The main purpose of a rootkit is to hide malicious activity by modifying or replacing legitimate system binaries (e.g., ls, ps, netstat) so they no longer show the presence of malicious files, users, or processes. This enables attackers to maintain persistent and stealthy access.
From CEH v13 Official Courseware:
* Module 6: Malware Threats # Rootkits
CEH v13 Study Guide states:
"Rootkits are stealthy programs designed to conceal the existence of other malicious processes or programs by replacing legitimate operating system utilities and binaries. This makes detection and removal extremely difficult." Incorrect Options:
* A: This is a backdoor's behavior.
* B: A buffer overflow is a method of exploitation, not the rootkit's purpose.
* D: Refers to a backdoor or vulnerability, not a rootkit's core function.
Reference:CEH v13 Study Guide - Module 6: Rootkits and Malware TypesNIST SP 800-83 - Malware Incident Prevention and Handling

Comprehensive and Detailed Explanation:
Tshark is the command-line version of Wireshark. The correct syntax for filtering packets from a subnet:
sudo tshark -f "net 192.168.8.0/24"
This captures only the traffic from that IP range. It's ideal for cron jobs and automated monitoring.
From CEH v13 Courseware:
Module 8: Sniffing # Tshark and Wireshark Usage
Reference:Wireshark Docs - Tshark Capture Filters

Social engineering attacks that target business processes are especially effective when they mimic legitimate workflows. CEH learning materials emphasize that attackers often exploit trust relationships and organizational procedures rather than attempting broad or generic phishing methods. In the context of HR operations, onboarding portals are highly trusted and frequently accessed by new employees who expect to enter personal information, submit documents, and receive initial network credentials. By creating a fake onboarding portal that closely resembles the organization's internal system, an attacker can collect credentials without triggering suspicion because the action being requested appears normal and expected. This method leverages procedural familiarity, brand consistency, and the implied authority of HR communications, making it far more effective than generic phishing emails or unsolicited social media messages. Phone calls, while sometimes useful, involve real-time interaction and increase the chance of detection. The fake portal, however, seamlessly integrates into existing processes, making it the most effective and lowest-profile approach for acquiring network credentials.

According to CEH v13 Module 03: Scanning Networks, when using Nmap for service enumeration and fingerprinting, the flag to determine service version and type information is:
-sV - Version Detection Scan
nmap -sV <target IP> instructs Nmap to actively connect to open ports and probe the services running on those ports. This technique helps identify:
The service name (e.g., Apache, Nginx, etc.)
The version number (e.g., Apache 2.4.54)
The OS or device details (when possible)
This is especially useful when ports like 80 (HTTP) and 443 (HTTPS) are open, as it helps determine which web server is running (e.g., Apache, IIS, Nginx) and its version - which is critical for vulnerability assessment.
Why Other Options Are Incorrect:
A). -sv
# Incorrect syntax. Nmap flags are case-sensitive and this is a typo. Correct flag is -sV.
B). -Pn
Skips host discovery (ping scan). It does not provide service version info.
C). -V
Displays Nmap's version, not the service version on the target.
D). -ss
Incorrect spelling. You may have meant -sS (TCP SYN scan), which is for port scanning, not version detection.
Correct Option is A, assuming the intent is to write the correct syntax as -sV. However, strictly speaking, if this is a case-sensitive exam, and the listed option is -sv (lowercase 'v'), it would be invalid. But based on CEH exam context where minor casing issues are accepted if conceptually correct, A is the best answer.
Reference from CEH v13 Study Guide and Courseware:
Module 03 - Scanning Networks, Section: Nmap Scan Types and Options
EC-Council iLabs: Performing Version Detection Using nmap -sV
Nmap Official Docs (Referenced in CEH): https://nmap.org/book/man-version-detection.html
-h | findstr " -sV" -sV: Probe open ports to determine service/version info

Comprehensive and Detailed Explanation:
VCloud-based (also known as Cloud-based or Cloud-assisted) antivirus leverages cloud computing to:
* Offload detection and analysis to powerful remote servers
* Provide real-time updates and threat intelligence
* Aggregate data from multiple endpoints to improve detection
This method is efficient, especially for zero-day threats and large-scale protection.
From CEH v13 Courseware:
* Module 6: Malware Threats # Modern Antivirus Technologies
Reference:CEH v13 Study Guide - Cloud-Based Antivirus Detection