CEH v13 stresses the importance of passive reconnaissance when the goal is to avoid any interaction with the target's systems. Job postings frequently reveal detailed information such as internal technologies, OS platforms, security tools, IDS brands, virtualization environments, scripting languages, and cloud services.
CEH explicitly notes job ads as one of the richest passive intelligence sources because organizations inadvertently disclose their tech stack, often mentioning required experience with specific network components, databases, protocols, or internal tools. Options B and D involve direct interaction, violating the passive reconnaissance requirement. WHOIS lookups (Option C) provide DNS registrar information but do not reveal internal network details. Job postings, social media recruitment materials, and HR documentation are discussed in CEH as critical OSINT resources used during the footprinting phase to gather actionable intelligence while maintaining complete stealth. Thus, analyzing job postings is the correct method.

The correct answer is Follow TCP Stream. CEH packet analysis and sniffing material explains that Wireshark can reconstruct an application conversation from captured packets belonging to the same TCP session. When investigating HTTP logins, this feature is especially useful because it allows the analyst to view the reassembled request and response content in readable sequence rather than examining individual packets one by one. If credentials are being transmitted in cleartext over HTTP, Follow TCP Stream can reveal them directly within the reconstructed session. Filtering by IP address or by protocol can narrow the visible traffic set, which is helpful, but those functions alone do not reconstruct the full conversation. Monitoring specific ports is also less precise for understanding the actual payload content. CEH guidance emphasizes that once suspicious or relevant traffic is identified, stream reconstruction is a powerful method for analyzing what data was exchanged between client and server. Since Thomas is specifically trying to isolate and read unencrypted HTTP authentication exchanges during login sessions, Follow TCP Stream is the Wireshark feature that best supports both visibility and interpretation of those credentials in context.

In CEH-aligned vulnerability assessment reporting, the Findings section is where the assessor documents what was discovered during scanning and validation in a clear, structured, and actionable way. This portion of the report typically contains the concrete results: identified assets, affected systems, vulnerability details, and evidence that supports each issue. The question states that Nikhil lists the IP addresses of scanned hosts, identifies which machines are affected, and includes tables categorizing vulnerabilities such as outdated software, default credentials, and open ports. These are classic "results" artifacts that belong in Findings because they communicate the observed security weaknesses and where they exist.
The Risk Assessment section generally builds on findings by assigning severity, likelihood, impact, and overall risk ratings, often mapping issues to business consequences and prioritization. While Nikhil may later rate default credentials as critical or open ports as medium depending on exposure, the act of enumerating vulnerabilities and associating them with specific hosts is the findings activity, not risk scoring.
Supporting Information usually contains appendices such as tool configurations, raw scan outputs, methodology references, assumptions, scope boundaries, and glossary items. Although IP lists and tables might appear in an appendix for completeness, the way the prompt describes them, they are being used as the primary categorized presentation of discovered vulnerabilities, which is consistent with the Findings section.
Assessment Overview is typically a high-level summary of scope, objectives, timeline, and approach, not detailed host-by-host vulnerability tables. Therefore, the correct section is Findings.