The TCP three-way handshake is the foundational mechanism used to establish a reliable connection between two devices. The sequence is as follows:
The client sends a SYN (synchronize) packet to the server to initiate the connection.
The server replies with a SYN-ACK (synchronize-acknowledge) packet.
The client sends an ACK (acknowledge) packet back to the server.
Therefore, the connection starts with a SYN packet from the client.
Reference: CEH v13 eCourseware - Module 03: Scanning Networks # "Understanding TCP Handshake" CEH v13 Study Guide - Chapter: "Scanning and Enumeration"

https://en.wikipedia.org/wiki/Meet-in-the-middle_attack
The meet-in-the-middle attack (MITM), a known plaintext attack, is a generic space-time tradeoff cryptographic attack against encryption schemes that rely on performing multiple encryption operations in sequence. The MITM attack is the primary reason why Double DES is not used and why a Triple DES key (168-bit) can be bruteforced by an attacker with 256 space and 2112 operations.
The intruder has to know some parts of plaintext and their ciphertexts. Using meet-in-the-middle attacks it is possible to break ciphers, which have two or more secret keys for multiple encryption using the same algorithm. For example, the 3DES cipher works in this way. Meet-in-the-middle attack was first presented by Diffie and Hellman for cryptanalysis of DES algorithm.

Comprehensive and Detailed Explanation:
Wireshark on Windows requires WinPcap to operate. WinPcap is a packet capture library that allows network interfaces to operate in promiscuous mode, which is essential for sniffing traffic.
From CEH v13 Courseware:
* Module 8: Sniffing # Sniffing Tools # WinPcap for Windows
Reference:Wireshark Documentation - "On Windows, WinPcap is required to capture live network traffic." Note: WinPcap has been succeeded by Npcap in modern versions.

The PSH (Push) flag in TCP instructs the sending system to:
* Immediately deliver data to the application.
* Avoid waiting for additional buffered data to form a full segment.
This is important in interactive communications like Telnet or SSH, where the delay in transmission would degrade the user experience.
From CEH v13 Courseware:
* Module 3: Scanning Networks # TCP Flags and Packet Structure
Reference:CEH v13 Study Guide - Module 3: TCP Header Fields and FlagsRFC 793 - Transmission Control Protocol (TCP)

The base metric represents the inherent qualities of a vulnerability, according to the Common Vulnerability Scoring System (CVSS). CVSS is a framework that numerically characterizes the severity of software vulnerabilities between the range of 0-10. CVSS consists of three metric groups: Base, Temporal, and Environmental. The base metric group captures the characteristics of a vulnerability that are constant over time and across user environments. The base metric group consists of six sub-metrics: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, and Impact. The impact sub-metric further consists of three sub-metrics: Confidentiality, Integrity, and Availability. The base metric group produces a score ranging from 0 to 10, which reflects the intrinsic and fundamental properties of a vulnerability12.
The other options are not correct for the following reasons:
* A. Temporal metric represents the inherent qualities of a vulnerability: This option is incorrect because the temporal metric group captures the characteristics of a vulnerability that change over time due to events external to the vulnerability. The temporal metric group consists of three sub-metrics: Exploit Code Maturity, Remediation Level, and Report Confidence. The temporal metric group modifies the base score to reflect the current state of the vulnerability, such as the availability of exploit code, the existence of patches or workarounds, and the degree of verification of the vulnerability report12.
* C. Environmental metric involves the features that change during the lifetime of the vulnerability: This option is incorrect because the environmental metric group captures the characteristics of a vulnerability that are relevant and unique to a user's environment. The environmental metric group consists of three sub-metrics: Modified Attack Vector, Modified Attack Complexity, and Modified Privileges Required. The environmental metric group also allows the user to assign importance values to the impact sub-metrics: Confidentiality Requirement, Integrity Requirement, and Availability Requirement. The environmental metric group modifies the base and temporal scores to reflect the impact of the vulnerability on the user's specific environment, such as the network configuration, the security objectives, and the asset value12.
* D. Temporal metric involves measuring vulnerabilities based on a specific environment or implementation: This option is incorrect because the temporal metric group does not involve measuring vulnerabilities based on a specific environment or implementation, but rather on the factors that change over time due to events external to the vulnerability. The environmental metric group, not the temporal metric group, involves measuring vulnerabilities based on a specific environment or implementation, as explained in option C.
References:
* 1: What is CVSS - Common Vulnerability Scoring System - SANS Institute
* 2: Common Vulnerability Scoring System - Wikipedia