Comprehensive and Detailed Explanation From CEH v13 Guide Topics:
The correct answer is A. HTTP cookies often store session identifiers or authentication-related tokens after a user logs in to a website. If these cookies remain on the system after the browser closes, an attacker with access to the device, malware, or stolen browser data may reuse those cookies to impersonate the authenticated user. This is commonly associated with session hijacking, cookie theft, or unauthorized reuse of trusted browser sessions.
Automatically deleting cookies when the browser terminates reduces the chance that an attacker can recover valid session cookies later. Option B relates more to privacy tracking and browsing history analysis, not the main authentication risk. Option C refers to SQL database compromise, which cookie deletion does not directly prevent. Option D refers to locally stored passwords, which are separate from HTTP cookies.
Therefore, the policy is primarily intended to mitigate unauthorized access to trusted websites through stolen authentication/session data.

The correct answer is A because AXFR is the DNS operation used for a full zone transfer. In DNS, a zone transfer copies DNS zone data from one DNS server to another, usually from a primary authoritative server to a secondary server for replication and redundancy. CEH DNS enumeration topics emphasize that zone transfers are valuable during reconnaissance because they can reveal DNS records, hostnames, mail servers, name servers, IP addresses, and other infrastructure details. The referenced CEH material identifies zone transfer as a DNS transfer where all SOA records are transmitted to the requester and states that the full zone transfer option uses opcode AXFR, while incremental transfer uses IXFR. It also shows the practical command pattern dig < domain.com > axfr for requesting a zone transfer. AXFR is not encryption, DNS tunneling, or normal DNS resolution; it specifically allows full DNS zone transfer.

In CEH v13 Mobile, IoT, and OT Hacking, Bluetooth Low Energy (BLE) attacks often involve capturing pairing exchanges. If the Long-Term Key (LTK) is not captured, decryption is not immediately possible.
CEH v13 explains that in such cases, attackers may attempt Btlejacking, which hijacks an existing BLE connection rather than decrypting it. This allows command injection and data manipulation without needing the LTK.
Options A and B are incorrect because decryption is not the only attack path. hcitool is for discovery, not exploitation. Therefore, Option D is correct.

The correct answer is C. Sherlock.
Sherlock is used to search for a username across many social networking and online platforms. Its primary purpose is cross-platform username correlation. It does not natively provide geolocation tracking like Creepy, and it does not provide relationship-graph visualization like Maltego.
CEH-aligned reconnaissance material describes Maltego as a tool that gathers information from different sources and represents relationships through graph-based analysis . Another reference explains that OSINT username-correlation tools can verify whether a username or profile exists across hundreds of platforms .
Sherlock matches that username-correlation function.
Option A. Maltego is incorrect because Maltego is used for relationship graphing and visual investigation.
Option B. Creepy is incorrect because Creepy is associated with geolocation intelligence from social media and image metadata.
Option D. Social Searcher is incorrect because it is mainly used for searching and monitoring social media content, not broad username enumeration across hundreds of sites.
Option C. Sherlock is correct because it specializes in checking whether a username exists across many online platforms.
Therefore, the best answer is C. Sherlock.

CEH v13 explains that NTP (UDP port 123) can leak sensitive network information if misconfigured. When an NTP daemon allows unrestricted external queries (e.g., monlist or ntpq commands), attackers can enumerate internal IP addresses and hostnames.
This exposure is a known reconnaissance weakness and has been exploited in both information disclosure and amplification attacks. CEH v13 strongly recommends restricting NTP query access using access control lists.
DNS poisoning and honeypots do not explain legitimate NTP enumeration responses. Therefore, option D is correct.