Asymmetric encryption, as defined in CEH v13 Cryptography, uses a public-private key pair, solving the key distribution problem inherent in symmetric encryption.
Public keys can be freely shared, enabling secure communication initiation without prior shared secrets. Disk encryption and hashes do not address key exchange.
Therefore, Option D is correct.

The correct answer is B because an attack that abuses the intended workflow, rules, or assumptions of an application is classified as a logic flaw or business logic flaw. In web application hacking, business logic defines how the application should behave, such as pricing rules, transaction sequencing, authorization decisions, coupon use, fund transfer limits, or approval workflows. A business logic flaw occurs when those rules are incomplete, poorly enforced, or can be manipulated by an attacker. The CEH web application material explains that business logic flaws exist when the application's core rules are not foolproof and can be exploited to compromise the application; these flaws often require careful review of architecture and design because automated scanners may not detect them reliably. XSS abuses improper output/input handling to run scripts in a browser. CSRF abuses a user's authenticated session. SQLi abuses database query construction.
The option that directly matches abusing business logic is Logic flaw.

The correct answer is B, Residual risk. In CEH risk-management terminology, residual risk is the amount of risk that remains after security controls, safeguards, countermeasures, or mitigation strategies have been applied. A penetration test identifies vulnerabilities, threats, and weaknesses that may expose an organization to risk. After the tester recommends controls such as patching, access control improvements, network segmentation, monitoring, hardening, or user awareness training, those controls reduce the likelihood or impact of exploitation. However, security controls rarely remove all risk completely. The remaining exposure is known as residual risk, and management must decide whether to accept, transfer, avoid, or further mitigate it. Inherent risk is the original level of risk before any controls are applied. Gap analysis is a comparison between the current security state and the desired or required state. Total risk usually refers to the overall risk before accounting for implemented safeguards. Therefore, the best term for risk remaining after controls is residual risk.

The objective is to conduct passive reconnaissance for potentially exposed administrative documents on .
onion sites, using advanced search operators. The query should therefore (1) restrict results to the hidden- network domain space, (2) focus on document formats likely to contain internal material, and (3) use a title
/header hint that aligns with management or administration content.
Option C is the best match because it combines:
site:onion to constrain results to .onion resources (the target environment of concern), filetype:pdf to focus on a common format for internal documents (policies, reports, procedures, administrative exports), and intitle: " admin access " to search for pages/files whose title/header metadata indicates administrative relevance. Using intitle aligns with the requirement to look for files "with headers suggesting management- related content," because titles are a practical proxy for document headers and indexing metadata.
By comparison, A does not include site:onion, so it is not scoped to hidden services, and it targets
"credentials" rather than administrative documents. B includes site:onion and filetype:pdf, but the title focus is "secure login," which is more likely to find authentication pages or generic security guidance rather than administrative document exposure. D is also plausible (docx + user accounts), but "user accounts" tends to point to account lists or HR-style docs rather than broader administrative access documentation, and PDFs are frequently used for formal administrative documentation and may be more commonly indexed.
Thus, C best satisfies the passive, targeted reconnaissance requirement for admin-related documents on .onion sites.

The correct answer is A. Key Reinstallation Attack (KRACK).
The scenario describes retransmitting a captured WPA2 handshake message so that the client reinstalls an already negotiated key. This is the defining behavior of KRACK, or Key Reinstallation Attack.
CEH wireless material explains that KRACK is a replay-style attack against WPA2 that abuses the four-way handshake. By repeatedly replaying the third handshake message, an attacker can cause the victim to reinstall the same encryption key, which can result in reuse of cryptographic values and weakening of traffic protection .
Option B. Replay Attack is too general. KRACK uses replay behavior, but the specific wireless technique is key reinstallation.
Option C. Man-in-the-Middle Attack is also too broad because the core weakness is not merely interception but forced key reinstallation.
Option D. WPA2 PSK Offline Cracking is incorrect because the scenario does not describe capturing a handshake and cracking the pre-shared key offline.
Therefore, the best answer is A. Key Reinstallation Attack (KRACK).