CEH v13 explains that Side-Channel Attacks exploit physical characteristics of cryptographic devices-such as power consumption, timing variations, electromagnetic leakage, or acoustic emissions-to infer confidential data like encryption keys. These attacks do not break the cryptographic algorithm itself but instead analyze unintended signals produced during computation. The scenario describes a classic power analysis and timing analysis attack, where the attacker monitors fluctuations during encryption operations on a smart card. CEH details how Differential Power Analysis (DPA) and Simple Power Analysis (SPA) allow attackers to extract secret keys by statistically correlating measured power traces to cryptographic operations.
This type of attack is extremely dangerous because it bypasses mathematical strength and targets hardware implementation flaws. Options A, C, and D do not relate to side-channel exploitation. CEH specifically categorizes this method as observing hardware emissions to deduce secrets, making Option B the most accurate match.

A botnet is a collection of compromised devices controlled as a coordinated group. Here, the hidden application components have converted geographically dispersed Android devices into bots that generate synchronized traffic against one destination. The combined traffic volume produces a distributed denial-of- service attack even if each individual device contributes only a modest number of requests.
Options A, B, and C concern infection or malware-delivery mechanisms. Installing a repackaged game from an unofficial source may explain how the devices were compromised, but the question asks how they were being leveraged after compromise. Their aligned timing, common destination, background execution, and large geographic distribution establish botnet-controlled DDoS activity.
Mobile botnets commonly use a command-and-control infrastructure to assign targets, update attack parameters, and coordinate HTTP, TCP, or UDP floods. Recommended defenses include restricting sideloading, validating application signatures, monitoring unusual background network activity, applying mobile threat defense, filtering malicious command-and-control domains, and coordinating upstream DDoS mitigation. Cloudflare's analysis of the WireX botnet documented Android devices running malicious applications that were specifically designed to generate coordinated DDoS traffic. Cloudflare WireX analysis

Behavioral analytics establishes a baseline of normal system communication patterns and highlights deviations in external interactions, enabling rapid identification of suspicious data transfers or command-and-control activity while directly mitigating risks from unsanctioned exchanges.

Rules of engagement define the boundaries and conditions of the penetration test, including authorized testing methods, permitted targets, testing schedule, communication procedures, and liability limitations. This document ensures both the client and penetration tester clearly understand what activities are allowed during the assessment.

The system is able to analyze packet contents beyond standard headers and detect malicious intent even when packets are fragmented. This capability is characteristic of deep packet inspection, which reassembles and inspects the full payload to identify threats that attempt to evade detection through fragmentation.