The command that best matches "directly interact with the NTP daemon and query its internal state," enabling monitoring and retrieval of statistics, is ntpdc. Option C is correct because ntpdc is designed as a control
/query utility for NTP that communicates with the NTP daemon using control messages. It can be used to request internal variables, statistics, and status information and to perform certain monitoring-style checks related to NTP daemon operation.
The scenario also gives a strong exclusion clue: Bob's goal is not primarily to list peers with delay, offset, and jitter values. That peer listing is most closely associated with ntpq -p (option A), which prints peer relationships and timing metrics. Similarly, ntptrace (option B) is used to trace the chain of NTP servers (who is syncing from whom), which is not what Bob is seeking. Option D (ntpq with -c command) can query certain runtime details, but the question emphasizes a diagnostic command focused on controlling/checking daemon operation and retrieving internal stats-this description aligns more closely with ntpdc in many NTP administration and diagnostic workflows.
In practice, an assessor might use ntpdc to query items like system status, clock variables, and monitoring statistics from the daemon, which can help diagnose synchronization irregularities and understand how the NTP service is behaving internally. That aligns with "query its internal state" and "retrieve statistics." Therefore, the correct command is C. ntpdc [-ilnps] [-c command] [host].

SYN/FIN scanning using IP fragments is a process of scanning that was developed to avoid false positives generated by other scans because of a packet filtering device on the target system. The TCP header splits into several packets to evade the packet filter. For any transmission, every TCP header must have the source and destination port for the initial packet (8-octet, 64-bit). The initialized flags in the next packet allow the remote host to reassemble the packets upon receipt via an Internet protocol module that detects the fragmented data packets using field-equivalent values of the source, destination, protocol, and identification.

The correct answer is A, No flags set. In CEH scanning concepts, a NULL scan is a TCP port-scanning technique in which the scanner sends a TCP segment with none of the TCP flags enabled. This means the packet does not contain SYN, ACK, FIN, RST, PSH, or URG flags. The uploaded CEH material states that when no TCP flag is set, the scan is known as Null Scanning, and further describes a NULL scan as sending a packet "without any flag set." This differs from a SYN scan, which sends SYN packets to begin a half-open connection, and from an ACK scan, which sends packets with the ACK flag set to help identify filtering behavior. RST is not what a NULL scan sends; rather, a closed port may respond with RST. For exam purposes, remember: NULL scan equals empty TCP flag field, so the best answer is No flags set.

The protocol that you would recommend to the team to achieve the secure exchange of the symmetric key is the Diffie-Hellman protocol. The Diffie-Hellman protocol is a key agreement protocol that allows two or more parties to establish a shared secret key over an unsecured communication channel, without having to exchange the key itself. The Diffie-Hellman protocol works as follows12:
The parties agree on a large prime number p and a generator g, which are public parameters that can be known by anyone.
Each party chooses a random private number a or b, which are kept secret from anyone else.
Each party computes a public value A or B, by raising g to the power of a or b modulo p, i.e., A = g^a mod p and B = g^b mod p.
Each party sends their public value A or B to the other party over the unsecured channel.
Each party computes the shared secret key K, by raising the received public value to the power of their own private number modulo p, i.e., K = A^b mod p = B^a mod p.
The parties can now use the shared secret key K to encrypt and decrypt the data using a symmetric key encryption algorithm, such as AES or 3DES.
The Diffie-Hellman protocol can ensure the secure exchange of the symmetric key because it relies on the mathematical difficulty of computing discrete logarithms, which means that it is hard to find the private numbers a or b given the public values A or B, g, and p. Therefore, an attacker who intercepts the public values A or B cannot easily compute the shared secret key K, and thus cannot decrypt the data encrypted with K12.
The other options are not as appropriate as option B for the following reasons:
A). Implementing SSL certificates on your company's web servers: This option is not relevant because SSL certificates are not used to exchange symmetric keys, but to authenticate the identity of the web servers and to establish a secure connection using public key encryption. SSL certificates are digital certificates that contain the public key and the identity information of the web server, and are issued and signed by a trusted certificate authority (CA). When a client connects to a web server, the web server sends its SSL certificate to the client, who verifies it with the CA. If the verification is successful, the client and the web server use the public key in the certificate to exchange a symmetric key, which is then used to encrypt and decrypt the data. However, this option does not address the scenario of transmitting data over an unsecured communication channel, which may not involve web servers or SSL certificates34.
C). Switching all data transmission to the HTTPS protocol: This option is not sufficient because HTTPS protocol is not a protocol for exchanging symmetric keys, but a protocol for securing web traffic using SSL or TLS encryption. HTTPS protocol is a combination of HTTP protocol and SSL or TLS protocol, which means that it uses HTTP for the application layer communication and SSL or TLS for the transport layer encryption.
When a client requests a web page from a web server using HTTPS protocol, the client and the web server establish a secure connection using SSL or TLS protocol, which involves the exchange of SSL certificates and a symmetric key, as explained in option A. Then, the client and the web server use the symmetric key to encrypt and decrypt the HTTP data. However, this option does not address the scenario of transmitting data over an unsecured communication channel, which may not involve web servers or HTTPS protocol5 .
D). Utilizing SSH for secure remote logins to the servers: This option is not applicable because SSH is not a protocol for exchanging symmetric keys, but a protocol for securing remote access to servers using public key authentication and encryption. SSH is a protocol that allows a client to securely connect to a server and execute commands or transfer files over an encrypted channel. SSH uses public key cryptography to authenticate the identity of the server and the client, and to exchange a symmetric key, which is then used to encrypt and decrypt the data. However, this option does not address the scenario of transmitting data over an unsecured communication channel, which may not involve remote logins or SSH protocol .
References:
1: Diffie-Hellman key exchange - Wikipedia
2: Diffie-Hellman Key Exchange - an overview | ScienceDirect Topics
3: SSL Certificate - an overview | ScienceDirect Topics
4: What is an SSL Certificate? | DigiCert.com
5: HTTPS - Wikipedia
6: What is HTTPS? | Cloudflare
7: SSH (Secure Shell) - Wikipedia
8: What is SSH? | SSH.COM

The correct answer is D. OS Command Injection in nginxWebUI.
The scenario describes user-controlled input being incorporated into backend processing routines and affecting system-level operations under the web service context. That is characteristic of OS command injection.
CEH-aligned web application material explains that injection flaws occur when untrusted input is processed without proper validation and that injection attacks include SQL injection, LDAP injection, and OS command injection . Another CEH source explains that command injection may occur when malicious commands are injected into application input fields instead of expected values, allowing commands to be passed to the server through poor input validation .
Option A. NULL Pointer Dereference in HTTP/3 is incorrect because the scenario does not describe HTTP/3 memory handling or service crashes caused by null pointer behavior.
Option B. Improper Certificate Validation is incorrect because the issue is not related to TLS certificate verification.
Option C. Server-Side Request Forgery (SSRF) is incorrect because SSRF involves causing the server to make unintended requests to internal or external resources.
Option D. OS Command Injection in nginxWebUI is correct because modified user input affects system-level commands executed by the web service.
Therefore, the best answer is D. OS Command Injection in nginxWebUI.