This scenario describes SNMP Enumeration, a technique covered under CEH v13 Reconnaissance and Enumeration. Simple Network Management Protocol (SNMP) operates over UDP port 161 and is widely used for monitoring and managing network devices. A common and critical weakness arises when organizations leave default or publicly known community strings such as public (read-only) or private (read-write) unchanged.
CEH v13 explains that when an SNMP agent is configured with default community strings, it allows unauthenticated or weakly authenticated queries, enabling attackers to retrieve extensive system information.
This includes installed software, running processes, system descriptions, network interfaces, and routing tables. The ability to perform bulk data queries using SNMP GET and WALK commands makes enumeration highly effective and fast.
Option B correctly identifies the root cause: misconfigured SNMP agents permitting anonymous or default access. The other options are incorrect because SNMP does not rely on FTP, registry access, or trap logging for enumeration. Traps (Option D) are unsolicited notifications sent to managers and are not used for querying system details.
CEH v13 strongly recommends disabling SNMP when not required, changing default community strings, restricting SNMP access via ACLs, and using SNMPv3, which supports authentication and encryption.
Therefore, Option B is the correct and CEH-aligned answer.

Side-channel attacks, as explained in CEH v13 OT and SCADA Security, extract sensitive information by observing physical characteristics of a system rather than exploiting software flaws directly. These characteristics may include power consumption, electromagnetic emissions, timing variations, or thermal output.
In SCADA environments, side-channel attacks are especially dangerous because they bypass traditional network defenses. The most reliable way to confirm such an attack is by analyzing hardware-level anomalies-such as unexpected power usage spikes or irregular signal emissions during normal device operations.
Option B directly aligns with CEH v13 guidance.
Options A, C, and D focus on software, cryptography, or network behavior, which are not primary indicators of side-channel exploitation.
Therefore, Option B is correct.

The correct answer is D. Application Keylogger because the scenario describes keystroke capture from desktop applications on a Windows workstation without installing kernel drivers and without requiring physical access or browser-level script injection. In CEH-aligned keylogger classifications, an application (user-mode) keylogger operates at the application layer by using user-space techniques such as hooking common Windows APIs (for example, keyboard input functions and message-handling routines) to intercept keystrokes as they are processed by applications. This enables logging of credentials typed into local programs, draft emails written in desktop clients, and sensitive text entered into business tools-exactly the outcome Tyler observed.
The question provides two strong eliminators. First, it states no kernel drivers were installed, which rules out kernel keyloggers that capture input at the kernel level (often requiring driver installation and deeper OS integration). Second, it states the attack did not require browser injection, which rules out a JavaScript keylogger (typically implemented by injecting script into a web page/application to capture form inputs within a browser session). It also explicitly notes that there was no physical device access, which rules out a hardware keylogger (a physical device placed between keyboard and computer or embedded in a keyboard) that requires in-person installation.
Application keyloggers are frequently used in post-exploitation because they can be deployed quickly with standard user-level privileges (though higher privileges may expand coverage), can target a broad range of applications, and can run covertly. From a defense perspective, monitoring for suspicious API hooking behavior, unusual process injection, abnormal input-capture patterns, and endpoint controls that detect credential access techniques are common countermeasures.
Therefore, given the constraints and the observed logging of desktop application input, the most likely keylogger type is an application keylogger.

DNS poisoning (also known as DNS cache poisoning) occurs when a malicious actor injects false DNS data into a DNS resolver's cache. The poisoned entry will persist for the duration of its TTL (Time To Live), which is defined in the DNS SOA (Start of Authority) record.
The SOA record contains several fields including:
Serial number
Refresh
Retry
Expire
Minimum TTL
The Minimum TTL value in the SOA record determines how long a DNS resolver should cache the DNS data
- including any potentially poisoned data.
From CEH v13 Official Courseware:
Module 3: Scanning Networks
Topic: DNS Enumeration & Poisoning
CEH v13 Study Guide states:
"The SOA record includes a minimum TTL value that dictates how long DNS information should be cached by other DNS servers. If DNS cache poisoning occurs, the false information will persist until the TTL expires." Incorrect Options:
A: MX (Mail Exchange) defines mail servers, not TTLs.
C: NS (Name Server) specifies authoritative servers, not caching durations.
D: TIMEOUT is not a valid DNS resource record.
Reference:CEH v13 Study Guide - Module 3: DNS Records # SOA Record Structure and TTLRFC 1035 - Domain Names: Implementation and Specification (Section 3.3.13)
======

Disabling Android Debug Bridge except in tightly controlled and explicitly authorized scenarios removes a powerful interface that attackers can abuse for remote command execution, directly mitigating the attack vector used to compromise the mobile banking environment.