The described action is classic web server footprinting through banner grabbing. In CEH reconnaissance methodology, banner grabbing is used to identify a target's service details by eliciting and analyzing standard protocol responses. When Sofia sends a simple HTTP request such as GET / HTTP/1.0, the server often responds with HTTP headers that may include fields like Server and sometimes X-Powered-By, which can reveal the web server product and version, and occasionally information that hints at the underlying operating system or framework. This disclosure is valuable to attackers because it enables targeted exploitation: once the exact server and version are known, an attacker can correlate that information with known vulnerabilities, misconfigurations, and exploit code.
This is not information gathering from robots.txt, which is a web file used to suggest crawler behavior and sometimes reveals hidden paths but does not inherently expose server software versions. It is also not directory brute forcing, which involves systematically guessing directories and files to find hidden endpoints.
Vulnerability scanning is broader and typically involves automated checks to detect vulnerabilities; while banner information can be an input to scanning, the technique shown here is specifically identification through response headers.
CEH-aligned mitigation includes disabling or minimizing server signature information, removing unnecessary headers, keeping server software patched, and using secure configurations and reverse proxies to reduce information leakage during reconnaissance.

The correct answer is A. Switch(config)# ip dhcp snooping because the question asks for the global setting that must be enabled first, before applying more specific (granular) DHCP Snooping controls. In Cisco switching, DHCP Snooping is the primary Layer 2 security feature used to mitigate rogue DHCP server attacks. Once enabled, the switch can distinguish between trusted ports (where legitimate DHCP server responses are allowed, typically uplinks toward the authorized DHCP server) and untrusted ports (typically access ports to end-user devices), where DHCP server responses (DHCPOFFER/DHCPACK) are filtered to prevent a rogue server from handing out malicious network configuration (gateway/DNS) to clients.
The scenario's defense goal-"reject DHCP responses from untrusted ports"-is exactly what DHCP Snooping enforces after it is enabled and ports are assigned trust states. Conceptually, the workflow is:
Enable DHCP Snooping globally (feature activation),
Enable it for the relevant VLAN(s), and
Mark the legitimate DHCP-facing interface(s) as trusted so only those ports can send DHCP server responses.
Options C and D are part of the later, granular steps:
C enables DHCP snooping for a specific VLAN, which is necessary but is not the global prerequisite the question highlights.
D is applied under an interface to designate a port as trusted; again, this is granular and only meaningful after DHCP snooping is activated.
Option B is a different feature (Dynamic ARP Inspection) and is used to mitigate ARP spoofing/poisoning rather than rogue DHCP.
Therefore, the global command Jason should recommend first is Switch(config)# ip dhcp snooping.

CEH v13 defines the five phases of ethical hacking as a structured methodology that mirrors real-world attack progression:
* Reconnaissance - Information gathering
* Scanning - Identifying live hosts, ports, and vulnerabilities
* Gaining Access - Exploiting vulnerabilities
* Maintaining Access - Establishing persistence
* Covering Tracks - Removing evidence
Option C matches this exact sequence. CEH v13 emphasizes that understanding this order is critical for both attackers and defenders, as it enables systematic testing and effective mitigation strategies.
All other options misplace phases and contradict the CEH methodology.

Footprinting is the first phase of ethical hacking and information gathering. It involves collecting as much information as possible about a target system or organization from public sources (such as websites, social media, WHOIS databases, job postings, etc.) before launching an attack or vulnerability scan.
# Reference - CEH v13 Official Study Guide, Module 1: Introduction to Ethical Hacking
"Footprinting is the process of gathering information about a target system to find ways to intrude into the system."
# Incorrect options:
A). Scanning is the next phase, involving probing the network.
C). Enumeration extracts detailed information from services like SNMP, NetBIOS, etc.
D). System Hacking is the actual exploitation phase.

The correct answer is D. ICMP Timestamp Ping Scan.
An ICMP Timestamp Ping Scan uses ICMP timestamp request messages to query a target system's clock value. If the target responds, the returned timestamp information can confirm that the host is alive and can also help infer timing characteristics such as round-trip delay.
CEH scanning material explains that ICMP scanning is used to identify live hosts by sending ICMP requests and observing replies. ICMP echo replies verify that a host is live, and ICMP-based discovery can also help determine network behavior and host characteristics .
Option A. UDP Ping Scan is incorrect because UDP scanning uses UDP probes, not ICMP timestamp requests.
Option B. ICMP Echo Ping Sweep is incorrect because echo ping sweeps use ICMP Echo Request and Echo Reply, not timestamp request/reply.
Option C. IP Protocol Scan is incorrect because IP protocol scanning tests supported IP protocols rather than querying clock values.
Option D. ICMP Timestamp Ping Scan is correct because the packet requests the target's internal clock value.
Therefore, the best answer is D. ICMP Timestamp Ping Scan.