CEH v13 explains that multi-vector DDoS attacks, especially those combining volumetric reflection (DNS amplification) with application-layer exhaustion (Slowloris), require multi-layered mitigation. Standard firewalls and IPS devices cannot handle large-scale distributed attacks without causing collateral damage to legitimate traffic. CEH emphasizes the need for hybrid DDoS protection, combining on-premises appliances for real-time local filtering with cloud-based scrubbing centers capable of absorbing massive volumetric floods. Cloud scrubbing removes malicious traffic upstream, while on-prem devices mitigate application-layer anomalies. Increasing bandwidth (Option A) is ineffective against reflection attacks. IPS (Option B) cannot handle Slowloris-style partial requests at scale. Blocking all external DNS/HTTP (Option C) would deny service to legitimate users. The correct CEH-aligned solution is hybrid DDoS mitigation services.

OSINT-based reconnaissance includes using search engines to identify publicly exposed cloud assets. CEH highlights Google dorking as a passive method to reveal S3 buckets indexed in search engines through patterns such as site:s3.amazonaws.com or keyword-based queries.

According to the CEH Network Scanning module, Idle Scanning (Zombie Scanning) is one of the most stealthy reconnaissance techniques. In this method, the attacker uses an idle third-party host (zombie) to probe the target indirectly.

Because all scan packets appear to originate from the zombie system, the true attacker remains hidden. CEH highlights that idle scans:

Are extremely stealthy

Generate minimal traffic from the attacker

Make attribution very difficult

Option B is correct.

Option A (FIN scan) is stealthy but still traceable.

Option C is noisy and easily detected.

Option D describes a Xmas scan, which is detectable.

CEH classifies idle scanning as one of the hardest scanning techniques to trace.

The correct answer is A. Honey trap. In CEH social engineering concepts, a honey trap is a technique in which an attacker creates a fake attractive identity, often on social media or dating platforms, to build emotional trust with a target. The attacker then uses that trust to extract sensitive personal, corporate, or security-related information.

In this scenario, Steve created a fake social media profile and used an appealing profile picture and description to attract Stella. Once Stella accepted the request and began communicating with him, Steve gradually asked questions about her company and collected important organizational information. This matches the honey trap method because the attacker used attraction, trust, and manipulation to obtain confidential information.

Option B, diversion theft, involves redirecting deliveries or information to the wrong location. Option C, piggybacking, means gaining physical access by following an authorized person. Option D, baiting, uses an enticing object or offer, such as infected USB media, to lure victims. Therefore, the best answer is Honey trap.

The correct answer is A. Enumerating IAM Roles.

The scenario describes a tester who is examining identity entities, attached policies, permission boundaries, and levels of access across cloud resources. These are all functions of Identity and Access Management (IAM). In the CEH cloud security context, cloud security management includes Governance, Risk Management, and Compliance (GRC), Identity and Access Management (IAM), and Patch and Configuration Management, which are used to control secure access to cloud resources .

Enumerating IAM roles is the best match because IAM roles define what identities can do, which policies are attached, and what privileges can be assumed or exercised. A cloud assessment reference also lists IAM checks such as identifying IAM users and roles using aws iam list-users and aws iam list-roles, and reviewing permissions using aws iam get-policy .

Option B. Enumerating S3 Buckets is incorrect because S3 enumeration focuses on storage buckets, permissions on buckets, public exposure, encryption, and logging. It does not primarily identify identity-policy relationships.

Option C. Enumerating EC2 Instances is incorrect because EC2 enumeration focuses on virtual machines, instance metadata, AMIs, regions, security groups, and running compute resources. It does not directly map to querying identity entities and attached policies.

Option D. Enumerating Serverless Resources is incorrect because serverless enumeration focuses on functions, triggers, event sources, and execution configurations. Although serverless functions may use roles, the question’s main focus is identity entities and their permissions, which makes IAM role enumeration the most precise answer.

Therefore, the best answer is A. Enumerating IAM Roles.

The scenario describes a Layer 7 (application-layer) denial-of-service pattern: Javier sends a wave of repetitive web requests that specifically overload backend scripts responsible for search queries and form submissions. This is characteristic of an HTTP GET/POST attack, where the attacker floods a web application with large volumes of HTTP requests—commonly GET requests for pages/resources and POST requests that trigger server-side processing (login, checkout, searches, form handlers). Because these requests can be syntactically valid and target costly operations, they can quickly exhaust CPU, memory, threads, database connections, or application worker pools, resulting in slow responses and timeouts for legitimate users—exactly what the customers experience here.

Why the other options don’t fit as well:

Slowloris (A) is also an application-layer technique, but it works differently: it holds many connections open by sending partial HTTP headers very slowly, aiming to exhaust the server’s concurrent connection capacity. The question emphasizes repetitive requests overloading backend scripts, not slow, incomplete requests holding sockets open.

UDP Flood (B) is a network/transport-layer volumetric attack that sends massive UDP packets to random or targeted ports, consuming bandwidth and host resources. It doesn’t specifically target web scripts handling search/forms.

Peer-to-Peer Attack (C) typically involves abusing P2P networks or reflection/amplification through distributed peers; it’s not described as direct repetitive web requests to application endpoints.

The key indicators are: (1) web requests (2) targeting script-driven functions like search and form submissions, and (3) resulting in user-facing slowness/timeouts due to overwhelmed application processing. These align most directly with D. HTTP GET/POST Attack.

CEH v13 explains that the Deep Web contains content not indexed by search engines, including exposed databases, misconfigured portals, leaked credentials, and internal documents.

This makes it a critical area to assess unintended data exposure. The Deep Web is not primarily for attacker profiling or insider detection.

Thus, Option D is correct.

A bootkit is the rootkit type that best matches the described behavior because it compromises the system boot process and executes before the operating system fully loads, often before many security controls, drivers, and monitoring services start. CEH materials describe bootkits as a highly persistent class of malware that targets components such as the Master Boot Record, Volume Boot Record, or bootloader. By gaining execution at boot time, a bootkit can load malicious code very early, then hook or tamper with OS loading routines, kernel initialization, or security mechanisms. This early execution is exactly what the scenario emphasizes: the payload runs “before any system-level drivers or services are active,” enabling covert control while evading traditional user-mode detection.

This also explains why administrators see suspicious network activity but forensics do not easily find malicious user-level artifacts. Bootkits can hide by manipulating what the OS and security tools can see after startup, including concealing files, processes, registry keys, or even redirecting reads so scanners receive “clean” data. Because the malicious component is anchored in the boot chain, it can survive reboots and remain present even if many OS-level indicators are cleaned.

A kernel-mode rootkit operates within the OS kernel but typically loads after the OS begins booting and drivers initialize. A hypervisor rootkit relies on virtualization to sit beneath the OS at runtime, but the scenario specifically highlights boot-time execution prior to drivers and services. Firmware rootkits persist in BIOS/UEFI or device firmware, which is possible, but the most direct match to “boot process compromise below the OS” in CEH terminology is a bootkit.

The correct answer is D. A hash algorithm is used to verify data integrity, which means confirming that information has not been changed after approval or transmission. Once the CFO approves the financial statements, a hash value can be generated for the document using algorithms such as SHA-256. Later, the accountant can calculate the hash again and compare it with the original hash. If both hash values match, the document has not been modified. If even one character, number, or byte changes, the resulting hash will be different.

Option A only controls the delivery medium and does not prove the file was unchanged. Option B provides password protection, which relates more to access control or confidentiality, not strong integrity verification. Option C gives redundancy, but both copies could still be altered or mishandled.

In CEH cryptography concepts, hashing is specifically associated with integrity verification, while encryption protects confidentiality and digital signatures provide integrity, authentication, and non-repudiation. Therefore, using a hash algorithm is the most suitable answer.

CEH defines passive reconnaissance as collecting information without directly engaging the target.

Option A is incorrect for passive reconnaissance because Nmap scanning actively probes systems, generating detectable traffic.

Options B, C, and D rely on publicly available information and are standard passive techniques.

CEH classifies Nmap scanning as active footprinting.

The most likely tool/command is dig @server axfr, which attempts a DNS zone transfer (AXFR) from a specified DNS server. In CEH-aligned reconnaissance and enumeration methodology, DNS is a high-value target because it reveals how an organization’s names map to systems. A successful zone transfer can expose an entire DNS zone database, often including hostnames (subdomains), mail exchanger (MX) records, canonical name (CNAME) aliases, and sometimes internal-facing entries if the zone is misconfigured. The scenario’s outcome—receiving “a full list of subdomains, MX records, and aliases”—matches exactly what an AXFR zone transfer can disclose when a DNS server is improperly configured to allow transfers to unauthorized hosts.

The clue about a “secondary server” is also significant. In DNS architecture, organizations frequently deploy primary (master) and secondary (slave) DNS servers. Secondary servers legitimately request zone transfers from the master to stay synchronized. If the secondary server is misconfigured (for example, allowing AXFR to any requester or to a broader range than intended), an attacker can exploit this and retrieve the zone file. This results in detailed visibility into the organization’s naming scheme and infrastructure layout—information that can be used to identify high-value targets (mail servers, VPN portals, admin hosts), locate staging points, and plan follow-on attacks such as credential harvesting, targeted exploitation, or social engineering.

Why the other options do not fit: smtp-user-enum.pl is used for enumerating valid users on SMTP servers, not DNS records. ldapsearch enumerates directory information from LDAP services, not DNS zones. nbtstat -A queries NetBIOS name tables for Windows hosts, which may reveal local names and shares but not DNS-wide subdomains and MX/CNAME records. Therefore, the enumeration described is most consistent with a DNS zone transfer using dig with AXFR.

The correct answer is B. HTTP/2 Stream Memory Not Reclaimed on RST.

The scenario describes an Apache web service using a multiplexed protocol, which points to HTTP/2. The important symptoms are steadily increasing memory consumption, normal client disconnects, repeated stream activity, and memory not returning to baseline. This strongly indicates that HTTP/2 stream-related memory is not being properly reclaimed after stream reset or termination events.

CEH-aligned web server material emphasizes that Apache web servers, like other web servers, can contain bugs and implementation vulnerabilities that require fixes and secure configuration review . The described behavior is not a generic misconfiguration; it is a protocol-specific memory-management issue associated with HTTP/2 stream handling.

Option A. DoS in HTTP/2 with Initial Window Size 0 is incorrect because that issue centers on abusing flow-control window behavior, not unreclaimed memory after stream resets.

Option C. Insecure Default Configuration is incorrect because the issue only appears when HTTP/2 multiplexed mode is enabled and is tied to stream memory behavior.

Option D. mod_macro Buffer Over-read is incorrect because the scenario does not involve mod_macro, buffer over-read behavior, or disclosure from memory.

Therefore, the best answer is B. HTTP/2 Stream Memory Not Reclaimed on RST.

The correct answer is C. Container orchestration because the described features—automated deployment, scaling, service discovery, and workload management across multiple nodes—are the defining functions of a container orchestration platform, and Kubernetes is the most widely used orchestration system for containers. In CEH-aligned cloud and container security discussions, orchestration refers to the automated coordination of containerized workloads so that applications remain available, scalable, and manageable without administrators manually placing or maintaining each container instance.

In Kubernetes, orchestration is achieved through the control plane and a set of components that continuously maintain the desired state of applications. For example, scheduling places pods onto nodes based on resource availability and constraints; controllers ensure that the correct number of replicas are running; services and DNS enable stable naming and service discovery; and autoscaling mechanisms adjust capacity according to demand. These combined behaviors allow the platform to keep critical services operating “smoothly” even as nodes change, workloads shift, or failures occur.

Why the other options are not the best match: Self-healing is a specific benefit of orchestration (Kubernetes restarts failed containers, reschedules pods, and replaces unhealthy instances), but it does not fully encompass the broader set of capabilities listed, such as deployment automation, scaling, and service discovery. Kube-controller-manager is a particular Kubernetes control-plane component that runs controller processes; it contributes to orchestration internally, but the question asks for the overarching capability responsible for the set of functions, which is container orchestration as a whole. Container vulnerabilities is not a Kubernetes capability; it is a security risk category (e.g., vulnerable images, misconfigurations, runtime exploits).

Therefore, the capability primarily responsible for automated deployment, scaling, service discovery, and multi-node workload management in Kubernetes is container orchestration.

The correct answer is B. Botnet Agents because the behavior described matches a command-and-control (C2) driven malware model where multiple compromised systems (“bots” or “zombies”) communicate with a remote controller and can be issued coordinated commands. In CEH-aligned malware concepts, a botnet is a collection of infected endpoints under centralized or distributed control. The malicious component installed on each infected workstation is commonly referred to as a bot/bot agent, which “checks in” to a C2 server to receive instructions and execute tasks silently in the background.

Several details strongly indicate botnet agent behavior: the payload is delivered via a disguised email attachment (a common initial infection vector), compromised machines silently communicate outbound to a remote server, and—most importantly—Daniel confirms multiple infected endpoints can receive synchronized commands and carry out actions simultaneously. The example of “sending bursts of outbound traffic on demand” aligns with typical botnet capabilities such as orchestrated DDoS traffic generation, mass scanning, spam sending, credential stuffing, or distributed task execution. The sustained observation “over the following week” also fits a botnet model where infected hosts maintain persistence and periodically beacon to C2 for updates and instructions.

Why the other options do not fit: Spyware primarily focuses on covertly collecting information (keystrokes, screenshots, browsing data) rather than executing synchronized commands across many machines. Scareware relies on alarming messages to trick users into paying or installing unwanted software; it does not describe silent C2 coordination. PUAs are typically unwanted but not necessarily malicious, often installed via bundling and usually lack structured C2 for coordinated remote command execution.

Therefore, the malicious component being simulated is best identified as botnet agents operating under C2 control.

The correct answer is A, DoS. If a Python API allows unlimited file upload size, an attacker can upload extremely large files or repeatedly upload many files until server resources are exhausted. This can consume disk space, memory, CPU, application worker threads, temporary storage, or bandwidth, causing the API or hosting server to slow down, crash, or become unavailable to legitimate users. CEH web application security guidance emphasizes validating input and applying file-upload controls such as content-type checks and malware scanning. It also notes that system resources can be depleted, such as by filling disk space, leading to denial of service. In CEH DoS concepts, a denial-of-service attack restricts or blocks authorized users from accessing system resources; flooding servers or exhausting resources prevents genuine requests from being served. XSS involves script injection, SQLi targets database queries, and CSRF forces authenticated users to perform actions. The issue here is resource exhaustion, so DoS is the best answer.