Banner grabbing is a technique wont to gain info about a computer system on a network and the services running on its open ports. administrators will use this to take inventory of the systems and services on their network. However, an to find will use banner grabbing so as to search out network hosts that are running versions of applications and operating systems with known exploits.
Some samples of service ports used for banner grabbing are those used by Hyper Text Transfer Protocol (HTTP), File Transfer Protocol (FTP), and Simple Mail Transfer Protocol (SMTP); ports 80, 21, and 25 severally. Tools normally used to perform banner grabbing are Telnet, nmap and Netcat.
For example, one may establish a connection to a target internet server using Netcat, then send an HTTP request. The response can usually contain info about the service running on the host:

This information may be used by an administrator to catalog this system, or by an intruder to narrow down a list of applicable exploits.
To prevent this, network administrators should restrict access to services on their networks and shut down unused or unnecessary services running on network hosts. Shodan is a search engine for banners grabbed from portscanning the Internet.

An ACK scan is primarily used to determine whether ports are filtered or unfiltered by a firewall. It helps identify firewall rules and packet-filtering behavior rather than directly determining whether ports are open or closed.

Modifying URL parameters to access restricted files and directories indicates traversal outside the intended web root. This is characteristic of directory traversal, where crafted input allows access to sensitive files not meant to be publicly accessible.

A brute-force attack is the most exhaustive password-cracking method. It tries every possible combination of characters (letters, numbers, and symbols) until the correct password is found.
From CEH v13 Courseware:
Module 6: Password Cracking Techniques
CEH v13 Study Guide states:
"Brute-force attacks try every possible combination until the correct password is discovered. It's resource- intensive but guarantees success if enough time and processing power is available." Incorrect Options:
B: Refers to social engineering or coercion.
C: Describes a dictionary attack.
D: Refers to a rainbow table attack.
E: Not a cracking method.
Reference:CEH v13 Study Guide - Module 6: Brute-Force vs. Dictionary Attacks