CEH v13 explains that steganography-based exfiltration hides data within benign-looking files, making it extremely difficult to detect via firewalls or IPS alone. Blocking all outbound traffic is impractical, and IPS systems are not designed to analyze file content deeply for hidden data.
The most effective countermeasure is steganalysis, which involves inspecting files for statistical anomalies, altered pixel distributions, or hidden payload patterns. CEH v13 identifies steganalysis tools as the only reliable method to detect and decode hidden data.
Traffic monitoring (Option C) helps identify suspicious transfers but cannot confirm steganography.
Therefore, Option D is correct.

The scenario points directly to information gathering from the robots.txt file. A robots.txt file is typically located at the root of a website (e.g., https://example.com/robots.txt) and is intended to instruct search engine crawlers which paths should or should not be indexed. During web reconnaissance, testers often review robots.
txt because it can unintentionally disclose sensitive directories, administrative panels, staging paths, backup locations, or restricted areas that the organization hoped would remain obscure. The scenario explicitly says Sofia found "a crawler directive at the server's root" that "allows unintended indexing of restricted areas," and that this "reveals internal paths." That is exactly the kind of leakage that can come from misconfigured or overly revealing crawler directives.
This is considered an early-stage reconnaissance / information gathering technique because it does not require exploitation. It leverages publicly accessible configuration hints to map the application's hidden structure.
Even when robots.txt is used correctly, the listed disallowed entries can still serve as a roadmap of interesting targets; if configured incorrectly (for example, allowing indexing or exposing sensitive paths), it can increase exposure by helping those paths surface in search results or be discovered faster by attackers.
Why the other options are less accurate:
Vulnerability Scanning (A) implies using scanners to identify known flaws; here, the tester is manually
/strategically inspecting a crawler directive for exposed paths.
Web Server Footprinting/Banner Grabbing (C) focuses on identifying server type/version and technologies via headers or responses, not discovering hidden paths from crawler directives.
Directory Brute Forcing (D) uses wordlists to guess directories; Sofia's discovery comes from a disclosed list of paths, not brute-force guessing.
Therefore, the technique is B. Information Gathering from robots.txt File.

The described evasion relies on preventing the IDS from correctly reassembling packets, which points directly to packet fragmentation. In fragmentation-based evasion, the attacker breaks the probe payload into multiple IP fragments. Some IDS sensors-especially if misconfigured, overloaded, or using limited reassembly logic-may fail to fully reconstruct the original packet stream, causing the malicious or suspicious content to evade signature matching and detection. Meanwhile, the target host (or a downstream device) may correctly reassemble the fragments and process the probe normally. This mismatch between what the IDS "sees" and what the target ultimately receives is the core concept behind fragmentation evasion.
The scenario explicitly says "IDS devices are unable to reassemble the packets correctly," which is essentially the textbook rationale for fragmentation as an IDS evasion method. Attackers may vary fragment size, overlap fragments, or manipulate offsets to stress or confuse reassembly engines. Even when modern IDS systems support reassembly, fragmentation can still be used to reduce detection reliability if sensors are under resource pressure or if traffic normalization is not enforced.
Why the other options don't match:
Source routing (B) attempts to influence the path packets take through the network; it does not inherently prevent IDS reassembly.
Decoy scanning (C) floods the target/IDS with scans from multiple spoofed addresses to obscure the true scanner source. This is about attribution noise, not packet reassembly failure.
IP spoofing (D) for scanning can disguise origin, but it does not inherently cause IDS reassembly problems.
Therefore, Maria is applying A. Packet Fragmentation.

The issue described is verbose error messages, where an application reveals excessive technical details when handling invalid input. The scenario states that the platform returns "detailed system information, including database query strings and directory paths" instead of a generic error. Exposing internal paths and query strings is a common symptom of verbose error handling: stack traces, SQL statements, file system locations, framework versions, and configuration hints can appear in responses when exception handling is misconfigured or when debug settings are enabled in production.
These details are valuable to attackers because they reduce guesswork. Directory paths can reveal the operating system, deployment layout, and sensitive file locations; database query strings can reveal table
/column names and query structure, enabling more effective SQL injection payloads or targeted data extraction. Verbose errors can also leak usernames, internal hostnames, API endpoints, and even secrets if mishandled. Even if the initial invalid request does not compromise the system, the leaked information can significantly improve the attacker's ability to craft subsequent attacks with higher precision.
Why the other options are less accurate:
Improper error handling (A) is a broader category and could include verbose errors, but the question's best match is the specific symptom: detailed internal information disclosure.
Directory traversal (B) involves manipulating path input to access unauthorized files; here, the application is revealing paths due to errors, not being coerced into reading arbitrary files.
CORS misconfiguration (D) relates to cross-origin browser access controls and is unrelated to leaking stack traces or database queries.
Therefore, the correct answer is C. Verbose Error Messages.

CEH v13 explains that NTP (UDP port 123) can leak sensitive network information if misconfigured. When an NTP daemon allows unrestricted external queries (e.g., monlist or ntpq commands), attackers can enumerate internal IP addresses and hostnames.
This exposure is a known reconnaissance weakness and has been exploited in both information disclosure and amplification attacks. CEH v13 strongly recommends restricting NTP query access using access control lists.
DNS poisoning and honeypots do not explain legitimate NTP enumeration responses. Therefore, option D is correct.