The analyst reuses a previously captured valid radio transmission and successfully gains unauthorized access because the system accepts it as fresh authentication data. This is a replay attack, where intercepted legitimate communications are retransmitted to impersonate a valid user or device.

The correct answer is D. XMAS Scan.
An XMAS scan sends TCP packets with multiple flags set, commonly FIN, URG, and PSH. In RFC 793-style behavior, closed ports respond with RST, while open ports often return no response.
CEH scanning material describes inverse TCP flag scanning as sending TCP probes with flags such as FIN, URG, and PSH. It identifies probes with these flags as XMAS scanning and explains that a closed port responds with an RST packet, while open ports may ignore or drop the abnormal packet combination .
Option A. FIN Scan is incorrect because a FIN scan uses only the FIN flag, while the scenario specifies an uncommon combination of multiple TCP control bits.
Option B. UDP Scan is incorrect because the probes are TCP packets, not UDP packets.
Option C. TCP Connect Scan is incorrect because a TCP connect scan completes the normal three-way handshake.
Option D. XMAS Scan is correct because it uses multiple TCP flags and produces the open/closed behavior described.
Therefore, the best answer is D. XMAS Scan.

The scan uses a non-standard combination of TCP flags (FIN, PSH, URG), which characterizes an Xmas scan. In this technique, closed ports respond with RST, while open ports do not reply, matching the observed behavior.

Probing the IPC share by attempting to brute force admin credentials is the most appropriate technique for this scenario, because it can reveal valuable information about the target system, such as its operating system, services, users, groups, and shares. An IPC share is a special share that allows processes to communicate with each other over the network using named pipes. An IPC share can be accessed anonymously or with valid credentials, depending on the security configuration of the target system. A brute force attack is a method of trying different combinations of usernames and passwords until a valid pair is found. By using a brute force attack, the tester can try to access the IPC share with admin credentials, which can grant them more privileges and access to more resources on the target system.
The other options are less suitable or effective techniques for this scenario. Brute forcing Active Directory may not be relevant or feasible, as the target system may not be part of a domain or may have strong password policies. Extracting usernames using email IDs may not provide enough information or access to the target system, as email IDs may not match the usernames or passwords. Conducting a DNS zone transfer may not be possible or useful, as the target system may not be a DNS server or may have restricted zone transfers. A DNS zone transfer is a method of obtaining information about the domain names and IP addresses of the hosts in a network by querying a DNS server. References:
* Inter-process communication - Wikipedia
* IPC$ share and null session behavior - Windows Server
* Brute Force Attack: Definition, Examples, and Prevention
* DNS Zone Transfer: Definition, Types, and Examples

Error-based SQL Injection is a type of in-band SQL Injection attack that relies on error messages thrown by the database server to obtain information about the structure of the database. In some cases, error-based SQL injection alone is enough for an attacker to enumerate an entire database.
The ethical hacker is likely to use this type of SQL Injection attack because the application responds to logically incorrect queries with detailed error messages that divulge the underlying database's structure. This means that the attacker can craft malicious SQL queries that trigger errors and reveal information such as table names, column names, data types, etc. The attacker can then use this information to construct more complex queries that extract data from the database.
For example, if the application uses the following query to display the username of a user based on the user ID:
SELECT username FROM users WHERE id = '$id'
The attacker can inject a single quote at the end of the user ID parameter to cause a syntax error:
SELECT username FROM users WHERE id = '1'
The application might display an error message like this:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'' at line 1 This error message reveals that the database server is MySQL and that the user ID parameter is enclosed in single quotes. The attacker can then use other techniques such as UNION, subqueries, or conditional statements to manipulate the query and retrieve data from other tables or columns.
References:
[CEHv13 Module 05: Sniffing]
Types of SQL Injection (SQLi) - GeeksforGeeks
Types of SQL Injection? - Acunetix