which matches worm behavior because the malware moves laterally from one vulnerable machine to another through a network service. This behavior is commonly associated with attacks such as WannaCry, where an SMBv1 vulnerability was weaponized so the malware could scan for vulnerable systems and spread via SMB after infection. Phishing involves tricking users through messages or websites, credential stuffing uses reused username/password pairs, and DoS focuses on denying availability. Since the key behavior is automated spreading across hosts through SMBv1, the best answer is worm-like propagation.

The correct answer is D because Telnet is insecure by default. Telnet is an older remote access protocol that provides command-line access to remote systems, but it does not encrypt communication. This means usernames, passwords, commands, and keystrokes can travel across the network in clear text and may be captured through sniffing or man-in-the-middle attacks. The CEH-aligned material specifically states that Telnet sends usernames, passwords, and keystrokes over the network as clear text, making it easy to sniff. HTTPS is secure HTTP over TLS/SSL, SFTP is file transfer protected through SSH, and SSH is a secure replacement for Telnet that uses encryption and commonly operates on TCP port 22. Therefore, compared with HTTPS, SFTP, and SSH, Telnet is the protocol that is insecure by default because confidentiality and secure authentication protection are not built into its normal operation.

The correct answer is B. Password Spraying because the pattern described is the defining behavior of a spraying attack: the attacker tries a small set of common or likely passwords (for example, seasonal passwords, default patterns, or organization-themed guesses) across many different user accounts, using only a few attempts per account to avoid account lockout thresholds. The scenario explicitly states that “many accounts each receive only a few login attempts,” the attacker “reuses a very small set of likely credentials across a large number of accounts,” and the activity is “spread out over several days and IP ranges to avoid triggering automated lockouts.” These are the exact operational traits that distinguish password spraying from traditional brute force.

In CEH-aligned credential attack concepts, brute force is typically characterized by repeated attempts against a single account (or a small set of accounts), often cycling through many password candidates until the correct one is found. That approach is noisy and quickly triggers lockouts and detection. Password spraying flips the strategy: it keeps the per-account attempt count low and distributes attempts widely and slowly, which reduces alerting and lockout events. This is why the attacker was able to successfully access “several low-privilege accounts” before the pattern was noticed—spraying often compromises accounts with weak or reused passwords while staying below detection thresholds.

Why the other options are incorrect: Session hijacking involves stealing or replaying session tokens/cookies after authentication, not repeated login attempts across accounts. CSRF forces a logged-in user’s browser to perform unintended actions; it does not produce distributed authentication failures in logs. Brute force is related, but the avoidance of lockouts through minimal attempts per account and broad targeting is the signature of password spraying.

Therefore, the observed behavior most clearly indicates a password spraying attack.

This scenario describes Platform as a Service (PaaS) because the provider delivers a managed platform where developers can deploy and run custom applications while the provider manages the underlying infrastructure components—servers, operating systems, storage, and often middleware/runtime components. The customer is responsible for application code and logic (and usually data and application configuration), but not for provisioning or maintaining the base compute and OS layers.

The key phrasing is: “developers can deploy and test custom applications without managing the underlying servers, operating systems, or storage,” and “the firm controls the application logic but not the runtime infrastructure.” That is the hallmark responsibility split of PaaS: the provider handles infrastructure and platform operations, enabling rapid development and deployment through managed runtimes, build/deploy pipelines, and scalable services.

Why the other models don’t fit:

IaaS (A) would require the customer to manage the OS and many platform components (patching, runtime configuration, middleware), even though the provider supplies the virtualized infrastructure. The scenario explicitly says they do not manage OS or servers.

SaaS (C) provides a complete finished application that the customer uses; customers typically cannot deploy their own custom application logic onto it in the way described.

XaaS (D) is a broad umbrella term, not the specific NIST-style service model classification being asked.

Therefore, the correct answer is B. Platform as a Service (PaaS).

The correct answer is C. Maintaining Access.

The red team has already gained administrative access. Installing a backdoor to preserve continued access after the initial vulnerability is remediated represents the Maintaining Access phase.

CEH methodology identifies five hacking phases: Reconnaissance, Scanning, Gaining Access, Maintaining Access, and Clearing Tracks. It explains that Maintaining Access is the phase where an attacker tries to maintain ownership and control over compromised systems, commonly using backdoors, rootkits, or Trojans to retain access . Another EC-Council-aligned reference states that Maintaining Access refers to retaining ownership of the system and securing continued access with backdoors, rootkits, Trojans, or Trojan horse backdoors .

Option A. Reconnaissance is incorrect because reconnaissance occurs before exploitation and focuses on information gathering.

Option B. Vulnerability Scanning is incorrect because scanning identifies weaknesses but does not involve installing persistence.

Option D. Clearing Tracks is incorrect because clearing tracks involves hiding evidence, altering logs, or avoiding detection.

Option C. Maintaining Access is correct because the backdoor is installed to preserve long-term access.

Therefore, the best answer is C. Maintaining Access.

The correct answer is MX. CEH reconnaissance material explains that MX, or Mail Exchange, records identify the mail servers responsible for receiving email for a domain. When a tester wants to understand how an organization handles incoming email traffic, MX records are the most relevant DNS data source because they reveal the designated mail infrastructure and often the priority order of mail servers. In this scenario, the objective is to gather passive intelligence about communication infrastructure without performing active network probing, so querying DNS records is appropriate. SOA records provide domain authority and zone administration information, TXT records often contain verification or policy-related text such as SPF details, and NS records identify authoritative name servers. While those can all contribute to broader reconnaissance, they do not directly answer which systems are responsible for receiving mail. CEH emphasizes that MX records are commonly used during footprinting to identify email infrastructure, support phishing simulations, analyze third-party mail providers, or map communication dependencies. Because the question explicitly asks for the DNS record type that reveals mail server configuration, MX is the correct choice.

RST hijacking is a TCP session hijacking technique emphasized in CEH materials under network attacks against established communications. In TCP, a Reset flag packet is used to abruptly tear down a connection. If an attacker can observe the session and determine the correct parameters such as IP addresses, ports, and an in-window sequence number, they can forge a TCP RST packet that appears to come from one endpoint. This can force the victim side to drop the session, making the legitimate client suddenly lose responsiveness.

The key clue in the scenario is that Rachel “observes a client-server communication” and then injects crafted packets that disrupt the client while the server continues to communicate with Rachel’s system. That behavior matches the practical use of RST hijacking in demonstrations: terminate or desynchronize the victim endpoint while keeping the server-side session usable long enough for the attacker to inject traffic with valid sequence and acknowledgment values. In a switched LAN, this is often paired with sniffing or traffic visibility to reliably craft the reset packet and subsequent injected packets.

Blind hijacking is different because the attacker cannot see the traffic and must guess sequence numbers, which contradicts the “observes communication” detail. UDP hijacking is not applicable because UDP is connectionless and does not use session state or RST flags. “TCP/IP hijacking” is a broad category, but the question asks for the specific technique used to disrupt the client via crafted packets, which is best identified as RST hijacking.

Covert channel communication is one of the most sophisticated evasion techniques described in CEH v13 Evasion Techniques. By embedding malicious data within unused or rarely inspected protocol fields (such as IP headers), attackers can bypass firewalls, IDS, and IPS systems entirely.

Unlike polymorphic malware (Option C), which can still be detected using behavior analysis, covert channels blend seamlessly into legitimate traffic. Packet fragmentation (Option D) is well-known and often mitigated. Honeypot spoofing (Option B) is rare and defensive in nature.

CEH v13 emphasizes that covert channels are difficult because:

They do not violate protocol specifications

They evade signature-based and stateful inspection

They appear as normal traffic

Detecting covert channels often requires deep protocol analysis and statistical traffic inspection, making them extremely challenging to mitigate.

Thus, Option A is the correct answer.

This scenario represents a Tautology-Based SQL Injection, a fundamental SQL injection technique covered under the Web Application Hacking module in the CEH v13 curriculum. The defining characteristic of this attack is the injection of a condition that always evaluates to TRUE, thereby bypassing authentication or authorization controls.

In the given example, the injected input 1 OR ' T ' = ' T ' ; -- manipulates the logical condition of the SQL query. A typical vulnerable login query may resemble:

SELECT * FROM users WHERE user_id = 1 AND password = ' input ' ;

When the attacker submits the injected payload, the resulting SQL statement becomes:

SELECT * FROM users WHERE user_id = 1 OR ' T ' = ' T ' ; -- ' ;

The expression ' T ' = ' T ' is a tautology, meaning it always evaluates to TRUE regardless of context. As a result, the database returns records without properly validating the user’s credentials, granting unauthorized access.

According to EC-Council CEH v13, tautology-based SQL injection is classified as a Boolean-based injection technique where attackers exploit improper input validation to alter the logical flow of SQL queries. This attack does not depend on database error messages (as in Error-Based SQL Injection), does not extract data using UNION statements (Union-Based SQL Injection), and does not rely on response delays (Time-Based Blind SQL Injection).

CEH v13 emphasizes that such attacks are especially effective against login forms and authentication mechanisms when developers fail to implement input sanitization, parameterized queries, or prepared statements. This attack is one of the most common and exam-tested SQL injection types because it clearly demonstrates how flawed logic can compromise application security without advanced techniques.

Understanding tautology-based SQL injection is critical for ethical hackers, as it forms the foundation for identifying and mitigating more complex SQL injection variants.

This scenario is a classic session fixation attack. In session fixation, the attacker sets or “fixes” a known session identifier (session ID) for the victim before the victim authenticates. The attacker then persuades the victim to use that predetermined session—often by embedding the session ID into a URL, link, or cookie setting mechanism. Once the victim logs in, the application incorrectly continues using the same session ID (rather than issuing a new one upon authentication). As a result, the attacker can reuse that known session ID to access the victim’s authenticated session context.

The described sequence matches session fixation exactly: James first crafts a session and obtains a session ID, then shares it with the victim via a link, the victim clicks and logs in, and “their activity is bound to the attacker’s pre-assigned session.” Later, James accesses the session and retrieves the victim’s input—demonstrating that authentication was tied to an attacker-controlled session token.

Why the other options do not fit:

Session replay (B) involves capturing a valid session token (e.g., via sniffing, XSS, or leakage) and replaying it, but it does not require pre-setting the token before the victim logs in.

Session prediction (C) is about guessing or calculating valid session IDs due to weak randomness. Here the attacker does not guess; he deliberately provides a session ID he already controls.

“Session donation (A)” is not the standard classification for this well-known web session weakness in CEH-style taxonomy; the described behavior aligns with fixation.

Therefore, the correct answer is D. Session Fixation Attack.

The correct answer is D, Long-term access. In MITRE ATT & CK terminology, “Persistence” refers to techniques adversaries use to keep access to a compromised environment after the initial compromise. This aligns closely with CEH system-hacking methodology, where the equivalent phase is “Maintaining Access.” CEH material describes maintaining access as the phase where a hacker tries to retain ownership of a system after exploiting a vulnerability, often by securing continued access through backdoors, rootkits, Trojans, or Trojan horse backdoors. Another CEH-focused source explains that after privilege escalation, the attacker moves into maintaining access by setting up mechanisms that allow return access later, which directly matches the concept of long-term access. Initial exploit belongs to gaining access, data theft relates more to collection or exfiltration, and cleanup relates to covering tracks. Therefore, ATT & CK “Persistence” means maintaining long-term access to the target environment.

The correct answer is D. Spearphone Attack.

A Spearphone Attack uses motion sensor data, such as accelerometer readings, to infer or reconstruct speech played through a smartphone’s loudspeaker. The attack is notable because it does not require direct microphone access. Instead, it abuses sensor readings produced by speaker vibrations and acoustic coupling inside the device.

The scenario states that no microphone or camera permission change occurred, but an installed application continuously read motion sensor output while the loudspeaker was active. The collected measurements were then used to reconstruct acoustic characteristics. These details precisely match Spearphone.

CEH-aligned mobile security material highlights that mobile devices can be attacked through malware, insecure applications, and application/OS abuse, and that mobile malware is commonly used to steal personal or sensitive data from devices .

Option A. Camfecting is incorrect because camfecting involves unauthorized camera activation or camera spying.

Option B. StormBreaker Abuse is incorrect because StormBreaker is associated with phishing/social-engineering frameworks that may capture device data, but the scenario specifically involves motion-sensor acoustic reconstruction.

Option C. Android Camera Hijack Attack is incorrect because no camera misuse is described.

Option D. Spearphone Attack is correct because the attack reconstructs speech from motion sensor readings while the loudspeaker is active.

Therefore, the best answer is D. Spearphone Attack.