The correct answer is Search Engine Phishing. CEH social engineering material explains that search engine phishing involves creating fraudulent websites and manipulating search visibility so that victims discover and visit the malicious site through search results rather than through a direct email or message lure. In this scenario, patients searching for the clinic's appointment system are led to a fake portal that closely resembles the official one and is positioned prominently in search engine results. That is the defining pattern of search engine phishing. Pharming would involve silently redirecting users to a fraudulent site through DNS or host- resolution manipulation, but the question specifically states that internal DNS servers were not altered and that users voluntarily navigated there through search results. Spear phishing would require targeted communications sent directly to victims, and whaling is aimed at high-profile executives. CEH guidance emphasizes that search engine phishing can be especially effective because users believe they are independently finding the legitimate service. Since the attacker relied on a cloned portal and manipulated search visibility rather than direct messaging or DNS tampering, Search Engine Phishing is the best answer.

A multihomed firewall refers to a firewall with two or more network interfaces (NICs), each connected to different network segments. The purpose of a multihomed firewall is to allow filtering and segmentation of traffic between multiple network zones, such as:
External network (e.g., Internet)
Internal network (e.g., LAN)
To qualify as multihomed, the system must have at least two network interfaces. This allows it to sit between two networks and inspect/filter traffic passing through it.
Reference - CEH v13 Official Study Guide:
Module 13: Evading IDS, Firewalls, and Honeypots
Section: Firewall Architecture
Quote:
"A multihomed firewall is a system with two or more NICs connected to different networks, typically used to control traffic between internal and external networks. The minimum number of interfaces is two." Incorrect Options Explained:
A). 3 interfaces may be used in advanced setups (e.g., with a DMZ), but not the minimum.
B & C. 4 or 5 connections are not required unless designing more complex segmentation.

The device's acceptance of outdated firmware without integrity or authenticity checks demonstrates a lack of secure update mechanisms. This allows attackers to perform a rollback attack, reintroducing known vulnerabilities and compromising the system.