A sheep dip computer is a dedicated device that is used to test inbound files or physical media for viruses, malware, or other harmful content, before they are allowed to be used with other computers. The term sheep dip comes from a method of preventing the spread of parasites in a flock of sheep by dipping the new animals that farmers are adding to the flock in a trough of pesticide. A sheep dip computer is isolated from the organization's network and has port monitors, file monitors, network monitors, and antivirus software installed. Before initiating the analysis of a potentially malicious program, the analyst should store the program on an external medium, such as a CD-ROM, and then insert it into the sheep dip computer. This way, the analyst can prevent the program from infecting other devices or spreading over the network, and can safely analyze its behavior and characteristics.
The other options are not correct steps to take before initiating the analysis. Running the potentially malicious program on the sheep dip computer may cause irreversible damage to the device or compromise its security.
Connecting the sheep dip computer to the organization's internal network may expose the network to the risk of infection or attack. Installing the potentially malicious program on the sheep dip computer may not be possible or advisable, as the program may require certain dependencies or permissions that the sheep dip computer does not have or allow.
References:
Sheep dip (computing)
What Does 'Sheep Dip' Mean in Cyber Security?
Malware Analysis
What is a Sheepdip?

This question describes a classic example of Tautology-Based SQL Injection, a subcategory of SQL Injection attacks which fall under Web Application Hacking in the CEH curriculum.
In a tautology-based SQL injection, the attacker injects a SQL fragment that always evaluates to true, thus bypassing the authentication mechanism. The string ' C 'll-T; - is a malformed variant, possibly meant to represent ' OR '1'='1'; --, which is one of the most basic and widely recognized tautology-based injection payloads. When injected into a vulnerable SQL query, this kind of input manipulates the WHERE clause of the query so that it always evaluates to true, regardless of the original conditions.
Here's how it works:
If the SQL query is:
SELECT * FROM users WHERE username = '$username' AND password = '$password'; And the attacker inputs:
' OR '1'='1'; --
The query becomes:
SELECT * FROM users WHERE username = '' OR '1'='1'; --' AND password = ''; This results in the execution of:
SELECT * FROM users WHERE '1'='1';
Which always evaluates to true, thereby bypassing authentication and allowing unauthorized access.
This method does not rely on error messages (Error-Based), timing delays (Time-Based Blind), or UNION statements (Union-Based). Its goal is to exploit logic within the query structure itself using boolean-based manipulation.
According to EC-Council's CEH v13 Module: Web Application Hacking, understanding tautology-based injection is critical because it's one of the most common ways attackers bypass login forms on poorly secured web applications.

Server-side request forgery (also called SSRF) is a net security vulnerability that allows an assaulter to induce the server-side application to make http requests to associate arbitrary domain of the attacker's choosing.
In typical SSRF examples, the attacker might cause the server to make a connection back to itself, or to other web-based services among the organization's infrastructure, or to external third-party systems.
Another type of trust relationship that often arises with server-side request forgery is where the application server is able to interact with different back-end systems that aren't directly reachable by users. These systems typically have non-routable private informatics addresses. Since the back-end systems normally ordinarily protected by the topology, they typically have a weaker security posture. In several cases, internal back-end systems contain sensitive functionality that may be accessed while not authentication by anyone who is able to act with the systems.
In the preceding example, suppose there's an body interface at the back-end url https://192.168.0.68/admin.
Here, an attacker will exploit the SSRF vulnerability to access the executive interface by submitting the following request:
POST /product/stock HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 118
stockApi=http://192.168.0.68/admin

The scenario describes an injection attack involving Server Side Includes (SSI). SSI directives are instructions placed in web pages that are executed by the web server before the page is sent to the user. If user input is improperly validated and directly used in an SSI-enabled environment, attackers can inject malicious SSI directives (such as file manipulation commands).
From CEH v13 Official Courseware:
Server-Side Includes (SSI) Injection occurs when attackers submit specially crafted input that is included in server responses and interpreted as SSI directives.
These directives can perform dangerous actions like:
Reading sensitive files (e.g., /etc/passwd)
Deleting or modifying files
Running shell commands via #exec directive
Incorrect options:
A). Server-side template injection is related to template engines like Jinja2 or Twig.
B). Server-side JS injection applies to environments like Node.js.
C). CRLF injection manipulates HTTP headers, not SSI parsing.
Reference - CEH v13 Official Courseware:
Module 14: Hacking Web Applications
Section: "Injection Flaws"
Subsection: "SSI Injection"
Lab Reference: CEH iLabs - Web Application Exploitation
=

Static Network Address Translation (Static NAT) allows a single private IP address to be mapped to a single public IP address. This one-to-one mapping ensures that the same internal machine is always reachable through the same external IP address, which is crucial for "server publishing" - making internal servers (e.g., web servers, FTP servers) accessible from the internet.
From CEH v13 Courseware:
* Module 03: Scanning Networks
* Topic: Network Address Translation
* Section: Types of NAT
CEH v13 Study Guide states:
"Static NAT provides a fixed translation of a private IP address to a public IP address. It is commonly used when an internal server must always be accessible from the Internet using a consistent IP address - this is known as server publishing." Incorrect Options:
* A. Overloading PAT: Multiple private IPs share a single public IP using port numbers - not suited for static mappings.
* B. Dynamic PAT: Similar to overloading; used for outbound traffic only.
* C. Dynamic NAT: Assigns a public IP from a pool; the mapping can change, not suitable for server publishing.
Reference:CEH v13 Study Guide - Module 3: Scanning Networks # NAT TypesRFC 3022 - Traditional NAT Terminology