The described weakness is cross-site scripting in a password-management component. User-controlled content is stored or incorporated into credential-related data and later rendered while a privileged user is interacting with the administrative interface. Because the content executes in that user's authenticated browser context, it could read accessible page information, perform unauthorized actions, alter displayed data, or assist in session compromise.
This behavior is consistent with stored XSS. OWASP explains that stored cross-site scripting occurs when malicious input is retained and later returned without correct contextual handling, causing it to execute with the web application's privileges. Defenses include context-appropriate output encoding, safe templating, strict input validation, sanitization where rich content is necessary, and a restrictive Content Security Policy as defense in depth.
TYPO3 is a separate content-management platform and is not the password-management module described.
Exposing CCURE passwords would be a credential-disclosure issue rather than injected script execution. A CRLF vulnerability manipulates carriage-return and line-feed characters, typically affecting HTTP headers or response construction; the question expressly excludes protocol-level input manipulation. Therefore, "XSS in password manager" precisely matches both the affected component and the execution behavior.

Censys is a powerful Internet-wide scanning tool that allows users to:
Discover and analyze devices and services exposed to the public internet Enumerate connected IoT devices, open ports, software versions Provide structured and searchable reports for vulnerability analysis According to CEH v13:
Censys continuously scans the IPv4 address space and maintains up-to-date databases of connected devices and their metadata.
Incorrect Options:
B: Wapiti is a web application vulnerability scanner.
C: NeuVector is a container security solution.
D: Lacework is a cloud workload protection platform, not focused on IoT enumeration.
Reference - CEH v13 Official Courseware:
Module 18: IoT and OT Hacking
Section: "IoT Discovery Tools"
Tool Focus: Censys, Shodan

The system deliberately reduces or suspends non-critical services while maintaining essential functions during resource exhaustion. This reflects degrading services, where lower-priority operations are sacrificed to preserve critical system availability under attack conditions.

The correct answer is B. Dynamic Testing.
The analyst is interacting with the running application, sending structured test inputs, and observing live response differences. That is dynamic testing. The payloads are not random; they are deliberate SQL injection probes designed to determine whether user-controlled input influences backend SQL logic.
CEH-aligned SQL injection material explains that testers can identify SQL injection by submitting inputs such as a single quote and observing whether errors or behavioral differences appear. It also references testing inputs such as ' OR 1=1-- to determine whether the application is vulnerable . CEH material further explains that SQL injection vulnerability detection includes injecting code into input fields and observing responses, error messages, GET/POST values, cookies, and string values .
Option A. Static Testing is incorrect because static testing reviews source code or configuration without executing the application.
Option C. Function Testing is incorrect because the purpose is not ordinary feature validation; it is security testing of query behavior.
Option D. Fuzz Testing is incorrect because fuzzing usually involves sending large volumes of random or unexpected input. The scenario uses targeted SQL logic tests.
Therefore, the best answer is B. Dynamic Testing.

Targeted spear-phishing leverages detailed internal knowledge and trusted vendor context to appear legitimate and relevant to executives. By referencing real projects and communications, it significantly reduces suspicion and increases the likelihood that executives will disclose credentials without detecting the deception.