According to the CEH Vulnerability Assessment and Incident Response modules, vulnerabilities with high CVSS scores and potential RCE must be treated as active threats.
CEH best practices recommend:
* Immediate containment (network isolation)
* Investigation and impact analysis
* Patch application
* Recovery
Option D follows the CEH incident response lifecycle precisely.
Option C is incomplete without containment.
Options A and B are unsafe.
CEH emphasizes containment before remediation.

The ntpq utility provides detailed NTP peer information, synchronization states, offsets, delays, and strata.
CEH specifically lists ntpq as the tool for querying NTP daemon status and enumerating peer relationships, making it essential for reconnaissance and lateral movement mapping.

A bootkit is the rootkit type that best matches the described behavior because it compromises the system boot process and executes before the operating system fully loads, often before many security controls, drivers, and monitoring services start. CEH materials describe bootkits as a highly persistent class of malware that targets components such as the Master Boot Record, Volume Boot Record, or bootloader. By gaining execution at boot time, a bootkit can load malicious code very early, then hook or tamper with OS loading routines, kernel initialization, or security mechanisms. This early execution is exactly what the scenario emphasizes: the payload runs "before any system-level drivers or services are active," enabling covert control while evading traditional user-mode detection.
This also explains why administrators see suspicious network activity but forensics do not easily find malicious user-level artifacts. Bootkits can hide by manipulating what the OS and security tools can see after startup, including concealing files, processes, registry keys, or even redirecting reads so scanners receive
"clean" data. Because the malicious component is anchored in the boot chain, it can survive reboots and remain present even if many OS-level indicators are cleaned.
A kernel-mode rootkit operates within the OS kernel but typically loads after the OS begins booting and drivers initialize. A hypervisor rootkit relies on virtualization to sit beneath the OS at runtime, but the scenario specifically highlights boot-time execution prior to drivers and services. Firmware rootkits persist in BIOS
/UEFI or device firmware, which is possible, but the most direct match to "boot process compromise below the OS" in CEH terminology is a bootkit.

White Hat Hacking is defined in CEH v13 as ethical hacking performed with explicit authorization to identify and remediate vulnerabilities. White hat hackers operate within legal frameworks and contractual agreements.
Grey hats act without permission but without malicious intent. Black hats conduct illegal attacks. Blue hats are external testers invited to find bugs before product release.
Thus, Option C is correct.

The correct answer is A because allowing execution from /tmp creates a direct risk that an attacker can place and run malicious binaries, scripts, droppers, or payloads from a temporary directory. In Linux, /tmp is commonly used for temporary files, and if execution is permitted, it becomes an attractive staging location after compromise. CEH malware concepts define malware as malicious software designed to gain access to target machines, steal information, harm systems, or give control to an attacker. CEH system-hacking concepts also describe malicious application execution after access, including installing malware, setting up backdoors, password crackers, and keyloggers. This risk is not SQL injection or XSS, because those are web application input attacks. It is also not primarily DoS, although malware could later cause denial of service.
The immediate and best answer is malware execution because executable temporary directories let attackers run hostile code from a writable location.