According to the Certified Ethical Hacker (CEH) System Hacking and Session Hijacking module, sidejacking is a form of session hijacking where an attacker passively intercepts network traffic to capture unencrypted session cookies. These cookies are then reused to impersonate the authenticated user without needing credentials.
CEH documentation explains that sidejacking commonly occurs on unencrypted HTTP connections, public Wi-Fi networks, or improperly secured internal networks. Once the session cookie is stolen, the attacker can replay it to gain access to the victim's active session.
Option B correctly describes this mechanism and directly matches CEH's definition of sidejacking.
Option A refers to perimeter exploitation, not session hijacking.
Option C describes social engineering, which is unrelated to sidejacking.
Option D is an example of cross-site scripting (XSS), not sidejacking.
CEH emphasizes HTTPS enforcement and secure cookie attributes as key countermeasures.

The correct answer is D. Set Passwords for Apps to Restrict Others from Accessing Them.
The device already has an operating system passcode, but the weakness appears after the phone is unlocked.
The financial application opens directly to sensitive dashboards without requiring any additional application- level authentication. The most direct mitigation is to require a separate password, PIN, biometric prompt, or reauthentication control for sensitive corporate applications.
CEH mobile/BYOD material explains that BYOD introduces security and control challenges because personally owned smartphones and tablets access organizational resources. Mobile Device Management solutions commonly enforce policies such as passcodes, remote locking, remote wipe, root/jailbreak detection, application deployment, monitoring, and policy enforcement .
Option A. Use Encryption Mechanism to Store Data is important for protecting data at rest, especially if the device is lost, but it does not stop access after the phone is already unlocked.
Option B. Set a Strong Passcode on the Device and Change It Relatively Often is already partially implemented because the OS requires a passcode. The issue is lack of app-level verification.
Option C. Maintain a Clear Separation between Business and Personal Data is useful for BYOD governance, but it does not directly prevent an unlocked device from opening sensitive dashboards.
Option D. Set Passwords for Apps to Restrict Others from Accessing Them is correct because it directly mitigates unauthorized access to corporate apps after device unlock.
Therefore, the best answer is D. Set Passwords for Apps to Restrict Others from Accessing Them.

Insecure Deserialization is the best match because the scenario explicitly describes user-supplied data being processed during object reconstruction. In CEH-aligned web application security concepts, deserialization is the process of taking serialized data, such as JSON, XML, YAML, or binary objects, and converting it back into in-memory objects the application can use. When an application accepts serialized objects from an untrusted source and reconstructs them without strong validation, integrity checks, and safe type constraints, an attacker can tamper with the serialized content to alter object fields, inject unexpected object types, or trigger unsafe behaviors during reconstruction.
The key clue is that Sophia uploads a crafted template file and gains administrative access and access to restricted dashboards. That outcome commonly occurs when a deserialized object contains role, permission, or account attributes that the server trusts, or when deserialization triggers privileged logic through gadget chains or unsafe callbacks. The prompt also rules out database queries, client-side code execution, and session manipulation, which eliminates common alternatives like SQL injection, XSS, and session hijacking. Local file inclusion would involve forcing the server to include local files using path manipulation, which is not described here. Verbose error messages can leak information but do not directly grant admin access.
Mitigations emphasized in ethical hacking guidance include never deserializing untrusted data when avoidable, enforcing strict allowlists of types, applying cryptographic signing or HMAC integrity validation to serialized data, using safer data formats with explicit schemas, regenerating authorization decisions server- side rather than trusting client-provided object attributes, and logging and blocking anomalous deserialization attempts.

According to the CEH System Hacking and Web Application Security modules, Man-in-the-Browser (MitB) attacks are among the most sophisticated and difficult session-hijacking techniques to detect. In MitB attacks, malware operates inside the victim's browser, allowing attackers to intercept, modify, or inject transactions after authentication has occurred.
CEH documentation highlights that MitB attacks bypass:
Multi-factor authentication
Encrypted cookies
HTTPS/TLS protections
Because the malicious activity occurs at the browser level, security controls perceive transactions as legitimate.
Option B is correct.
Option A (XSS) is detectable via content security policies.
Option C is mitigated by regenerating session IDs.
Option D is ineffective against encrypted sessions.
CEH emphasizes MitB attacks as a critical threat to online banking systems.

The observed behavior most closely matches the Digital Signature Algorithm (DSA). The strongest indicators are: (1) a fresh random value is generated for each signature operation, and (2) the math operates in a subgroup defined by public domain parameters using modular arithmetic, and (3) signatures are verified using a public verification key, not by "decrypting" the message.
DSA is a signature-only asymmetric algorithm derived from discrete logarithm principles. It uses public domain parameters commonly represented as (p, q, g), where p is a large prime, q is a prime divisor of p#1, and g is a generator of a subgroup of order q. For each signature, DSA requires a unique per-message secret random number k. This ephemeral k is crucial: reusing it (or generating it predictably) can expose the private key. The scenario's emphasis on "fresh random value for each signature operation" aligns directly with this core DSA requirement.
By contrast, RSA signatures can be implemented in different ways (often involving modular exponentiation with padding) and do not inherently require a fresh random per-signature secret like DSA's k (although some padding schemes may involve randomness). Diffie-Hellman is primarily a key exchange algorithm, not a signing algorithm. ElGamal can be used for signatures and also uses randomness, but the mention of
"subgroup defined by public domain parameters" and the classic per-signature random value requirement most strongly aligns with the standard description of DSA used in many security curricula and assessments.
Therefore, based on the signature process characteristics described, the best match is A. DSA.