The ethical hacker is likely performing an SYN scan to stealthily identify open ports without fully establishing a connection. An SYN scan, also known as a half-open scan or a stealth scan, is a type of port scanning technique that exploits the TCP three-way handshake process. The hacker sends an SYN packet to a target port and waits for a response. If the target responds with an SYN/ACK packet, it means the port is open and listening for connections. If the target responds with an RST packet, it means the port is closed and not accepting connections. However, instead of completing the handshake with an ACK packet, the hacker sends an RST packet to abort the connection. This way, the hacker avoids creating a full connection and logging an entry in the target's system, making the scan less detectable and intrusive. The hacker can repeat this process for different ports and identify which ones are open and potentially vulnerable to exploitation12.
The other options are not correct for the following reasons:
* B. They are performing a TCP connect scan to identify open ports on the target machine: This option is incorrect because a TCP connect scan involves establishing a full connection with the target port by completing the TCP three-way handshake. The hacker sends an SYN packet, receives an SYN/ACK packet, and then sends an ACK packet to finalize the connection. Then, the hacker terminates the connection with an RST or FIN packet. A TCP connect scan is more reliable and compatible than an SYN scan, but also more noisy and slow, as it creates more traffic and logs on the target system12.
* C. They are performing a vulnerability scan to identify any weaknesses in the target system: This option is incorrect because a vulnerability scan is a broader and deeper process than a port scan. A vulnerability scan involves identifying and assessing the security flaws and risks in a system or network, such as missing patches, misconfigurations, outdated software, or weak passwords. A vulnerability scan may use port scanning as one of its techniques, but it also uses other methods, such as banner grabbing, service enumeration, or exploit testing. A vulnerability scan usually requires more time, resources, and permissions than a port scan34.
* D. They are performing a network scan to identify live hosts and their IP addresses: This option is incorrect because a network scan is a different process than a port scan. A network scan involves discovering and mapping the devices and hosts connected to a network, such as routers, switches, servers, or workstations. A network scan may use ping, traceroute, or ARP requests to identify the IP addresses, MAC addresses, and hostnames of the live hosts. A network scan usually precedes a port scan, as it provides the target range and scope for the port scan56.
References:
* 1: Port Scanning Techniques - an overview | ScienceDirect Topics
* 2: nmap Host Discovery Techniques
* 3: Vulnerability Scanning Tools | OWASP Foundation
* 4: What Is Vulnerability Scanning? Types, Tools and Best Practices | Splunk
* 5: Network Scanning - an overview | ScienceDirect Topics
* 6: Network Scanning - Nmap

By submitting modified ciphertexts and observing differences in server error messages, the tester is exploiting padding validation feedback. This behavior allows the attacker to infer correct padding and progressively recover plaintext, which is characteristic of a padding oracle attack.

Windows 2000 and newer systems use Kerberos as their default authentication protocol rather than NTLM or LM challenge/response over SMB. Kerberos is encrypted and does not rely on the older SMB logon exchange methods that L0phtCrack can sniff.
From CEH v13 Courseware:
* Module 6: Malware and Password Attacks
* Module 4: Enumeration
CEH v13 Study Guide states:
"Kerberos is the default authentication protocol in Windows 2000 and newer systems. It encrypts communication and is not vulnerable to the same sniffing attacks that work against LM/NTLM challenge- response mechanisms." Incorrect Options:
* A: While a NIDS may detect traffic, it doesn't prevent sniffing.
* C: Logons can be sniffed in older systems using NTLM.
* D: L0phtCrack does not sniff web logons-it targets SMB and Windows logins.
Reference:CEH v13 Study Guide - Module 6: Password Sniffing TechniquesMicrosoft TechNet - Overview of Kerberos Authentication

A rootkit is a type of stealth malware designed to hide the existence of certain processes or programs from normal detection methods. It can:
* Hide itself and other processes
* Conceal files and registry entries
* Intercept system calls or keystrokes (keylogging)
* Maintain persistent access
From CEH v13 Courseware:
* Module 6: Malware Threats # Rootkits
Incorrect Options:
* A: A Trojan may offer remote access but doesn't necessarily hide itself.
* C: DoS tools are used to overload systems, not hide.
* D: Scanners detect vulnerabilities, not conceal activities.
* E: A backdoor may provide unauthorized access, but rootkits focus on hiding.
Reference:CEH v13 Study Guide - Module 6: Malware Types # RootkitsNIST SP 800-83 - Malware Handling Guide