CEH v13 identifies URL parameters used in dynamic SQL queries as common injection points. When user- controlled values are passed directly into database queries without validation, attackers can manipulate query logic. Injecting a test payload such as 1 OR 1=1 into the userID parameter is a standard method to determine whether the application concatenates input into SQL statements. If the page displays all user orders instead of only the authenticated user's orders, this confirms SQL injection. CEH teaches that conditional tautologies are one of the safest and most reliable ways to probe SQL vulnerabilities, especially in GET parameters.
JavaScript injection (Option A) tests XSS, not SQLi. Directory traversal (Option C) targets filesystem issues, not database logic. Brute-forcing user credentials (Option D) does not test query sanitization. Therefore, modifying the userID parameter with a SQL injection payload is the correct CEH-aligned method.

The correct answer is B. BitLocker Drive Encryption because the requirements describe native Windows full- disk encryption that integrates tightly with enterprise Windows security features and centralized management.
BitLocker is Microsoft's built-in disk encryption technology designed to provide transparent encryption for the operating system volume and additional fixed/removable drives. It supports hardware-backed startup protection through integration with the Trusted Platform Module (TPM), which can help protect encryption keys and validate boot integrity before unlocking the OS volume. This matches the prompt's requirement for
"hardware-backed startup protection."
The scenario also emphasizes "centralized key escrow via Active Directory/management policies." In enterprise deployments, BitLocker recovery information can be backed up to Active Directory and managed through Group Policy / MDM controls, enabling standardized enforcement (encryption settings, recovery key handling, compliance reporting) across servers and endpoints. This is a core operational advantage in regulated environments like healthcare: it enables rapid response (recoverability), consistent policy application, and audit-friendly control of encryption keys-without requiring third-party key management tooling for basic escrow needs.
Additionally, the prompt calls for securing the "system partition and attached data volumes" in a way that is compatible with Windows platform behavior and minimizes disruption. BitLocker supports encrypting both the OS volume and data volumes, and it is designed for transparent operation once enabled, so normal server use and domain authentication continue as expected.
Why the other options are not correct: FileVault is Apple's full-disk encryption for macOS, not Windows.
VeraCrypt and Rohos Disk Encryption are third-party solutions that can provide disk encryption, but they do not match the stated preference for deep Windows enterprise integration with TPM-based startup protection and Active Directory-based recovery key escrow through standard Microsoft management policies.
Therefore, the best solution for this Windows enterprise requirement is BitLocker Drive Encryption.

The Certified Ethical Hacker (CEH) Malware Threats module explains that modern malware increasingly uses fileless techniques and living-off-the-land strategies, communicating over legitimate protocols like HTTP and DNS to evade detection.
Because this traffic blends with normal activity, port-based blocking and signature-based antivirus are often ineffective. CEH highlights behavioral analytics and network traffic analysis as the most reliable detection mechanisms for identifying anomalies such as:
Unusual outbound DNS queries
Abnormal HTTP beaconing patterns
Suspicious process behavior
Option C is correct because it focuses on detecting behavioral anomalies, which CEH identifies as essential for combating advanced malware and command-and-control (C2) channels.
Option D may disrupt business operations and does not address DNS-based C2.
Option A is outdated.
Option B cannot detect unknown or fileless malware.
CEH strongly recommends anomaly detection and behavioral monitoring for advanced threats.

Insufficient logging and monitoring is the most direct threat highlighted by the scenario. In CEH-aligned cloud security concepts, visibility is foundational: without adequate telemetry, security teams cannot detect, investigate, or respond to malicious activity in time. The question explicitly states attackers "remained undetected" because the organization lacked mechanisms to track function-level activity and capture anomalous events. In a serverless architecture, this visibility gap can be especially damaging because there are no traditional servers for defenders to log into, and many security signals must be collected from cloud-native sources such as function invocation logs, API gateway logs, identity events, and centralized monitoring pipelines.
While privilege escalation is a common cloud threat, the question's root cause is not described as excessive permissions or role abuse; it is the lack of detection capability. Loss of governance refers to weak policies, mismanaged accounts, and lack of control over cloud resources, which may contribute indirectly but is not the immediate failure described. Side-channel attacks are specialized and do not match the evidence of missed alerts and absent operational telemetry.
CEH guidance emphasizes implementing centralized logging, continuous monitoring, alerting, and anomaly detection as core controls. For serverless, this includes capturing detailed function execution logs, tracing, identity and access events, and integrating them into a SIEM/SOAR workflow. Effective monitoring enables rapid detection of abnormal invocation patterns, suspicious API calls, unusual data access, and persistence attempts-reducing dwell time and preventing small compromises from becoming major outages.

The correct answer is C. Deauthentication Attack.
A deauthentication attack is used to forcibly disconnect wireless clients that are actively associated with an access point. The referenced CEH wireless material describes a deauthentication attack as an attack used to forcefully disconnect users who are actively connected on the target access point, and identifies it as a type of denial-of-service attack .
The scenario states that crafted 802.11 management frames are sent toward the access point and that connected laptops immediately lose association and must reconnect. This behavior directly matches a deauthentication attack.
Option A. Eavesdropping Attack is incorrect because eavesdropping involves capturing or monitoring wireless traffic, not forcing clients to disconnect.
Option B. Jamming Attack is incorrect because jamming disrupts wireless communication by creating radio- frequency interference. The scenario describes crafted management frames, not RF interference.
Option D. Evil Twin Attack is incorrect because an Evil Twin attack involves creating a rogue access point that imitates a legitimate access point to lure users into connecting.
Therefore, the best answer is C. Deauthentication Attack.