Jordan is in the vulnerability scanning step because he has already moved past identification/cataloging (information gathering) and is now actively testing IoT devices for weaknesses such as outdated firmware, default credentials, and exposed/open service ports. In IoT hacking methodology, information gathering focuses on discovering devices, mapping the environment, identifying device types, interfaces, protocols, and versions, and understanding how data flows between endpoints, gateways, mobile apps, and cloud services.
Once that baseline inventory exists, the next step is to assess the devices and their ecosystem components for known and observable security gaps.
The specific checks described are classic vulnerability scanning targets in IoT environments:
Outdated firmware can indicate known vulnerabilities, missing security fixes, and unpatched components.
Default passwords are a common IoT weakness and can enable trivial compromise when not changed.
Open service ports reveal exposed management interfaces or unnecessary services that can be enumerated or exploited.
Running "specialized tools" to systematically evaluate these elements is consistent with vulnerability scanning because it is structured assessment aimed at finding exploitable conditions, but it stops short of actually exploiting or establishing persistence.
Why the other options do not fit:
Information gathering (C) would focus on identifying devices and collecting details, not actively checking them for outdated firmware/default passwords/open ports as vulnerabilities.
Gain remote access (B) implies exploitation or obtaining unauthorized control/access, which the scenario does not indicate-he is checking and assessing.
Launch attacks (D) implies executing exploitation, disruption, or compromise steps. The question explicitly frames this as testing for weaknesses, not carrying out attacks.
Therefore, Jordan is performing A. Vulnerability scanning.

The correct answer is Checks for outdated versions of over 1,250 servers. In CEH vulnerability assessment coverage, Nessus Essentials is presented as a vulnerability scanning solution that can assess a wide variety of technologies, including operating systems, web servers, databases, network devices, and virtualized environments. Its core role is identifying weaknesses, missing patches, insecure configurations, and exposure conditions across supported platforms. The option about checking outdated versions across a very broad range of server technologies best reflects that scanner-oriented capability. Patch management is not the primary function of Nessus Essentials, because it identifies vulnerabilities rather than directly managing patch deployment. Agent-based detection may be used in some security products, but that is not the defining capability highlighted in this CEH-style framing. High-speed asset discovery is a feature associated more strongly with specialized discovery platforms, whereas Nessus is centered on vulnerability enumeration and assessment. CEH study material emphasizes understanding the purpose of common security tools, and Nessus is generally classified as a scanner that detects outdated software versions and known vulnerabilities so remediation can be prioritized across the environment. That is why option B is the most accurate fit.

The correct answer is B. NTP Enumeration because the indicators and the data obtained match enumeration of the Network Time Protocol (NTP) service, which commonly runs on UDP port 123. In CEH-aligned reconnaissance and enumeration concepts, attackers often enumerate exposed services to learn configuration and internal details that can assist with follow-on attacks. When NTP is reachable from untrusted networks and is misconfigured (or supports certain query modes), it can leak information about the time server's peers, synchronization status, and operational metrics such as offset and delay-exactly the attributes described in the scenario.
The prompt also notes that Joe can gather internal hostnames and client IP addresses connected to the time server. This aligns with how NTP can reveal associated systems and relationships: time servers often have multiple internal clients, upstream peers, or configured associations. Queries that expose peer/association information can unintentionally disclose internal naming conventions, IP address ranges, and network structure-valuable intelligence for an attacker conducting mapping and target selection. In addition, time infrastructure is frequently centralized, so enumerating it can provide a hub-like view of the environment.
Why the other options are incorrect: DNS zone transfer enumeration is associated with DNS AXFR and typically yields DNS records such as subdomains and MX/CNAME entries-not NTP peers/offsets/delays and not UDP 123. VoIP enumeration targets telephony protocols and services (e.g., SIP) on different ports and would not center on time synchronization metrics. NetBIOS enumeration involves ports 137-139 and returns NetBIOS name and session information, not NTP operational data.
Therefore, the technique used to obtain peer, offset, delay, and connected client details from a UDP/123 time server is NTP enumeration.

CEH materials describe RDDoS (Ransom DDoS) attacks as threat-driven extortion campaigns where attackers demand payment and demonstrate capability by launching a short-lived DDoS burst. The purpose is to intimidate the victim into paying before a larger, sustained attack begins. The attack described uses HTTP floods with incomplete POST requests-an application-layer DDoS technique that consumes server resources by forcing the target to hold open connections. This kind of demonstration followed by an extortion email aligns precisely with RDDoS behavior. DRDoS attacks involve reflection/amplification through third-party servers, which is not occurring here. Pulse wave attacks use timed bursts and do not involve extortion, while recursive GET floods do not match the incomplete POST behavior. Therefore, the correct classification is RDDoS.

The behavior described-manipulating request parameters so the application retrieves and exposes files from the server's local directories-is characteristic of Local File Inclusion (LFI). LFI occurs when an application uses user-controllable input to construct a file path (often for templates, language files, includes, or uploads) and fails to properly validate or constrain it. An attacker can then supply values such as relative path traversal sequences to force the application to access unintended local resources, leading to disclosure of sensitive files (configuration files, credentials, keys, environment files) and sometimes further impact depending on context.
In the scenario, Sophia is testing a "template upload feature," then "modifying the input parameters in an upload request" to "trick the application into retrieving sensitive files from the server's local directories," allowing her to view internal configuration files. That is a textbook LFI outcome: unauthorized read access to local files through a web interface, caused by improper input validation and insecure file path handling.
Why the other options are less accurate:
Insecure deserialization (A) involves unsafe processing of serialized objects, often leading to remote code execution; it is not about retrieving local files via path manipulation.
Cookie poisoning (B) is tampering with cookie values to escalate privileges or alter application behavior; it does not inherently explain local file retrieval.
File injection (C) is a broader term and can refer to multiple file-related abuses, but the specific pattern of including or reading local files via parameters is most precisely labeled Local File Inclusion.
Therefore, the correct answer is D. Local File Inclusion.