Comprehensive and Detailed Explanation:
Subnet 10.1.4.0/23 includes addresses from:
10.1.4.0 to 10.1.5.255
Total = 512 IPs (510 usable)
Last 100 usable IPs would be:
Start: 10.1.5.155 to 10.1.5.254
Only option C (10.1.5.200) falls within that range.
From CEH v13 Courseware:
Module 3: Subnetting & IP Addressing
Reference:IP Subnet Calculators and RFC 950
======

Blind SQL Injection is a type of SQL injection attack where no error messages or data are directly returned to the attacker. Instead, the attacker sends specially crafted SQL queries that result in true or false responses.
Based on how the application responds (such as redirecting to a different page or loading time), the attacker infers information about the backend database.
According to CEH v13:
* Blind SQLi is used when standard SQL injection yields no visible output.
* It comes in two forms:
* Boolean-based: Infers information based on application behavior.
* Time-based: Infers information based on server response time delays.
Incorrect Options:
* A. Time-based SQLi is a sub-type of Blind SQLi, but the question describes Boolean-based behavior.
* B. Union SQL injection uses the UNION keyword to fetch additional rows; requires visible output.
* C. Error-based SQL injection relies on database error messages.
Reference - CEH v13 Official Courseware:
Module 14: Hacking Web Applications
Section: "Types of SQL Injection"
Subsection: "Blind SQL Injection (Boolean and Time-Based)"

The Common Vulnerability Scoring System (CVSS) is a method used to supply a qualitative measure of severity for a vulnerability. CVSS consists of three metric groups: Base, Temporal, and Environmental. The Base metrics produce a score ranging from 0 to 10, which can then be modified by scoring the Temporal and Environmental metrics. A vector string represents the values of all the metrics as a block of text1 The Base metrics measure the intrinsic characteristics of a vulnerability, such as the attack vector, the attack complexity, the required privileges, the user interaction, the scope, and the impact on confidentiality, integrity, and availability. The Base score reflects the severity of a vulnerability assuming that there is no temporal information or context available1 The Temporal metrics measure the characteristics of a vulnerability that change over time, such as the exploit code maturity, the remediation level, and the report confidence. The Temporal score reflects the current state of a vulnerability and its likelihood of being exploited1 The Environmental metrics measure the characteristics of a vulnerability that depend on a specific implementation or environment, such as the security requirements, the modified base metrics, and the collateral damage potential. The Environmental score reflects the impact of a vulnerability on a particular organization or system1 In this scenario, the vulnerability has a Base score of 7, a Temporal score of 8, and an Environmental score of
5. This means that:
The vulnerability has a high severity based on its intrinsic characteristics, such as the attack vector, the attack complexity, the required privileges, the user interaction, the scope, and the impact on confidentiality, integrity, and availability. A Base score of 7 corresponds to a high severity rating according to the CVSS v3.0 specification1 The vulnerability has an increasing likelihood of exploitability over time based on its current state, such as the exploit code maturity, the remediation level, and the report confidence. A Temporal score of 8 is higher than the Base score of 7, which indicates that the vulnerability is more likely to be exploited as time passes1 The vulnerability has a medium impact on the specific environment or implementation based on the security requirements, the modified base metrics, and the collateral damage potential. An Environmental score of 5 is lower than the Base score of 7, which indicates that the vulnerability is less impactful in the particular context of the organization or system1 Therefore, the statement that best describes this scenario is: The vulnerability has an overall high severity, the likelihood of exploitability is increasing over time, and it has a medium impact in their specific environment.
References:
NVD - Vulnerability Metrics

In CEH v13 Cloud Computing, serverless architectures introduce unique security challenges, particularly around Function-as-a-Service (FaaS) permissions. When a serverless function is compromised through an insecure third-party API, the damage depends largely on what the function is allowed to do.
Implementing function-level permission models and enforcing the principle of least privilege ensures that even if a function is exploited, its ability to execute malicious actions is strictly limited. CEH v13 strongly emphasizes granular IAM controls in serverless environments.
While cloud-native security platforms (Option A) and CASBs (Option C) provide visibility and governance, they do not directly prevent excessive permissions. Regular patching (Option D) is important but does not mitigate permission abuse.
CEH v13 identifies least privilege as the single most critical control in preventing serverless abuse and privilege escalation. Therefore, Option B is the correct answer.