CEH v13 identifies AI-powered malware as an emerging advanced threat that adapts its execution based on environmental cues and user behavior. Unlike traditional polymorphic malware, AI-driven malware can dynamically decide when and how to execute actions to avoid detection.
The described traits-behavioral adaptation, idle-time exfiltration, encrypted communication-are hallmarks of AI-assisted malware.
Polymorphic viruses change signatures but do not adapt behavior intelligently. Rootkits focus on hiding presence. Worms propagate aggressively.
Therefore, Option A is correct.

The correct answer is C. Whois lookup because the scenario describes retrieving publicly available domain registration records using an online service without directly interacting with the target organization's infrastructure. In CEH-aligned reconnaissance (footprinting) techniques, WHOIS is a foundational passive information-gathering method used to identify details tied to a domain name, such as the registrant
/organization, administrative and technical contacts, registration and expiration dates, and the authoritative name servers associated with the domain. These details are commonly used to establish ownership context, map the organization's external footprint, and identify potential points of contact for administrative or security coordination.
The prompt emphasizes that the ethical hacker wants "details about the organization's domain ownership" and
"points of contact." That is precisely the kind of information WHOIS is intended to provide. It also explicitly notes "without direct interaction with the target," which aligns with WHOIS being passive: queries are made to registries/registrars or WHOIS aggregation services rather than probing the target's servers.
Why the other options are less correct: Email footprinting focuses on collecting email addresses, formats, mail servers, and potentially related metadata, but it is not the primary method for domain ownership/registrant contact records. Network footprinting is broader and often involves identifying IP ranges, network blocks, technologies, and topology-potentially including active probing. DNS interrogation (such as querying A, MX, NS, TXT records) can reveal technical DNS data and infrastructure mapping, but it typically does not provide the domain's registrant ownership details and formal contact records; that role is handled by WHOIS and registry data.
Therefore, the method most likely used here is a WHOIS lookup to obtain public domain registration and contact information.

The correct answer is C. Confidentiality. In information security, the CIA triad consists of Confidentiality, Integrity, and Availability. Confidentiality specifically addresses the secrecy and privacy of information by ensuring that sensitive data is accessed, viewed, or disclosed only by authorized individuals, systems, or processes. CEH-aligned material explains that confidentiality means information is secret and should not be disclosed to unintended people or entities; if confidentiality is compromised, it can cause unauthorized access and privacy loss. Another CEH exam guide source states that confidentiality addresses the secrecy and privacy of information and prevents disclosure to unauthorized individuals or systems. Availability is incorrect because it ensures systems and data are accessible when needed. Integrity is incorrect because it protects data from unauthorized modification. Authentication is also incorrect because it verifies identity, but it does not itself define secrecy or privacy. Therefore, the best CEH answer is Confidentiality.

The IT team's action-capping how many requests a single user can make per second and then delaying or dropping aggressive connections-is the defining behavior of rate limiting. In DDoS conditions, especially when the portal is under a surge of automated or abusive traffic, rate limiting enforces a policy that restricts request frequency from a source (such as an IP address, session, API key, or user identifier). This helps preserve availability by preventing any one client (or a small set of clients) from consuming a disproportionate share of application and infrastructure resources.
The key wording in the scenario is that "aggressive connections are delayed or dropped while most legitimate customers continue to use the service." Rate limiting is designed for precisely this outcome: it introduces friction for abusive traffic patterns while allowing typical user behavior through. Depending on implementation, controls can respond with delays (throttling), temporary blocks, connection resets, or HTTP error responses (for example, "too many requests") when limits are exceeded. This is commonly applied at the edge (reverse proxy/CDN), load balancer, WAF, or application gateway to reduce pressure on backend services.
Why the other options are not the best match:
Shutting Down Services (B) is an extreme measure that sacrifices availability to stop an attack; the scenario explicitly states service largely continues.
Absorb the Attack (C) refers to scaling capacity or using scrubbing centers/CDNs to handle volume without necessarily restricting individual requester behavior; the described control is specifically per-user request caps.
Degrading Services (D) generally means intentionally reducing functionality or quality (e.g., disabling non- essential features) to keep core services alive; here, the main technique is enforcing request-rate thresholds.
Thus, the countermeasure strategy being used is A. Rate Limiting.

Directory Traversal, also called path traversal, is a web attack in which an attacker manipulates file path input so the server accesses files outside the intended web directory. In CEH guidance on web application attacks, this commonly happens when an application builds a file path from user-controlled input such as a URL parameter that indicates a filename, folder, language pack, template, or download resource. If the server does not properly validate and normalize the supplied path, an attacker can inject traversal sequences such as dot- dot-slash patterns or encoded equivalents to move up directories and retrieve sensitive files.
The scenario describes Ethan changing URL parameters and receiving "data from areas of the system that should be restricted," specifically "configuration files not intended for public access." That is the hallmark outcome of directory traversal: unauthorized read access to files like application configs, environment settings, keys, or server configuration that can later enable deeper compromise. This is not password cracking because no credential guessing or authentication attack is involved. It is not web cache poisoning, which targets shared caching infrastructure to serve poisoned content to other users. It is not HTTP response splitting, which relies on injecting CRLF characters to manipulate response headers and potentially cause caching or XSS side effects.
CEH-aligned remediation focuses on strict allowlisting of permitted file resources, canonicalizing paths before access, rejecting traversal tokens and their encoded forms, using indirect object references instead of raw file paths, and enforcing least-privilege permissions so sensitive configuration files are not web- accessible even if a validation mistake occurs.