CEH v13 highlights the Idle Scan as one of the stealthiest reconnaissance methods available, designed specifically to avoid detection by IDS and security monitoring tools. Idle scanning leverages a "zombie host"
-a system with a predictable IPID sequence-to route all probe packets through it. Since no packets ever originate directly from the attacker's IP, IDS systems are unable to attribute the port scan to the attacker. CEH emphasizes that this technique creates zero direct traffic between the attacker and the target, making it extremely evasive and ideal for highly monitored networks. FIN scans (Option A) are somewhat stealthy but still originate from the attacker and are detectable. TCP Connect scans (Option C) are the most detectable because they complete full connections. ICMP Echo scans (Option D) are easily logged and flagged by IDS.
Idle scanning is uniquely suited for bypassing advanced detection systems while still identifying open ports and live hosts.

The best answer is Remediation because the workflow centers on fixing confirmed vulnerabilities through an organized, prioritized plan and coordinating corrective actions with operations teams. In CEH-aligned vulnerability management, the lifecycle typically moves from asset identification and risk context, to scanning and validation, to analysis and prioritization, and then into remediation where weaknesses are actually reduced or eliminated. The question explicitly states that after vulnerabilities are detected and validated, Priya' s team "develop a structured timeline to address the confirmed vulnerabilities" and prioritize "high-risk findings affecting mission-critical systems." Creating the remediation plan, assigning owners, scheduling patch windows, implementing configuration hardening, disabling unnecessary services, updating vulnerable software, and applying compensating controls are all core remediation activities.
Although the final step mentions rescanning to confirm resolution and producing a compliance report, that verification step occurs after remediation work has been performed. Verification is an important follow-on phase, but it is not the main phase being executed throughout the described workflow. Vulnerability analysis refers more to interpreting scan results, validating false positives, mapping weaknesses to impact, and determining exploitability. Risk assessment focuses on evaluating business impact and likelihood to prioritize work. Here, those phases are present, but the primary emphasis is on coordinating and executing fixes and driving them to closure, which is remediation.
In short, Priya is in the remediation phase, with verification used afterward to confirm the remediation was effective.

Jason's goal is to capture live SNMP traffic on the wire and manually inspect protocol fields such as community strings, OIDs, and variable bindings within requests and responses. The method described is packet capture and protocol dissection, which is exactly what Wireshark is designed for. Wireshark can capture traffic from an interface (or from a mirrored/SPAN port) and decode SNMP at the protocol level, presenting SNMP PDUs in a human-readable structure. This enables an assessor to view SNMP GET
/GETNEXT/GETBULK requests, SET operations (if present), and responses, including the transmitted identifiers and values-useful for verifying whether sensitive SNMP data is exposed in transit.
The scenario explicitly states Jason is not running structured queries and instead wants to observe "SNMP requests and responses in transit," which rules out tools that actively query devices. SnmpWalk (C) is an active enumeration tool that queries SNMP agents using a community string and walks a subtree of the MIB; that is the opposite of passive traffic inspection. Nmap (A) can scan ports and perform some SNMP-related scripts, but it still operates as an active probing tool rather than a live traffic capture and manual field review platform. SoftPerfect Network Scanner (D) is a network discovery tool for identifying hosts and services; it is not a packet-level sniffer intended for dissecting SNMP messages on the wire.
Additionally, the mention of "manual parsing" is consistent with packet analysis workflows: even though Wireshark decodes SNMP, the analyst still needs to interpret what OIDs and values mean, correlate requests to responses, and assess sensitivity (e.g., community strings in SNMPv1/v2c are not encrypted, and captured traffic may reveal them).
Therefore, the correct method is B. Wireshark.

The correct answer is B because encryption, decryption, translation, compression, and data formatting are core functions of the OSI Presentation layer, which is Layer 6. The CEH networking material states that the Presentation layer formats data for the Application layer, translates data into a common format, and that data compression and encryption occur at this layer. In the scenario, PKI is used to protect a sensitive email so that only user B can read it. CEH cryptography concepts explain that asymmetric encryption uses separate keys:
the recipient's public key is used to encrypt the data, and the recipient's private key is used to decrypt it.
Although email itself is an application-layer service, the OSI function of encoding, encrypting, and decrypting message data maps to the Presentation layer. Transport handles end-to-end delivery, Session manages conversations, and Application provides user-facing network services. Therefore, the best answer is Presentation.

The correct answer is D. NTP Enumeration.
The scenario describes querying a time synchronization service and receiving information about internal client systems. This directly maps to Network Time Protocol (NTP) enumeration.
CEH-aligned enumeration material explains that NTP runs on UDP port 123 and is used to synchronize time across a network. Querying an NTP server may reveal a list of connected systems, including system names, IP addresses, and internal network information when the NTP server is placed in a DMZ or screened subnet .
Another CEH reference states that NTP enumeration can reveal host information connected to the NTP server, client IP addresses, machine names, operating system information, and internal IP information depending on deployment .
Option A. NFS Enumeration is incorrect because NFS enumeration focuses on network file shares and exported directories.
Option B. NetBIOS Enumeration is incorrect because NetBIOS enumeration targets names, shares, sessions, and Windows network information.
Option C. SNMP Enumeration is incorrect because SNMP enumeration queries device management information using MIB/OID data.
Option D. NTP Enumeration is correct because the service being queried is a time synchronization service exposing client and internal network information.
Therefore, the best answer is D. NTP Enumeration.