Whaling is an advanced social engineering technique that targets high-profile individuals, such as executives, managers, or celebrities, by impersonating them or someone they trust, such as a colleague, partner, or vendor. The attacker creates a fake Linkedin profile, pretending to be a high-ranking official from a well- established company, and uses it to connect with other employees within the organization. The attacker then leverages the trust and authority of the fake profile to gain access to exclusive corporate events and proprietary project details shared within the network. This way, the attacker can launch targeted attacks against the organization, such as stealing sensitive data, compromising systems, or extorting money.
The most likely immediate threat to the organization is the loss of confidential information and intellectual property, which can damage the organization's reputation, competitiveness, and profitability. The attacker can also use the information to launch further attacks, such as ransomware, malware, or sabotage, against the organization or its partners and customers.
The other options are not as accurate as whaling for describing this scenario. Pretexting is a social engineering technique that involves creating a false scenario or identity to obtain information or access from a victim.
However, pretexting usually involves direct communication with the victim, such as a phone call or an email, rather than creating a fake Linkedin profile and connecting with the victim's network. Spear phishing is a social engineering technique that involves sending a personalized and targeted email to a specific individual or group, usually containing a malicious link or attachment. However, spear phishing does not involve creating a fake Linkedin profile and connecting with the victim's network. Baiting and involuntary data leakage are not social engineering techniques, but rather possible outcomes of social engineering attacks.
Baiting is a technique that involves offering something enticing to the victim, such as a free download, a gift card, or a job opportunity, in exchange for information or access. Involuntary data leakage is a situation where the victim unintentionally or unknowingly exposes sensitive information to the attacker, such as by clicking on a malicious link, opening an infected attachment, or using an unsecured network. References:
* Whaling: What is a whaling attack?
* Advanced Social Engineering Attack Techniques
* Top 8 Social Engineering Techniques and How to Prevent Them

The described scenario is a textbook example of a Man-in-the-Middle (MITM) attack. In such attacks, the attacker stealthily places themselves between two communicating systems, intercepts their communications, and may even modify the traffic. The communicating parties remain unaware that their traffic is being monitored or altered.
Eric is using the Dsniff toolset, which is well-known for enabling MITM attacks through techniques such as:
* ARP spoofing (to redirect traffic)
* Credential sniffing
* Packet manipulation
From CEH v13 Official Courseware:
* Module 8: Sniffing
* Module 11: Session Hijacking
CEH v13 Study Guide states:
"In a man-in-the-middle (MITM) attack, the attacker intercepts and potentially alters the communication between two systems without either party knowing. Tools like Dsniff, Cain & Abel, and Ettercap are commonly used to launch such attacks." Incorrect Options:
* A: "Interceptor" is not a technical term in cybersecurity.
* C: ARP Proxy is a network feature; while ARP spoofing can be part of a MITM attack, it's not the attack classification itself.
* D: Poisoning (like DNS or ARP poisoning) is often a technique used to initiate MITM but not the final classification.
Reference:CEH v13 Study Guide - Module 8: Sniffing # MITM Attacks Using DsniffRFC 4949 - Internet Security Glossary (Definition of MITM)

ARP Spoofing Attack ARP packets can be forged to send data to the attacker's machine.Attackers flood a target computer's ARP cache with forged entries, which is also known as poisoning. (P.1143/1127)

A sniffer tool is a software or hardware device that can capture and analyze network traffic. In a switched Ethernet environment, where each port on a switch is connected to a single device, a sniffer tool can only see the traffic that is destined for or originated from the device it is attached to. However, an attacker can use various techniques to overcome this limitation and sniff the traffic of other devices on the same network. One of these techniques is MAC flooding, which exploits the finite memory of the switch's MAC address table.
The attacker sends a large number of frames with different source MAC addresses to the switch, which fills up the MAC address table and causes the switch to enter a fail-open mode, where it broadcasts all incoming frames to all ports, regardless of the destination MAC address. This way, the attacker can see all the traffic on the network and capture it with a sniffer tool.
The other options are less likely or less effective techniques for sniffing a switched Ethernet network.
Compromising physical security to plug into the network directly may allow the attacker to sniff the traffic of the device they are connected to, but not the traffic of other devices on the network. Using a Trojan horse with in-built sniffing capability may allow the attacker to sniff the traffic of the infected device, but not the traffic of other devices on the network, unless the Trojan horse also performs MAC flooding or other techniques to bypass the switch. Using passive sniffing, which involves listening to the network traffic without sending any packets, may provide significant stealth advantages, but it does not help the attacker to see the traffic of other devices on the network, unless the switch is already in fail-open mode or the attacker uses other techniques to induce it.
References:
Sniffing: A Beginners Guide In 4 Important Points
How can I run a packet sniffer on a Router or Switch
Detection of Sniffers in an Ethernet Network

In CEH v13 Module 04: Enumeration, identifying services based on well-known port numbers is foundational for enumeration and scanning activities.
Port 21/TCP is assigned to the File Transfer Protocol (FTP).
FTP is a standard protocol used to upload, download, and manage files on a remote server.
During enumeration, open FTP ports can be probed for:
Anonymous login
Banner grabbing
Directory traversal vulnerabilities
Option Clarification:
A: BGP: Runs on TCP port 179.
C: NFS: Commonly uses port 2049.
D: RPC: Dynamically uses multiple ports.
Correct answer is B. FTP (port 21).
Reference:
Module 04 - Enumeration Ports and Services
CEH eBook Appendix: Common Port Numbers and Protocols