Rachel assumes the identity of a trusted individual within the organization to manipulate the HR staffer into divulging sensitive information. This deliberate use of a false identity to gain access is characteristic of impersonation.

The correct answer is B. Design Flaws.
The issue is caused by a weakness in the workflow logic of the application. The platform depends on a multi- step identity verification sequence, but the server does not properly enforce completion of each required stage.
This is not simply a missing patch or configuration issue; it is a logic/design weakness in how the authentication workflow was built.
CEH-aligned vulnerability material classifies Design Flaws as flaws involving encryption, data validation, logic flaws, and similar systemic weaknesses . CEH web application material also explains that business logic flaws can exist in how an application is designed to function and may be exploited through transaction tampering or incomplete validation of workflow behavior .
Option A. Poor Patch Management is incorrect because the weakness is not described as an unpatched known vulnerability.
Option C. Application Flaws is related, but the more precise classification is a design or business logic flaw because the workflow itself fails to enforce required verification stages.
Option D. Misconfigurations / Weak Configurations is incorrect because the problem is not caused by insecure server settings or default configuration.
Option B. Design Flaws is correct because the root weakness is flawed authentication workflow logic.
Therefore, the best answer is B. Design Flaws.

This scenario clearly aligns with a Pulse Wave DDoS attack, a sophisticated denial-of-service technique described in CEH v13 Network and Perimeter Hacking. Unlike traditional volumetric DDoS attacks that rely on sustained flooding, pulse wave attacks deliver short, extremely high-volume bursts of traffic, followed by periods of inactivity.
The defining characteristics described-intermittent spikes exceeding 300 Gbps, regular intervals (every 10 minutes), and temporary recovery-are hallmark indicators of pulse wave attacks. CEH v13 explains that attackers use this method to overwhelm server resources, trigger auto-scaling failures, exhaust mitigation thresholds, and evade detection systems that rely on sustained traffic baselines.
Option A is incorrect because UDP floods are continuous. Option B (HTTP GET flood) targets the application layer with sustained requests. Option C (PDoS) permanently damages hardware, which does not match the recurring pattern.
Pulse wave attacks are particularly effective against large platforms like streaming services because they:
* Exploit elasticity limits of cloud infrastructure
* Confuse rate-based detection systems
* Cause repeated service degradation without long attack durations
CEH v13 emphasizes that pulse wave attacks are difficult to mitigate without adaptive, behavior-based DDoS protection. Therefore, Option D is the correct and CEH-aligned answer.

The correct answer is D, Long-term access. In MITRE ATT & CK terminology, "Persistence" refers to techniques adversaries use to keep access to a compromised environment after the initial compromise. This aligns closely with CEH system-hacking methodology, where the equivalent phase is "Maintaining Access." CEH material describes maintaining access as the phase where a hacker tries to retain ownership of a system after exploiting a vulnerability, often by securing continued access through backdoors, rootkits, Trojans, or Trojan horse backdoors. Another CEH-focused source explains that after privilege escalation, the attacker moves into maintaining access by setting up mechanisms that allow return access later, which directly matches the concept of long-term access. Initial exploit belongs to gaining access, data theft relates more to collection or exfiltration, and cleanup relates to covering tracks. Therefore, ATT & CK "Persistence" means maintaining long-term access to the target environment.