Password cracking is a core component of the system hacking phase. CEH materials highlight that once password hashes are obtained, attackers often perform offline cracking to avoid detection and bypass account lockout policies. Tools like Hashcat make use of hardware acceleration-specifically, GPU or multi-core CPU computing-to significantly increase cracking throughput. Hardware acceleration allows the system to perform thousands to millions of hash calculations simultaneously, dramatically improving cracking efficiency compared to traditional CPU-bound methods. While dumping SAM contents is part of credential extraction, it is not the optimization described in the scenario. Dictionary rules influence cracking strategy but not raw speed. NetBIOS spoofing is unrelated to password cracking. The emphasis here is on maximizing computational power to accelerate the hash-cracking process, aligning directly with CEH's explanation of hardware-accelerated offline cracking techniques.

The described behavior aligns precisely with ARP spoofing, also known as ARP poisoning, a common man- in-the-middle attack technique covered extensively in CEH materials. ARP operates at Layer 2 of the OSI model and is responsible for mapping IP addresses to MAC addresses within a local network. Because ARP lacks authentication mechanisms, any host can send forged ARP replies to other devices on the LAN.
In this scenario, Marcus injects crafted messages that alter how two hosts identify each other. This strongly indicates forged ARP replies were sent to both the payroll workstation and the authentication server. By telling each system that his machine's MAC address corresponds to the other party's IP address, Marcus positions himself logically between the two endpoints. As a result, traffic is transparently routed through his system without requiring changes to switch configurations, proxies, or VPN tunnels.
This technique enables interception and potential modification of credentials in transit. DNS spoofing affects domain name resolution rather than direct Layer 2 host identification. MAC flooding overflows the switch CAM table to force broadcast behavior but does not specifically manipulate IP-to-MAC mappings between two targeted hosts. Switch port stealing targets MAC table entries but does not rely on altering host identity mappings in the same way ARP poisoning does.
Therefore, ARP spoofing is the most accurate technique described in this scenario.

The behavior described matches the countermeasure commonly referred to in CEH materials as escaping or encoding special characters, most notably the single quote character. SQL injection frequently relies on breaking out of a quoted string in the SQL statement using the single quote, then appending logical operators such as OR 1=1, comments, or additional clauses. When an application replaces special characters with escaped equivalents before the SQL statement is executed, it attempts to ensure the input is treated purely as data rather than executable SQL syntax. A classic example is transforming a single quote into an escaped form such as \' or doubling it to '' depending on the database and escaping rules. By doing so, the database parser interprets the quote as part of the literal string value, preventing the attacker from terminating the string and altering query logic.
Option B is therefore the best fit because it precisely describes encoding or escaping the single quote, which is the most commonly targeted delimiter in SQL injection payloads. Option A, user input validation, is broader and typically refers to allowlisting accepted characters and formats, but the question specifically emphasizes replacement with escaped equivalents rather than rejecting invalid input. Option D, parameterized queries or prepared statements, is the strongest modern control recommended in CEH guidance because it separates code from data at the API level, but it is different from character escaping and does not rely on rewriting input characters. Option C limits damage but does not prevent injection. The observed mechanism is clearly single- quote encoding.

The scenario describes a jailbreak that boots normally without requiring a computer, but after a reboot the device loses the jailbroken (elevated) state until the user runs an on-device app to re-enable jailbreak features.
That behavior matches semi-untethered jailbreaking.
In iOS jailbreaking terminology, the key differentiator is what happens after a restart and whether a computer is required to regain jailbroken functionality. With a semi-untethered jailbreak, the device can reboot on its own into a normal, usable iOS state (so it is not "bricked" or stuck at boot), but jailbreak features such as elevated privileges, unsigned code execution, and tweaks are not active immediately after reboot. To reapply the jailbreak, the user launches a jailbreak app installed on the device, which triggers the exploit chain again and re-enables the modified state until the next reboot. This aligns exactly with "temporarily lost after restart until the user launches a special on-device app." Why the other choices don't match:
Tethered jailbreaking (A) requires the device to be connected to a computer to boot; without tethering, the device cannot boot properly or remains unusable. The scenario explicitly says it can "boot normally without a computer," so it is not tethered.
Untethered jailbreaking (B) persists across reboots; the device remains jailbroken after restarting with no extra steps. That contradicts the described need to reapply modifications after restart.
Semi-tethered jailbreaking (D) is similar in that the device can boot without a computer, but typically the device boots into a non-jailbroken mode and may require a computer or additional steps to return to a jailbroken state depending on the method; the scenario specifically highlights re-enabling via an on-device app, which is the hallmark most commonly associated with semi-untethered jailbreaks.
Therefore, the jailbreaking method shown is C. Semi-untethered Jailbreaking.

CEH guidance for web server hardening prioritizes controls that reduce exploitable conditions across the broadest set of threats. While obscuring paths (for example, unusual directory names like "certrcx" or storing content under "/admin/web") may slightly slow down casual discovery, CEH emphasizes that security through obscurity is not a reliable control. If an attacker can identify the server root, document root, and virtual directory structure (through misconfigurations, directory listing, error leakage, backup exposure, or known-path enumeration), then the real risk becomes unpatched vulnerabilities in the web server, modules, libraries, and underlying OS.
Regularly updating and patching the server software is the most direct, high-impact countermeasure because it closes known vulnerabilities attackers routinely exploit (RCE, privilege escalation, auth bypass, path traversal, request smuggling, etc.). CEH materials also stress that virtual hosting expands the attack surface (multiple sites, shared services, shared misconfigurations), making systematic patching and configuration management even more important.
Option A (moving the document root to a different disk) may help with organization and, in some cases, recovery planning, but it does not inherently reduce vulnerabilities. Option C (changing IPs) is not a security control; it may complicate blocking lists but doesn't fix the underlying weakness. Option D (using LAMP) is an architectural choice, not a security measure by itself-an open-source stack can still be insecure if misconfigured or unpatched.
Therefore, CEH-aligned best practice is regular patching and updates.