ESP (Encapsulating Security Payload) in transport mode is used for end-to-end communication between hosts within the same LAN. It encrypts only the payload, not the header, ensuring confidentiality and integrity while maintaining efficient routing.
Reference - CEH v13 Official Study Guide:
Module 20: Cryptography
Quote:
"In ESP transport mode, only the data payload is encrypted, making it ideal for secure communication within a LAN where the IP header must remain intact for routing." Incorrect Options Explained:
B & C. Not valid IPSec modes.
D). AH tunnel mode ensures integrity but does not provide encryption.

https://www.cisco.com/c/en/us/support/docs/ip/access-lists/26448-ACLsamples.html Since the first line prohibits any TCP traffic (access-list 102 deny tcp any any), the lines below will simply be ignored by the router. Below you will find the example from CISCO documentation.
This figure shows that FTP (TCP, port 21) and FTP data (port 20) traffic sourced from NetB destined to NetA is denied, while all other IP traffic is permitted.

FTP uses port 21 and port 20. TCP traffic destined to port 21 and port 20 is denied and everything else is explicitly permitted.
* access-list 102 deny tcp any any eq ftp
* access-list 102 deny tcp any any eq ftp-data
* access-list 102 permit ip any any

In CEH v13 Module 11: Hacking Wireless Networks, wireless standards and their transmission ranges are discussed.
Actual Range Specs:
802.11a: Operates at 5 GHz, range up to ~75 ft indoors, much less than 150 ft due to poor wall penetration.
802.11b/g: Operate at 2.4 GHz, typically 150-300 ft indoors.
802.16 (WiMax): Wireless MAN technology with range up to 30 miles - correct for point-to-point outdoor line of sight.
Conclusion:
802.11a listed as 150-150 ft is incorrect.
Realistic effective range is up to 75 ft indoors, depending on obstructions and interference.
This overestimation makes Option D the wrong one.
Reference:
Module 11 - Wireless Protocols and Specifications
IEEE Wireless Standards Summary Table (CEH Appendix)
CEH iLabs: Analyzing Signal Strength of 802.11a/b/g/n Networks

CEH v13 explains that SQL injection typically occurs when user inputs are concatenated into SQL queries without proper validation or parameterization. The login form is one of the most common injection targets, and testers use specific test payloads designed to manipulate the authentication query. A classic test string such as ' OR '1'='1 exploits conditional logic to force the SQL statement to evaluate as true, effectively bypassing authentication if the application is vulnerable. CEH notes that this technique is a standard initial test because it is low-risk, easily detectable if vulnerable, and directly confirms improper sanitization.
JavaScript injection (Option A) tests for XSS, not SQLi. Directory traversal (Option C) targets file path vulnerabilities rather than SQL queries. Brute-force attacks (Option D) rely on guessing credentials and do not test input sanitization. Therefore, using a logical SQL injection payload is the most appropriate and CEH- aligned method.

Email headers typically contain multiple time-related fields, but they do not all carry the same evidentiary value for tracing message handling. In CEH-aligned reconnaissance and email analysis, the most reliable way to determine when an email was processed by the sender's infrastructure is to examine the earliest "Received" header entry-specifically, the timestamp showing when the message was accepted by the sender's originating mail server (the first mail transfer agent in the chain). This aligns with option C: the date and time received by the originator's email servers.
The "Date" header (option A) is set by the sender's mail client and can be manipulated or misconfigured, making it less trustworthy for forensic timing. Option B (sender's mail server) is useful for identifying infrastructure and routing, but it does not directly provide the exact processing moment unless paired with the correct "Received" timestamp. Option D (authentication system such as SPF/DKIM/DMARC results) helps validate whether a message is authorized for a domain and detect spoofing, but it does not pinpoint when the sender's system processed the email.
CEH guidance emphasizes that analysts should correlate multiple "Received" lines from bottom to top (earliest to latest), validate time zones, and look for inconsistencies such as impossible hops, private IP anomalies, or missing hops that indicate header forgery. However, for the specific "moment processed by the sender's system," the first acceptance timestamp at the origin mail server is the key artifact.