According to the CEH Sniffing and Network Protocol Attacks module, covert channels represent one of the most sophisticated and difficult-to-detect data interception techniques. These channels hide malicious communication within legitimate protocol behavior, making them extremely challenging for traditional IDS
/IPS and packet inspection tools to identify.
Industrial and legacy protocols such as Modbus, widely used in OT and legacy enterprise environments, lack encryption and authentication by design. CEH documentation highlights that attackers can manipulate unused or poorly validated Modbus fields to covertly transmit or intercept data while appearing as normal control traffic.
Option D is correct because covert channels over trusted legacy protocols blend seamlessly with legitimate traffic and bypass many security controls.
Option A is not a sniffing technique but a data-hiding method.
Option B describes exploitation, not sniffing.
Option C is a theoretical evasion method but is more detectable through reassembly.
CEH emphasizes covert channels as one of the most formidable sniffing challenges.

The scenario describes an authentication endpoint that allows a high volume of repeated login attempts with no additional friction, enabling automated scripts to rapidly try large password lists. This is typical of online password guessing and credential stuffing/brute-force style automation. The countermeasure being requested is explicitly one that "forces interaction steps designed to disrupt automation," which best matches CAPTCHA. CAPTCHA mechanisms introduce a challenge-response test intended to distinguish humans from automated bots, thereby reducing the effectiveness of scripted, high-rate credential attempts.
CAPTCHA is commonly deployed on login and registration pages (and sometimes on password reset flows) to slow down or block automated abuse. When triggered-often after a threshold of failed attempts or suspicious behavior-it forces the requester to complete an interactive step (image selection, puzzle, checkbox with behavioral analysis, etc.). This breaks fully automated attack loops and increases the attacker's cost, especially when combined with additional controls such as account lockout thresholds, IP reputation, device fingerprinting, and rate limiting.
Why the other options are less aligned to the "disrupt automation" requirement:
Strong hashing algorithms (A) protect stored passwords at rest (e.g., if a database is compromised). They do not directly stop online automated login attempts.
2FA/MFA (B) is excellent for reducing account takeover impact, but it does not inherently prevent high- volume credential submissions; it adds a second factor after correct credentials are provided. Also, the question's wording strongly points to a bot-disruption interaction step.
Forced periodic password changes (D) is not a primary control for stopping automated login attempts and can introduce usability issues; it does not directly add friction to repeated submissions.
Therefore, the most appropriate countermeasure described is C. Use CAPTCHA challenges on login and registration pages.

The correct answer is D because, in DNS, a zone is the administrative portion of the DNS namespace that contains DNS resource records for that portion of the domain tree. These records define how names are resolved and how services are located. Examples include A records for host-to-IP mapping, MX records for mail servers, NS records for name servers, CNAME records for aliases, PTR records for reverse lookups, and SOA records that identify the authoritative DNS server for the zone. In CEH reconnaissance and footprinting topics, DNS information is important because a DNS zone can reveal valuable network details such as hostnames, mail servers, name servers, and other infrastructure information. Option A is too broad because a zone is not merely a collection of domains. Option B is vague and does not define the zone itself. Option C is too narrow because alias records are only CNAME records, one type of DNS resource record. Therefore, a DNS zone is best defined as a collection of resource records.

The correct answer is A. DNS hijacking. In this attack, the user enters a legitimate domain name, but DNS resolution is manipulated so the browser is redirected to a fake or malicious website. The fake site may look like the real banking site but uses a different URL or lacks HTTPS security, prompting the victim to enter credentials again. ARP cache poisoning usually occurs inside a local network to redirect traffic through an attacker, DHCP spoofing gives victims malicious network settings, and DoS attacks make services unavailable. Here, the key clue is redirection from a legitimate URL to a suspicious banking page, which matches DNS hijacking.

Passive reconnaissance focuses on collecting information without directly touching or interacting with the target's systems. CEH materials stress that any action that sends network traffic to the target-such as scanning, probing, fingerprinting, or enumeration-creates logs and increases the risk of detection. Email headers, however, are considered an excellent source of passive intelligence because they reveal internal IP structures, routing paths, mail server hostnames, internal domain formats, and technology stacks without requiring interaction with the target environment. Since these headers are already in the possession of the ethical hacker through legitimate communication records, examining them does not generate traffic or trigger monitoring systems. SSL certificates and WHOIS data provide valuable external information, but they rarely disclose internal addressing schemes. Active scanning tools, such as Nmap, would immediately violate the requirement to avoid detection. Therefore, analyzing previously received email headers is the most effective and covert method for extracting internal network details during the reconnaissance phase.