Packet fragmentation is a well-documented IDS evasion technique in CEH v13 Network and Perimeter Hacking. Attackers fragment packets to evade detection by overwhelming or confusing intrusion detection systems, especially those that rely on simple pattern matching.
CEH v13 explains that anomaly-based IDS systems are particularly effective against evasion techniques like packet fragmentation because they analyze deviations from normal network behavior, rather than relying on static signatures. Fragmented packets often create unusual traffic patterns, abnormal packet sizes, or irregular reassembly behavior, which anomaly-based systems are designed to detect.
Signature-based IDS solutions struggle against fragmentation because attackers can split malicious payloads across multiple packets in ways that bypass predefined signatures. Rejecting all fragmented packets (Option C) is impractical and could disrupt legitimate network communication, as fragmentation is a normal part of TCP/IP networking.
Recognizing regular intervals (Option A) is unreliable, as attackers can randomize packet timing. CEH v13 clearly recommends anomaly-based detection to counter advanced evasion techniques.
Thus, Option B is the most effective and CEH-aligned IDS configuration.

The correct answer is A. LDAP Injection.
The scenario describes malicious input being inserted into directory-based search logic used to validate identities. LDAP is commonly used for centralized directory authentication and account lookups. When user input is embedded directly into LDAP filters without proper validation, an attacker can alter the filter logic using operators, wildcards, and special LDAP syntax.
CEH-aligned material states that LDAP injection takes advantage of non-validated input and that an attacker may access information by using an LDAP filter to search the directory database . Another CEH exam reference explains that LDAP injection exploits applications that construct LDAP statements based on user input and pass that input directly into LDAP queries .
Option B. OS Command Injection is incorrect because the scenario does not involve operating system commands.
Option C. SQL Injection is incorrect because the backend lookup is directory-based, not relational database SQL.
Option D. XPath Injection is incorrect because XPath injection targets XML query expressions, not LDAP directory filters.
Therefore, the best answer is A. LDAP Injection.

Controlling access according to need-to-know is the broadest applicable administrative control among the choices. It ensures that employees, applications, and mobile sessions can reach only the corporate information and services required for authorized duties. This reduces the amount of sensitive data exposed if a personal device, application, or user session is compromised.
The principle should be implemented through documented BYOD rules, role-based or attribute-based authorization, application separation, mobile-device or enterprise-mobility management, user awareness, and periodic access reviews. NIST SP 800-124 Revision 2 addresses enterprise management of both organization- issued and personally owned mobile devices, including access control, centralized device management, configuration, and security awareness.
Option B is an important technical measure for the session-timeout problem, and option C directly addresses rooted or jailbroken devices. Neither one establishes the broader ownership boundaries, application restrictions, authorization rules, and acceptable-use expectations described. Data-center protection is even further removed from the device-governance problem. Ideally, a complete BYOD or mobile-device policy would combine need-to-know access with timeouts, device-compliance checks, application controls, containerization, and training. Because that combined policy is not offered, D is the best available administrative answer.

Virtual Patching is a risk-mitigation technique emphasized in CEH v13 Security Operations. It involves deploying compensating controls-such as WAF rules, IPS signatures, or firewall policies-to block exploitation attempts without modifying the vulnerable system.
CEH v13 highlights virtual patching as especially useful when:
* Downtime is unacceptable
* Vendor patches are delayed
* Legacy systems are in use
Monitoring alone does not prevent exploitation, and shutting down systems is often impractical. Virtual patching provides immediate protection while maintaining availability.

MX (Mail Exchange) records in DNS define the mail servers responsible for receiving email for a domain.
Each MX record has a priority value.
Important concept:
A lower number indicates a higher priority.
Email servers attempt delivery to the mail server with the lowest priority first.
For example:
If MX records are:
10 mail1.example.com
20 mail2.example.com
Then mail1 will be tried first. If it fails, mail2 will be used.
So the statement "MX record priority increases as the number increases" is false.
Reference:CEH v13 Study Guide - Module 3: DNS Records # MX Record Priority ExplanationRFC 974 - Mail Routing and the Domain System
======