In CEH v13 Module 06: Malware Threats, code emulation is defined as a technique used by modern antivirus software where a virtual CPU and memory are created to safely execute and analyze malware in a sandboxed environment.
This allows the detection engine to observe runtime behavior of suspicious code without risking the actual system.
It's more effective than signature-based detection for catching polymorphic and obfuscated malware.
Reference:
Module 06 - Malware Detection Techniques
CEH eBook: Heuristic vs. Emulation-Based Detection
CEH iLabs: Malware Analysis with Emulation and Behavior-Based Techniques

Comprehensive and Detailed Explanation:
In a MAC flooding attack, tools like macof (shown in the image) rapidly generate a large number of Ethernet frames with spoofed source MAC addresses. These are sent to the switch to overflow its CAM (Content Addressable Memory) table.
Once the CAM table is full:
The switch can no longer learn new MAC-to-port associations.
It fails open and starts broadcasting all incoming traffic to all ports.
This causes the switch to act like a hub.
Consequently, the attacker can:
Sniff traffic that would otherwise be switched.
Intercept data not destined for their system.
From CEH v13 Courseware:
Module 8: Sniffing # Switch-Based Attacks # MAC Flooding
Incorrect Options:
B: A switch typically does not crash but reverts to hub behavior.
C: There is no factory default override behavior like this.
D: Packets are not dropped-this would defeat the attack's purpose.
Reference:CEH v13 Study Guide - Module 8: MAC Flooding and Layer 2 AttacksCisco Security Best Practices - Switch CAM Table Protection
======

The CEH Web Application Attacks module explains tautology-based SQL injection as an attack where input alters a conditional statement to always evaluate as TRUE (e.g., ' OR '1'='1').
Submitting a single quote often breaks query logic and allows attackers to manipulate authentication conditions.
Option D is correct.
Option A extracts data.
Option B relies on error messages.
Option C uses timing delays.
CEH identifies tautology attacks as one of the earliest and most common SQL injection techniques.