CEH materials explain that modern web applications deploy multiple layers of security-HTTPS, secure cookies, HttpOnly flags, and strict session regeneration-to defend against standard hijacking methods such as token theft through XSS or fixation. When these protections are properly implemented, attackers must compromise the underlying trust relationship between the client and server to successfully intercept or manipulate session tokens. One of the most advanced techniques described in CEH is compromising a trusted certificate authority or injecting a forged certificate into the victim's trust store. This enables the attacker to perform a transparent MITM attack despite HTTPS protections. Because the victim's browser trusts the forged certificate, encrypted traffic-including session tokens-is exposed to the attacker without generating browser warnings or IDS alerts. Timing side-channel attacks are not considered session hijacking methods; XSS is mitigated by secure flags; and session fixation is ineffective when session regeneration occurs.
Therefore, compromising a trusted certificate authority to enable an undetectable MITM attack is the most viable method.

The correct answer is B because massive outbound HTTPS traffic is a strong indicator of data exfiltration, especially when it is designed to blend into normal web traffic. In CEH attack lifecycle concepts, exfiltration occurs after an attacker gains access and can quietly extract protected resources or sensitive data from the environment. The retrieved CEH-aligned material describes exfiltration as the phase where an attacker with elevated access can "quietly extract data," and notes that exfiltration can occur silently. HTTPS is commonly allowed outbound in enterprise networks, so attackers may use it as a covert or low-noise channel to move stolen files, credentials, database dumps, or archives to an external server. The guide material also notes that malware often uses SSL over port 443 or other easy- to-hide mechanisms rather than obvious suspicious ports. DoS usually creates service disruption, scanning generates probing patterns, and reconnaissance focuses on information gathering. Massive hidden outbound HTTPS most likely indicates data exfiltration.

This scenario describes fileless malware using covert command-and-control (C2) channels over commonly allowed protocols such as HTTP and DNS, a technique heavily emphasized in CEH v13 Malware Threats.
Such malware avoids writing files to disk and instead leverages memory, legitimate system tools, and trusted protocols to evade traditional defenses.
Signature-based antivirus updates (Option A) are ineffective against fileless malware because there are no static artifacts to match. Blocking known malware ports (Option C) is also ineffective, as the malware intentionally uses ports 80 and 53, which must remain open for normal business operations. Restricting plain HTTP (Option B) may reduce visibility but does not stop DNS tunneling or encrypted malicious traffic.
CEH v13 identifies behavioral analytics as the most effective countermeasure against advanced malware.
Behavioral solutions establish a baseline of normal system and network activity, then detect anomalies such as:
Unusual outbound DNS query patterns
Abnormal HTTP beaconing intervals
Legitimate applications behaving suspiciously
PowerShell or system tools generating network traffic unexpectedly
By monitoring how systems behave rather than what files exist, behavioral analytics can identify stealthy C2 communications and disrupt them early. Therefore, Option D is the most effective and CEH-aligned response.

The correct answer is D, ciphertext-only attack, because the attackers possess only encrypted data and have neither the encryption key nor any confirmed samples of the original plaintext. In CEH-aligned cryptography concepts, cryptanalytic attacks are categorized by what information and capabilities the attacker has. A ciphertext-only attack is the most constrained model: the attacker attempts to infer the plaintext or key by analyzing ciphertext alone, often leveraging statistical properties, repetitions, formatting assumptions, and structural patterns that may leak information when encryption is misused.
The scenario highlights that the attacker "examines encrypted outputs in bulk" to detect "structural or statistical patterns." That wording maps directly to ciphertext-only analysis: looking for patterns caused by weak modes of operation, poor IV/nonce handling, deterministic encryption, repeated blocks (common in ECB mode), predictable headers, or consistent record templates. With block ciphers, large datasets increase the chance that repeated plaintext blocks produce repeated ciphertext blocks if the system uses an unsafe mode or reuses IVs, allowing an attacker to correlate records, identify fields, or sometimes recover content when combined with protocol or file-format knowledge.
The other options require more attacker capability than the prompt provides. Known-plaintext attacks require some plaintext-ciphertext pairs. Chosen-plaintext attacks require the ability to encrypt attacker-chosen inputs.
Chosen-ciphertext attacks require a decryption oracle or the ability to submit ciphertext for decryption. Since none of those are present here, Emma should evaluate ciphertext-only exposure and specifically validate the cipher mode, IV/nonce uniqueness, padding behavior, and whether encryption is semantically secure for stored patient records.
yes do please

The CEH Malware and Rootkit Analysis module emphasizes that kernel-level rootkits compromise the most trusted components of the operating system. Once a kernel is compromised, no tool running on that system can be fully trusted.
CEH explicitly states that the only reliable remediation for kernel-mode rootkits is:
Full system wipe
Reinstallation from a known, trusted source
Restoration of verified clean data
Option C is correct and represents CEH best practice.
Option A may work for user-mode rootkits but is unreliable for kernel-level infections.
Option B is a research tactic, not remediation.
Option D is containment, not eradication.