In CEH v13 Module 03: Scanning Networks, ICMP scan types are covered under host discovery techniques in Nmap/Zenmap.
The -PP option in Nmap is used to perform an ICMP timestamp request scan.
This method sends an ICMP timestamp request and listens for a timestamp reply from the target.
It helps analysts determine the system uptime and verify whether the host is alive (for stealthy discovery).
Option Clarification:
A: -PY: SCTP INIT Ping (used for SCTP-based hosts).
B: -PU: UDP Ping (sends UDP packets).
C: -PP: ICMP Timestamp Ping - correct answer.
D: -Pn: Skips host discovery (treats all hosts as alive), not a ping type.
Reference:
Module 03 - Host Discovery Techniques
CEH Labs: Zenmap and Nmap Scanning with ICMP Ping Options
Nmap Docs: https://nmap.org/book/man-host-discovery.html

According to CEH v13 Module 08: Sniffing, the attack described is a classic example of ARP spoofing
/poisoning which leads to Man-in-the-Middle (MITM) scenarios. In such attacks, a malicious actor sends forged ARP responses to associate their MAC address with the IP address of a target system, redirecting traffic through their machine.
Tool Used: BetterCAP
BetterCAP is a powerful, modular MITM framework.
It can:
Perform ARP spoofing
Intercept and manipulate HTTP/HTTPS traffic
Modify packets in real-time
Carry out credential harvesting and session hijacking
Miley's actions match the default behavior of BetterCAP during an ARP spoofing attack:
Spoof ARP to redirect traffic.
Intercept and analyze (or manipulate) traffic.
Option Clarification:
A). Gobbler: An older ARP tool, but mostly for ARP scanning, not modern MITM attacks.
B). KDerpNSpoof: Incorrect or misspelled; not a recognized CEH tool.
C). BetterCAP: Correct - used for ARP spoofing and traffic manipulation.
D). Wireshark: Passive sniffer; cannot perform ARP spoofing or MITM.
Reference:
Module 08 - Sniffing Techniques # ARP Poisoning Using BetterCAP
CEH iLabs: Performing ARP Spoofing and SSL Stripping with BetterCAP

Comprehensive and Detailed Explanation:
Blind SQL injection is used when the application does not return errors or display query results. In such cases, attackers use inference methods such as:
* Boolean-based queries
* Time-based queries (e.g., using SLEEP or WAITFOR DELAY)
Elliot's use of timing delays indicates a time-based blind SQL injection.
From CEH v13 Courseware:
* Module 10: Web Application Hacking # SQL Injection Types
Reference:CEH v13 Study Guide - Module 10: Blind SQL Injection TechniquesOWASP - SQL Injection Cheat Sheet

In CEH v13 Module 14: Cryptography, IPSec (Internet Protocol Security) is defined as a framework used to establish secure communication channels over IP networks, particularly in VPNs.
IPSec supports encryption, authentication, and integrity.
Operates in Tunnel Mode (VPNs) or Transport Mode (End-to-End).
Core protocols: AH (Authentication Header) and ESP (Encapsulating Security Payload).
Option Analysis:
A: PEM: Privacy Enhanced Mail (email encryption).
B: PPP: Point-to-Point Protocol (data link layer, not encryption).
C: IPSEC: VPN encryption protocol.
D: SET: Secure Electronic Transaction (used in payment systems, obsolete).
Reference:
Module 14 - IPSec Overview in VPN Security
CEH eBook: Protocols Used in VPNs - IPSec, L2TP, PPTP

1. AV (Asset value) = $300 + (14 * $10) = $440 - the cost of a hard drive plus the work of a recovery person, i.e.how much would it take to replace 1 asset? 10 hours for resorting the OS and soft + 4 hours for DB restore multiplies by hourly rate of the recovery person.
2. SLE (Single Loss Expectancy) = AV * EF (Exposure Factor) = $440 * 1 = $440
3. ARO (Annual rate of occurrence) = 1/3 (every three years, meaning the probability of occurring during 1 years is 1/3)
4. ALE (Annual Loss Expectancy) = SLE * ARO = 0.33 * $440 = $145.2