CEH v13 explains that when traditional enumeration techniques-such as SMB null sessions-are disabled, attackers often pivot to misconfigured LDAP services that still allow anonymous binding. LDAP anonymous bind, when not properly restricted, exposes directory information such as usernames, organizational units, group memberships, and other metadata. This aligns directly with the scenario, where the tester must avoid triggering alarms while still gathering internal data. LDAP queries generate minimal noise, often blending with normal authentication-related traffic, making them ideal for covert enumeration. Options A and C would require authentication or violate access restrictions, and DNS zone transfers (Option D) rarely succeed because modern DNS servers disable AXFR requests from unauthorized clients. CEH repeatedly stresses the importance of detecting and securing LDAP anonymous bind due to its potential for silent information leakage-making Option B the correct choice.

A counter-based authentication system is based on the HOTP (HMAC-Based One-Time Password) algorithm.
It uses a shared secret and a moving counter to generate a one-time password (OTP). Each time the counter is incremented, a new OTP is generated and encrypted using the secret key.
Reference - CEH v13 Official Study Guide:
Module 5: System Hacking
Quote:
"HOTP generates a one-time password using a counter value and a secret key. This is a form of two-factor authentication, and the passwords are encrypted." Incorrect Options Explained:
A & B. These describe biometric systems, not counter-based OTPs.
D). Virtual passwords from passphrases are not counter-based systems.
=

The correct answer is C, Severity scoring. CVSS stands for Common Vulnerability Scoring System. In CEH vulnerability analysis and vulnerability management topics, CVSS is used to measure and communicate how severe a vulnerability is. The CEH material explains that CVSS captures the principal characteristics of a vulnerability and produces a numerical score that reflects its severity. That score can then be translated into qualitative ratings such as low, medium, high, and critical, helping organizations assess and prioritize remediation activities. CVSS is not an encryption mechanism, because it does not protect data or perform cryptographic operations. It is also not exploitation, because it does not attack or take advantage of vulnerabilities. Auditing may use CVSS results as supporting evidence, but CVSS itself is specifically a scoring framework. Therefore, in this question, the best and most precise CEH-aligned answer is Severity scoring.