The correct answer is A. Risk management framework. The question describes an enterprise-level risk management approach used by management and other personnel to identify events that may affect business objectives, manage risks and opportunities, and provide reasonable assurance that objectives will be achieved.
In CEH-aligned information security concepts, risk management focuses on identifying organizational assets, threats to those assets, and vulnerabilities, then selecting countermeasures to reduce risk and improve the organization's security posture. EC-Council risk management phases include Risk Identification, Risk Assessment, Risk Treatment, Risk Tracking, and Risk Review. Qualitative risk assessment is only one method of assessing risk using descriptive ratings such as low, medium, and high; it is not the full enterprise framework. PCI-DSS applies specifically to payment card data security, and NIST SP 800-37 is a specific federal information-system risk management publication. Therefore, the best general CEH answer is Risk management framework.

CEH v13 explains that WPA2-PSK security relies on the strength of the pre-shared key. Once the 4-way handshake is captured, the attacker must attempt offline cracking. CEH emphasizes that the dictionary attack is the most efficient and commonly used cracking method because it tests structured wordlists, human-derived passwords, and hybrid permutations, dramatically reducing time compared to full brute force. Brute forcing (Option B) is computationally heavy and often impractical unless the password is extremely short. XSS (Option A) and SQL injection (Option D) have no relevance to WPA2 authentication, which occurs at the wireless protocol level, not the router's web interface. The dictionary attack is highlighted in CEH as the principal technique used with tools like aircrack-ng, hashcat, and pyrit, allowing rapid key testing using optimized GPU or CPU cracking. Thus, Option C is the most effective and CEH-aligned method.

The defense described-keeping user inputs separate from the SQL statement and binding them as fixed values before execution-is the defining characteristic of parameterized queries (prepared statements). This is one of the most effective and widely recommended countermeasures against SQL injection because it prevents attacker input from being interpreted as SQL code.
In a vulnerable application, developers often build SQL statements by concatenating strings, such as " SELECT ... WHERE user= ' " + input + " ' " . In that pattern, malicious payloads can alter the query structure (adding conditions, UNIONs, comments, or stacked queries). With prepared statements, the SQL engine receives the query structure first (the template), and then receives the parameter values separately. The database treats the parameters strictly as data, not executable SQL. As a result, even if an attacker submits quotes, keywords, or operators, those characters remain part of the parameter value and cannot change the query's logic.
The scenario specifically says inputs are "bound as fixed values," which is direct language associated with parameter binding. That makes option D the best answer.
Why the other options are less accurate:
User input validation (A) is helpful but can be bypassed and is not as robust as parameterization; also the described mechanism is not validation but binding separation.
Restrict database access (B) is a defense-in-depth measure (least privilege) that reduces impact, but it does not inherently stop injection from occurring.
Encoding the single quote (C) is a legacy/insufficient approach; encoding or escaping can be error-prone and DBMS-specific, and it does not match the description of parameters being bound separately.
Therefore, the application is using D. Use parameterized queries or prepared statements.

The correct answer is B because scheduled tasks are commonly abused for persistence. In system hacking and post-exploitation phases, persistence means maintaining access to a compromised system even after reboot, logoff, or temporary session loss. Attackers may abuse Windows Task Scheduler or Linux cron jobs to automatically run malware, scripts, callbacks, or backdoors at specific intervals, during startup, or when a user logs in. The retrieved guide material shows scheduled-task usage for recurring execution and also references persistence-focused modules such as post/windows/manage/persistence, which aligns with the CEH concept of maintaining access after compromise. Reconnaissance is information gathering before attack, sniffing captures network traffic, and DoS attempts to disrupt availability. Those do not specifically describe abusing scheduled tasks. Defensively, administrators should audit scheduled jobs, monitor task creation events, restrict task-creation privileges, and investigate unknown startup or recurring tasks.