The correct answer is C, Preparation. In the incident response lifecycle, preparation is the stage performed before an actual incident occurs. This phase focuses on making the organization ready to respond effectively by creating the incident response plan, forming the incident response team, assigning roles and responsibilities, defining escalation paths, and testing communication procedures. CEH incident management material lists "Preparation for Incident Response" as the first incident response process before detection, classification, notification, containment, investigation, eradication, recovery, and post-incident activities. It also emphasizes setting up an incident response team, identifying the people who should be contacted during an intrusion, and defining lines of communication. Containment occurs after an incident is detected and aims to limit damage. Notification involves informing affected users or stakeholders. Recovery restores affected systems to normal operation. Since building the team and testing communication happen before an incident, the correct phase is Preparation.

Tess King is attempting to gather all DNS records from a target zone. This process is referred to as a zone transfer (AXFR), which is typically performed by secondary name servers to synchronize DNS data with the primary. If improperly secured, attackers can initiate unauthorized zone transfers to enumerate valuable information such as:
* Hostnames
* IP addresses
* Mail servers
* Name servers
CEH v13 defines a zone transfer as a crucial step in DNS enumeration.
From CEH v13 Official Courseware:
* Module 3: Scanning Networks
* Topic: DNS Enumeration # Zone Transfers
CEH v13 Study Guide states:
"A zone transfer (AXFR) is a DNS transaction used to replicate DNS databases. Attackers can exploit this feature to extract all DNS information from an improperly secured server." Incorrect Options:
* A. Zone harvesting is not a formal term.
* C. Zone update refers to DNS dynamic update operations (e.g., DDNS).
* D. Zone estimate is not a DNS-related process.
Reference:CEH v13 Study Guide - Module 3: DNS Enumeration # Zone TransfersRFC 5936 - DNS Zone Transfer Protocol

MAC flooding overwhelms the switch's CAM table with spoofed source addresses, causing it to fail at maintaining accurate MAC-to-port mappings. When the CAM table is full, the switch falls back to broadcasting frames out all ports, effectively behaving like a hub and exposing normally isolated unicast traffic.

CEH explains that MAC flooding overwhelms a switch's CAM table, causing it to fail open. When the table fills, the switch broadcasts frames out all ports, behaving like a hub. This exposes unicast traffic to attackers operating in promiscuous mode.

Reconstructing the full TCP session allows the analyst to view the complete HTTP conversation in a readable format, including any transmitted credentials. This makes it possible to directly observe unencrypted login data within the session stream.