The Certified Ethical Hacker (CEH) Malware Threats module explains that attackers often abuse legitimate system services to blend malicious traffic with normal system behavior. Background Intelligent Transfer Service (BITS) is a Windows service designed to transfer files in the background using idle network bandwidth.
Attackers leverage BITS because its traffic closely resembles legitimate Windows Update traffic, which is commonly allowed through firewalls and proxy servers. CEH documentation states that BITS-based malware can download payloads, upload stolen data, and maintain persistence without triggering security alerts.
Option A is correct because BITS traffic appears legitimate and trusted, making it difficult for security devices to distinguish malicious usage.
Option B is incorrect because BITS does not operate exclusively through HTTP tunneling; it primarily uses HTTP/HTTPS in a legitimate manner.
Option C is incorrect because IP fragmentation is not a core feature of BITS.
Option D is incorrect because BITS does not rely on encrypted DNS traffic.
CEH emphasizes that living-off-the-land (LotL) techniques-using native tools like BITS-are increasingly favored by attackers due to their stealth and reliability.

This scenario matches a session fixation attack because Michael sets up a valid session identifier with the application first, then forces the victim to authenticate while using that same pre-established session. In CEH terms, session fixation occurs when an attacker "fixes" or plants a known session ID in the victim's browser, typically via a crafted URL parameter, cookie setting through a subdomain, or a redirect that preserves a session token. If the application does not regenerate the session ID after login, the victim's authentication becomes bound to the attacker-known session. The attacker can then reuse that same session ID to access the application as the victim, exactly as described when Michael "uses that session to access the portal" after the employee logs in.
The other options do not fit the mechanism. Session sniffing relies on capturing session tokens from network traffic, usually when encryption is missing or weak, but the question focuses on a link and a pre-initialized session rather than intercepting traffic. Session replay generally refers to capturing and replaying authentication exchanges or tokens, not pre-setting a session before the victim authenticates. "Session donation" is not the standard CEH label for this behavior and is not the best match to the described flow.
CEH-recommended mitigations include regenerating session IDs immediately after authentication and privilege changes, rejecting session IDs supplied in URLs, setting Secure and HttpOnly cookie flags, enforcing SameSite where appropriate, implementing short idle timeouts, and adding server-side controls to detect concurrent use or abnormal session binding changes.

Publicly readable cloud storage may expose confidential documents, backups, source code, credentials, or personally identifiable information if access permissions are misconfigured.
Reviewing access policies, applying the principle of least privilege, and continuously monitoring storage permissions are essential cloud security practices.

The correct answer is A because data exfiltration means the unauthorized extraction, transfer, or removal of data from a target system, network, database, cloud storage, or endpoint. In CEH system hacking and post- exploitation concepts, after an attacker gains access and possibly escalates privileges, the attacker may attempt to access protected resources and quietly extract sensitive data. The retrieved guide material describes exfiltration as a phase where an attacker with elevated or unrestricted access can access protected resources and "quietly extract data," modify or delete sensitive files, or obtain configuration information. Therefore, the keyword that best matches data exfiltration is "extraction." Option B, deletion, means removing data. Option C, encryption, means converting readable data into ciphertext, commonly seen in ransomware. Option D, corruption, means damaging or altering data so it becomes unreliable or unusable. These actions may occur during attacks, but they do not define exfiltration.