The activity described is passive wireless packet capture in monitor mode-specifically collecting management frames (such as beacon frames and probe responses) and observing client/AP interactions (including authentication-related frames) while not injecting or transmitting anything. In the Aircrack-ng suite, the tool designed for exactly this reconnaissance-and-capture purpose is Airodump-ng.
Airodump-ng is the component that listens on the air interface once the card is placed into monitor mode, then captures 802.11 frames and displays useful reconnaissance data such as BSSID, channel, encryption type, signal strength, and associated clients (stations). Critically, it can write captured traffic to files (e.g., .cap) for offline analysis-which matches the scenario's "record into a capture file for later offline analysis." This is a common CEH workflow: reconnaissance # capture # analyze, keeping the initial step non-intrusive.
By contrast:
Aireplay-ng (A) is primarily used for active attacks / packet injection (e.g., deauthentication, replay) and would typically involve transmitting frames.
Aircrack-ng (B) is used mainly for key cracking (WEP/WPA/WPA2 handshakes) after capture, not for passive collection itself.
Airbase-ng (C) focuses on creating a rogue AP / MITM-style setups, which is also an active transmission role.
So, for silent monitoring + capturing beacons/probes/auth frames to a file, the best match is D. Airodump-ng.

In CEH-aligned cloud security discussions, protecting data across its lifecycle is a primary requirement, and a major risk area is how data moves between clients, applications, and cloud services. The scenario states the exposure occurred because there was no encryption during transmission between user devices and cloud storage. That maps directly to the Service and Data Integration risk area because it focuses on the security controls applied when cloud services exchange data with users and with other services, including secure communication channels, API protection, and proper cryptographic enforcement for data in transit.
When data is transmitted without TLS or with weak or misconfigured TLS, it becomes vulnerable to interception and manipulation through man in the middle attacks, traffic sniffing, SSL stripping, or downgrade attacks. In regulated environments such as healthcare, HIPAA expectations strongly align with implementing strong encryption in transit and ensuring secure session establishment, certificate validation, and modern cipher suites. This is not primarily a multi tenancy or physical security issue, which relates to isolation between tenants and the provider's datacenter controls. It is also not primarily an incident analysis and forensic support issue, which concerns detection, logging, evidence collection, and investigative capability after events occur. Infrastructure security is broader and can include network protections, but the question is specifically about preventing exposure during transmission, which is most precisely addressed by service and data integration controls.
Correct remediation typically includes enforcing HTTPS with modern TLS, enabling HSTS, disabling legacy protocols and weak ciphers, ensuring correct certificate management, using mutual TLS where appropriate, and securing cloud storage access through authenticated, encrypted endpoints and properly secured APIs.

The correct answer is C. Identify and evaluate current practices. In CEH-aligned security assessment concepts, a security audit/review is used to verify whether security policies and procedures are in place and being followed. If documented policies do not exist, the ethical hacker or auditor should not stop the audit or create policies during testing, because policy creation is a management/governance responsibility, not an assessor's role. Instead, the assessor should identify the organization's current practices, actual controls, informal procedures, and operational behavior, then evaluate them against accepted standards, baselines, legal requirements, and security best practices. CEH material also emphasizes that information security policies are a fundamental component of the security infrastructure and define requirements, rules, and controls for protecting organizational resources. The absence of policies should be documented as a finding, but the review can still continue by assessing what is currently being done in practice. Increasing testing does not address the governance gap. Thus, the best course is to identify and evaluate current practices.

Operational Technology and ICS environments often suffer from misconfigurations such as unchanged factory-default passwords. CEH identifies exploiting default credentials as a direct and effective method because ICS devices frequently lack strong authentication controls. Using these built-in credentials grants immediate unauthorized access to supervisory controls, enabling adversaries to manipulate configurations, disrupt processes, or escalate attacks across critical systems.

The correct answer is A. Sending special characters to detect SQL modification behavior.
The scenario describes a black-box SQL injection discovery technique. The tester does not see the application source code or database query, so she submits SQL-significant characters and observes how the application responds. CEH-aligned SQL injection material explains that SQL injection involves injecting malicious SQL into existing queries and that vulnerability detection can involve injecting code into input fields and observing application responses or errors .
The important clue is that the application shows irregular behavior even without detailed error messages. That indicates the input may be modifying the backend SQL statement.
Option B is incorrect because truncation testing checks whether long or unexpected values are cut off, not whether SQL logic is affected.
Option C is too specific to identifier or database syntax handling and does not best match the general SQL injection probe described.
Option D is related, but it is narrower than the actual technique. The broader and more accurate black-box technique is sending special SQL-significant characters and observing behavior.
Therefore, the best answer is A. Sending special characters to detect SQL modification behavior.