Comprehensive and Detailed Explanation:
IDS cannot easily detect malicious content in encrypted traffic. Since the payload is encrypted (e.g., HTTPS, SSL/TLS), it is unreadable without decryption.
Statement B is therefore FALSE.
From CEH v13 Courseware:
* Module 13: IDS, Firewalls and Honeypots # Limitations of IDS
Reference:CEH v13 Study Guide - IDS Capabilities and Limitations

Comprehensive and Detailed Explanation:
Steganography allows someone to hide data (like a spreadsheet or document) within another innocuous- looking file (like an image, video, or audio). This disguises the presence of the data entirely, allowing it to bypass standard data loss prevention (DLP) systems and firewalls, which look for file types and suspicious patterns.
From CEH v13 Courseware:
* Module 6: Malware Threats # Steganography and Covert Channels
Reference:CEH v13 Study Guide - Module 6: Data Hiding Techniques Using SteganographyNIST SP 800-83
- Guide to Malware Handling and Prevention

In CEH v13 Module 14: Cryptography, key escrow is discussed as a recovery mechanism where a third party securely holds a cryptographic key for retrieval if it's lost.
Key Escrow Characteristics:
Common in enterprise environments for systems like BitLocker.
Keys are automatically backed up to Active Directory (AD) for future retrieval.
Ensures that encrypted data is not permanently lost due to forgotten or deleted keys.
Option Clarification:
A). Key archival: Storing old keys for audit/record-keeping.
B). Key escrow: Correct - Third-party or central storage for recovery purposes.
C). Certificate rollover: Replacement of expiring certificates.
D). Key renewal: Generating a new key after expiration or compromise.
Reference:
Module 14 - Key Management and Recovery # Key Escrow
CEH iLabs: BitLocker Key Recovery through Active Directory Escrow

The Snort rule in the image is detecting suspicious bind attempts over DCERPC (Distributed Computing Environment/Remote Procedure Call), specifically targeting ports 135 (RPC) and 445 (SMB) with crafted content. The rule references CVE CAN-2003-0352.
CVE-2003-0352 is associated with the DCOM RPC vulnerability in Microsoft Windows that was exploited by the MS Blaster (also known as Lovsan) worm in 2003.
Key Indicators from the Snort Rule:
alert tcp $EXTERNAL_NET any -> $HOME_NET 135
content includes DCERPC binding pattern (|05| and |0b| with specific binary patterns) Reference to CVE-2003-0352 Class type: attempted-admin The MS Blaster worm exploited this vulnerability by sending a specially crafted RPC request to port 135, allowing remote code execution.
From CEH v13 Courseware:
Module 6: Malware Threats
Module 11: Session Hijacking
Discussion of historic worms and their exploit signatures, including MS Blaster.
Incorrect Options:
A). WebDav: Typically uses HTTP/HTTPS and was exploited by Nimda.
B). SQL Slammer: Targeted UDP port 1434 (SQL Server), not TCP 135/445.
D). MyDoom: Spread via email and exploited Windows file-sharing mechanisms (port 3127), not DCERPC.
Reference:CEH v13 Study Guide - Module 6: Malware Threats # Classic Worm AttacksCVE Details:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0352Microsoft Security Bulletin MS03-026 - RPC Vulnerability

Passive OS fingerprinting involves observing traffic from a remote host and analyzing it to infer details about the operating system without actively sending packets or probes. This is useful in stealthy reconnaissance where avoiding detection is critical.
tcpdump is a packet analyzer that captures traffic in real time. By analyzing certain TCP/IP header fields such as TTL (Time-To-Live), window size, TCP options, and DF (Don't Fragment) flags, attackers can passively deduce the operating system of the target host.
CEH v13 Guide states:
"Passive fingerprinting tools like tcpdump and Wireshark allow the attacker to capture packets and analyze them for OS-specific traits, making it possible to identify the OS without sending packets to the target system." Reference - CEH v13 Study Guide:
Module 02: Footprinting and Reconnaissance, Section: "OS Fingerprinting Techniques", Subsection: "Passive OS Fingerprinting" Incorrect Options Explained:
* A: nmap is primarily an active scanning tool (though it has limited passive capabilities).
* C: tracert is used for tracing packet routes, not OS fingerprinting.
* D: ping checks host availability and latency, not OS details.
###############