In CEH v13 Module 06: Malware Threats, a worm is described as a self-replicating piece of malware that spreads independently from one system to another without needing to attach itself to any file or program (unlike viruses).
Key Characteristics of Worms:
Capable of network propagation without human interaction.
Often used in mass attacks (e.g., WannaCry, Conficker).
Can cause significant damage by:
Consuming bandwidth.
Spreading payloads (e.g., ransomware).
Modifying or deleting files.
Option Clarification:
A: Rootkit: Hides presence of malware or attacker activities.
B: Trojan: Disguised as legitimate software; does not replicate.
C: Worm: Correct - self-replicating and spreads automatically.
D: Adware: Primarily shows ads; not typically destructive or self-replicating.
Reference:
Module 06 - Types of Malware # Worms
CEH iLabs: Network Infection with Self-Spreading Worms

In CEH v13 Reconnaissance and Enumeration, NetBIOS name suffixes are used to identify the role of systems within a Windows network. The <1B> NetBIOS suffix is particularly significant because it uniquely identifies the Domain Master Browser, which in modern Windows environments corresponds to the Primary Domain Controller (PDC).
When an nbtscan is performed, multiple systems may respond with NetBIOS names, but only one system per domain will register the <1B> suffix. This is because the PDC is responsible for maintaining the master browse list and coordinating authentication services across the domain.
Option C is correct because the <1B> entry is explicitly defined in CEH documentation as belonging to the domain controller.
Option A is incorrect because the local system does not advertise <1B>.
Option B is incorrect because DHCP servers use different identifiers and do not register <1B>.
Option D is incorrect because NetBIOS must be enabled for <1B> to appear at all.
CEH v13 highlights identifying <1B> during enumeration as a high-value discovery, since domain controllers are prime targets during privilege escalation and lateral movement phases.

CEH cloud modules explain that side-channel attacks exploit indirect information leakage based on hardware characteristics-such as CPU timing, power usage, cache access patterns, or electromagnetic emissions. In virtualized cloud environments, multiple tenants share the same physical hardware, creating opportunities for attackers to extract sensitive data from neighboring virtual machines. By placing a malicious VM on the same host as the victim, an attacker can measure minute differences in timing during cryptographic operations, allowing them to infer private keys or sensitive computations. This aligns precisely with CEH's definition of a side-channel attack. Cryptojacking involves unauthorized cryptocurrency mining, CPDoS targets caching layers rather than key extraction, and metadata spoofing manipulates cloud metadata endpoints. Only side- channel analysis matches the described attack behavior.

Zero Trust Networks The Zero Trust model is a security implementation that by default assumes every user trying to access the network is not a trusted entity and verifies every incoming connection before allowing access to the network.It strictly follows the principle, "Trust no one and validate before providing a cloud service or granting access permission."It also allows companies to impose conditions, such as allowing employees to only access the appropriate resources required for their work role. (P.2997/2981) Zero Trust is a strategic initiative that helps prevent successful data breaches by eliminating the concept of trust from an organization's network architecture. Rooted in the principle of "never trust, always verify," Zero Trust is designed to protect modern digital environments by leveraging network segmentation, preventing lateral movement, providing Layer 7 threat prevention, and simplifying granular user-access control.