The correct answer is C. DNSSEC (Domain Name System Security Extensions). DNSSEC is a collection of security extensions designed to protect the Domain Name System (DNS) from attacks such as DNS cache poisoning, DNS spoofing, and forged DNS responses. Traditional DNS was not originally designed with strong authentication mechanisms, making it vulnerable to attackers who could redirect users to malicious websites by manipulating DNS records.
DNSSEC addresses this weakness by using public key cryptography and digital signatures to verify the authenticity and integrity of DNS data. When a DNS resolver receives a response, it can validate the digital signature associated with the DNS record to ensure that the information originated from the legitimate DNS zone and has not been altered during transmission.
Option A (Resource transfer) is not a DNS security mechanism. Option B (Resource records) are standard DNS database entries such as A, AAAA, MX, and CNAME records. Option D (Zone transfer) is a DNS replication mechanism used between DNS servers and does not provide authentication or protection against spoofing.
CEH Exam Tip:
DNSSEC = DNS Authentication + Integrity Verification + Protection Against DNS Poisoning and Spoofing Attacks.

WS-Security (Web Services Security) is a protocol specification that provides a means for securing SOAP- based messages. It defines how to add authentication, encryption, and digital signatures to SOAP headers, helping ensure message integrity and confidentiality.
According to CEH v13 Official Courseware:
WS-Security is an extension of SOAP.
It supports features such as:
Authentication via tokens (e.g., username, X.509)
Message integrity via digital signatures
Message confidentiality via XML encryption
Incorrect Options:
A). WSDL (Web Services Description Language) describes the web service interface but does not provide security.
B). WS Work Processes is not a defined web service security standard.
C). WS-Policy allows expressing security requirements, but enforcement is handled by WS-Security.
Reference - CEH v13 Official Courseware:
Module 14: Hacking Web Applications
Section: "Web Services Security"
Subsection: "WS-* Standards"
=

The correct answer is A. Sequential Change-Point Detection.
The scenario asks for a technique that detects the exact point where traffic behavior changes from normal to anomalous. This directly matches Sequential Change-Point Detection.
CEH DoS/DDoS detection material explains that change-point detection is used to detect DoS attacks and uses a non-parametric CUSUM algorithm to detect traffic patterns. It also notes that this method has low computational overhead and high accuracy .
Option B. Wavelet-Based Signal Analysis is incorrect because wavelet analysis focuses on signal decomposition and volume-based anomaly detection, not specifically identifying the exact statistical change point.
Option C. Traffic Pattern Analysis is too general and does not specifically describe structural-break detection.
Option D. Activity Profiling compares behavior against average traffic rates or baselines, while the question asks for abrupt real-time change-point detection.
Therefore, the best answer is A. Sequential Change-Point Detection.

Comprehensive and Detailed Explanation:
An incident checklist is a low-overhead, high-impact solution to improve procedural consistency under pressure. It ensures critical steps are not forgotten during stressful incidents. The checklist can be reused and updated easily and is a recognized best practice in incident response processes.
From CEH v13 Courseware:
Module 19: Incident Response and Forensics # Incident Handling Procedures Reference:NIST SP 800-61 Rev.2 - Computer Security Incident Handling Guide

The protocol that you would recommend to the team to achieve the secure exchange of the symmetric key is the Diffie-Hellman protocol. The Diffie-Hellman protocol is a key agreement protocol that allows two or more parties to establish a shared secret key over an unsecured communication channel, without having to exchange the key itself. The Diffie-Hellman protocol works as follows12:
* The parties agree on a large prime number p and a generator g, which are public parameters that can be known by anyone.
* Each party chooses a random private number a or b, which are kept secret from anyone else.
* Each party computes a public value A or B, by raising g to the power of a or b modulo p, i.e., A = g^a mod p and B = g^b mod p.
* Each party sends their public value A or B to the other party over the unsecured channel.
* Each party computes the shared secret key K, by raising the received public value to the power of their own private number modulo p, i.e., K = A^b mod p = B^a mod p.
* The parties can now use the shared secret key K to encrypt and decrypt the data using a symmetric key encryption algorithm, such as AES or 3DES.
The Diffie-Hellman protocol can ensure the secure exchange of the symmetric key because it relies on the mathematical difficulty of computing discrete logarithms, which means that it is hard to find the private numbers a or b given the public values A or B, g, and p. Therefore, an attacker who intercepts the public values A or B cannot easily compute the shared secret key K, and thus cannot decrypt the data encrypted with K12.
The other options are not as appropriate as option B for the following reasons:
* A. Implementing SSL certificates on your company's web servers: This option is not relevant because SSL certificates are not used to exchange symmetric keys, but to authenticate the identity of the web servers and to establish a secure connection using public key encryption. SSL certificates are digital certificates that contain the public key and the identity information of the web server, and are issued and signed by a trusted certificate authority (CA). When a client connects to a web server, the web server sends its SSL certificate to the client, who verifies it with the CA. If the verification is successful, the client and the web server use the public key in the certificate to exchange a symmetric key, which is then used to encrypt and decrypt the data. However, this option does not address the scenario of transmitting data over an unsecured communication channel, which may not involve web servers or SSL certificates34.
* C. Switching all data transmission to the HTTPS protocol: This option is not sufficient because HTTPS protocol is not a protocol for exchanging symmetric keys, but a protocol for securing web traffic using SSL or TLS encryption. HTTPS protocol is a combination of HTTP protocol and SSL or TLS protocol, which means that it uses HTTP for the application layer communication and SSL or TLS for the transport layer encryption. When a client requests a web page from a web server using HTTPS protocol, the client and the web server establish a secure connection using SSL or TLS protocol, which involves the exchange of SSL certificates and a symmetric key, as explained in option A. Then, the client and the web server use the symmetric key to encrypt and decrypt the HTTP data. However, this option does not address the scenario of transmitting data over an unsecured communication channel, which may not involve web servers or HTTPS protocol5 .
* D. Utilizing SSH for secure remote logins to the servers: This option is not applicable because SSH is not a protocol for exchanging symmetric keys, but a protocol for securing remote access to servers using public key authentication and encryption. SSH is a protocol that allows a client to securely connect to a server and execute commands or transfer files over an encrypted channel. SSH uses public key cryptography to authenticate the identity of the server and the client, and to exchange a symmetric key, which is then used to encrypt and decrypt the data. However, this option does not address the scenario of transmitting data over an unsecured communication channel, which may not involve remote logins or SSH protocol .
References:
* 1: Diffie-Hellman key exchange - Wikipedia
* 2: Diffie-Hellman Key Exchange - an overview | ScienceDirect Topics
* 3: SSL Certificate - an overview | ScienceDirect Topics
* 4: What is an SSL Certificate? | DigiCert.com
* 5: HTTPS - Wikipedia
* : What is HTTPS? | Cloudflare
* : SSH (Secure Shell) - Wikipedia
* : What is SSH? | SSH.COM