Insufficient logging and monitoring is the most direct threat highlighted by the scenario. In CEH-aligned cloud security concepts, visibility is foundational: without adequate telemetry, security teams cannot detect, investigate, or respond to malicious activity in time. The question explicitly states attackers "remained undetected" because the organization lacked mechanisms to track function-level activity and capture anomalous events. In a serverless architecture, this visibility gap can be especially damaging because there are no traditional servers for defenders to log into, and many security signals must be collected from cloud-native sources such as function invocation logs, API gateway logs, identity events, and centralized monitoring pipelines.
While privilege escalation is a common cloud threat, the question's root cause is not described as excessive permissions or role abuse; it is the lack of detection capability. Loss of governance refers to weak policies, mismanaged accounts, and lack of control over cloud resources, which may contribute indirectly but is not the immediate failure described. Side-channel attacks are specialized and do not match the evidence of missed alerts and absent operational telemetry.
CEH guidance emphasizes implementing centralized logging, continuous monitoring, alerting, and anomaly detection as core controls. For serverless, this includes capturing detailed function execution logs, tracing, identity and access events, and integrating them into a SIEM/SOAR workflow. Effective monitoring enables rapid detection of abnormal invocation patterns, suspicious API calls, unusual data access, and persistence attempts-reducing dwell time and preventing small compromises from becoming major outages.

The scenario describes malicious instructions being executed directly in memory within legitimate processes after the phishing attachment is opened, without any on-disk artifacts or persistence mechanisms yet established. This corresponds to the code execution phase of a fileless attack lifecycle, where the payload is actively running in a compromised process.

In CEH v13 Module 03: Scanning Networks, Nmap's evasion techniques are discussed for bypassing or confusing Intrusion Detection Systems (IDS) and firewalls.
The -D option in Nmap is used to enable decoy scanning. It inserts false IP addresses in the scan to obfuscate the true origin of the scan.
This technique helps in masking the attacker's IP and can confuse IDS logs.
Option Clarification:
A: -n/-R: Disables DNS resolution (-n) or uses reverse DNS (-R), does not evade detection.
B: -0N/-0X/-0G: Output formats (normal, XML, grepable), not related to evasion.
C: -T: Controls timing (e.g., -T0 is stealthy, -T5 is aggressive), but not explicitly for IDS evasion.
D: Correct. Used for IDS/firewall evasion by using decoy IPs.
Reference:
Module 03 - Scanning with Evasion Options
Nmap Official Docs: https://nmap.org/book/man-bypass-firewalls-ids.html

The correct answer is A. --spoof-mac 0.
Nmap supports MAC address spoofing as a firewall-evasion and scan-obfuscation option. The available reference material lists Nmap firewall evasion options and identifies --spoof-mac mac as the option used to spoof the MAC address .
The value 0 tells Nmap to generate a random MAC address. Because the question states that the recorded hardware address changes automatically each time, the random MAC option is the correct match.
Option B. --spoof-mac Dell is incorrect because this selects a MAC address associated with a specific vendor prefix, not the fully random behavior described.
Option C. --spoof-mac 00:01:02:25:56:AE is incorrect because it uses a fixed MAC address. Repeated scans would show the same spoofed address, not a new one each time.
Option D. --spoof-mac Dell 10.10.1.11 is incorrect because it is not the correct Nmap option format for this behavior.
Therefore, the best answer is A. --spoof-mac 0.