https://en.wikipedia.org/wiki/Sniffing_attack
To prevent networks from sniffing attacks, organizations and individual users should keep away from applications using insecure protocols, like basic HTTP authentication, File Transfer Protocol (FTP), and Telnet. Instead, secure protocols such as HTTPS, Secure File Transfer Protocol (SFTP), and Secure Shell (SSH) should be preferred. In case there is a necessity for using any insecure protocol in any application, all the data transmission should be encrypted. If required, VPN (Virtual Private Networks) can be used to provide secure access to users.
NOTE: I want to note that the wording "best option" is valid only for the EC-Council's exam since the other options will not help against sniffing or will only help from some specific attack vectors.
The sniffing attack surface is huge. To protect against it, you will need to implement a complex of measures at all levels of abstraction and apply controls at the physical, administrative, and technical levels. However, encryption is indeed the best option of all, even if your data is intercepted - an attacker cannot understand it.

Adversaries could decide to build an possible or file difficult to find or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. this is often common behavior which will be used across totally different platforms and therefore the network to evade defenses.
Payloads may be compressed, archived, or encrypted so as to avoid detection. These payloads may be used throughout Initial Access or later to mitigate detection. typically a user's action could also be needed to open and Deobfuscate/Decode Files or info for User Execution. The user can also be needed to input a parole to open a parole protected compressed/encrypted file that was provided by the mortal. Adversaries can also used compressed or archived scripts, like JavaScript.
Portions of files can even be encoded to cover the plain-text strings that will otherwise facilitate defenders with discovery. Payloads can also be split into separate, ostensibly benign files that solely reveal malicious practicality once reassembled.
Adversaries can also modify commands dead from payloads or directly via a Command and Scripting Interpreter. surroundings variables, aliases, characters, and different platform/language specific linguistics may be wont to evade signature based mostly detections and application management mechanisms.

The SOA (Start of Authority) record contains key DNS parameters, including TTL (Time To Live). The components of an SOA record are in this order:
(domain) IN SOA (Primary Name Server) (Responsible party) (Serial) (Refresh) (Retry) (Expire) (Minimum TTL) Given:
Rutgers.edu. SOA NS1.Rutgers.edu ipad.college.edu (200302028 3600 3600 604800 2400.) Field breakdown:
* Serial: 200302028
* Refresh: 3600 seconds
* Retry: 3600 seconds
* Expire: 604800 seconds
* Minimum TTL: 2400 seconds # This is the TTL value
From CEH v13 Courseware:
* Module 3: Scanning Networks
* Topic: DNS Enumeration and Zone Transfers
* Subsection: Understanding DNS Records
CEH v13 Study Guide states:
"In an SOA record, the last value is the Minimum TTL - the amount of time other DNS servers should cache resource records for the zone." Incorrect Options:
* A: Serial number
* B: Refresh interval
* C: Expiry interval
* E/F: Arbitrary, not part of the SOA shown
Reference:CEH v13 Study Guide - Module 3: DNS Records and Zone TransfersRFC 1035 - Domain Names
- Implementation and Specification

When using exploits, you might gain access as only a local user. This limits what you can do on the target machine. You can use Meterpreters 'getsystem` command (https://github.com/rapid7/metasploit-payloads/blob
/master/c/meterpreter/source/extensions/priv/elevate.c#L70) to elevate your permissions from a local administrator to SYSTEM. This works by using three elevation techniques.