When a switch's ARP cache is flooded using a tool like Macof (from the Dsniff suite), it overwhelms the device's MAC address table, which stores port-to-MAC mappings.
If the table overflows:
The switch can no longer associate MAC addresses with specific ports.
It fails open and begins forwarding frames out all ports - just like a hub.
This degrades the switch's functionality and allows attackers to sniff traffic on segments that should otherwise be isolated.
From CEH v13 Courseware:
Module 8: Sniffing # Switch-based Attacks
Reference:CEH v13 Study Guide - Module 8: ARP Flooding and MAC Table PoisoningTool Reference:
Macof (Dsniff Suite)
======

The host-based vulnerability assessment (VA) resolution arose from the auditors' got to periodically review systems. Arising before the net becoming common, these tools typically take an "administrator's eye" read of the setting by evaluating all of the knowledge that an administrator has at his or her disposal.
UsesHost VA tools verify system configuration, user directories, file systems, registry settings, and all forms of other info on a number to gain information about it. Then, it evaluates the chance of compromise. it should also live compliance to a predefined company policy so as to satisfy an annual audit. With administrator access, the scans area unit less possible to disrupt traditional operations since the computer code has the access it has to see into the complete configuration of the system.
What it Measures Host
VA tools will examine the native configuration tables and registries to spot not solely apparent vulnerabilities, however additionally "dormant" vulnerabilities - those weak or misconfigured systems and settings which will be exploited when an initial entry into the setting. Host VA solutions will assess the safety settings of a user account table; the access management lists related to sensitive files or data; and specific levels of trust applied to other systems. The host VA resolution will a lot of accurately verify the extent of the danger by determinant however way any specific exploit could also be ready to get.
Types of Vulnerability Assessment Host-based assessments are a type of security check that involve conducting a configuration-level check to identify system configurations, user directories, file systems, registry settings, and other parameters to evaluate the possibility of compromise. Host-based scanners assess systems to identify vulnerabilities such as native configuration tables, incorrect registry or file permissions, and software configuration errors. (P.528/512)

The preparation phase of incident handling is the proactive phase where organizations:
Develop and define incident response policies and rules
Assign roles and responsibilities
Design backup and disaster recovery strategies
Train staff and test response plans via drills or tabletop exercises
This phase ensures that the organization is ready to respond effectively when an incident occurs.
Reference - CEH v13 Official Study Guide:
Module 18: Incident Response and Computer Forensics
Quote:
"In the preparation phase, organizations define rules, set up an incident response team, perform training, and establish and test incident handling procedures." Incorrect Options:
B). Containment is about stopping the spread of an active incident
C). Identification is when the incident is first detected
D). Recovery is for restoring systems post-incident
=