A Kernel-level rootkit operates at the core of the operating system (OS kernel), enabling the attacker to:
* Modify or replace kernel code
* Load malicious kernel modules
* Hide files, processes, and backdoors at a level that is difficult for standard security tools to detect According to CEH v13:
* Kernel-mode rootkits are highly stealthy and dangerous because they run with the highest privileges.
* These rootkits modify system calls and memory structures in the kernel space to conceal malicious activity.
Incorrect Options:
* A. User-mode rootkits operate at the application layer and are less stealthy than kernel-level rootkits.
* B. Library-level rootkits manipulate standard libraries (like libc) to intercept calls.
* D. Hypervisor-level rootkits run beneath the OS (e.g., via virtualization) and are extremely rare and complex.
Reference - CEH v13 Official Courseware:
Module 06: Malware Threats
Section: "Types of Rootkits"
Subsection: "Kernel-Mode Rootkits vs. User-Mode Rootkits"

In LM hashing (used in legacy Windows systems), passwords are split into two 7-character chunks. If a password is fewer than 8 characters, the second half is padded with nulls and hashed to a constant value.
That constant is:
* AAD3B435B51404EE
Thus, the second half of the LM hash (the rightmost 16 characters) is always the same if the password is < 8 characters.
From CEH v13 Courseware:
* Module 6: Malware Threats # LM Hash Characteristics
CEH v13 Study Guide states:
"If the password is less than 8 characters, the second half of the LM hash will always be
'AAD3B435B51404EE', indicating the hash belongs to a short password."
Reference:CEH v13 Study Guide - Module 6: Understanding LM/NTLM Hashes

LAN Manager (LM) hashes are legacy password hashing methods used in older Windows systems (including Windows 2000 for backward compatibility). LM hashing works by:
* Converting the password to uppercase.
* Padding or truncating it to 14 characters.
* Splitting it into two 7-character halves.
* Using each half as a DES key to encrypt a known constant ("KGS!@#$%").
Therefore, LM hashing uses the DES (Data Encryption Standard) algorithm.
From CEH v13 Official Courseware:
* Module 6: Malware Threats # Password Storage and LM Hash Structure
Reference:CEH v13 Study Guide - Module 6: Windows Password StorageMicrosoft Security Documentation
- LM/NTLM Authentication

Zero Trust Networks The Zero Trust model is a security implementation that by default assumes every user trying to access the network is not a trusted entity and verifies every incoming connection before allowing access to the network.It strictly follows the principle, "Trust no one and validate before providing a cloud service or granting access permission."It also allows companies to impose conditions, such as allowing employees to only access the appropriate resources required for their work role. (P.2997/2981) Zero Trust is a strategic initiative that helps prevent successful data breaches by eliminating the concept of trust from an organization's network architecture. Rooted in the principle of "never trust, always verify," Zero Trust is designed to protect modern digital environments by leveraging network segmentation, preventing lateral movement, providing Layer 7 threat prevention, and simplifying granular user-access control.

Hashing algorithms (such as SHA-256 or MD5) are used to generate a unique digital fingerprint of a file or message. Once the CFO approves the financial statement, generating a hash value for the document ensures that if any modification occurs (even a single bit), the hash value will change, indicating a breach in data integrity.
This solution directly addresses integrity - one of the three components of the CIA triad (Confidentiality, Integrity, Availability). Password protection or transferring via USB does not ensure integrity; they offer access control and delivery security.
Reference:
CEH v13 eCourseware - Module 20: Cryptography # "Hash Functions"
CEH v13 Study Guide - Chapter: Cryptographic Controls # Data Integrity with Hashes