A Network Intrusion Detection System primarily observes network traffic and alerts administrators when suspicious activity is detected. Unlike an IPS operating inline, a traditional NIDS typically does not block traffic automatically. Detection accuracy depends on signatures, behavioral analysis, and proper tuning to minimize false positives and negatives.

The environment includes fully functional enterprise systems such as servers, databases, and identity services that allow attackers to interact, escalate privileges, move laterally, and perform realistic post-exploitation activity. This level of realism and engagement is characteristic of a high- interaction honeypot, which emulates real production environments to capture detailed attacker behavior.

CEH v13 explains that cryptographic consistency is essential for secure session management. Variable token lengths can leak information about encryption methods, key sizes, or user privilege levels, making sessions vulnerable to cryptanalysis or targeted attacks.
The most effective mitigation is implementing uniform encryption strength across all roles, ensuring consistent key sizes, algorithms, and token formats. While MFA improves authentication and key rotation improves lifecycle management, neither directly resolves cryptographic inconsistency.
CEH v13 stresses that encryption should be role-agnostic and standardized. Therefore, Option C is correct.

Comprehensive Explanation from CEH v13 Courseware:
CEH v13 underscores that modern multi-vector DDoS attacks-particularly SYN floods combined with Layer
7 HTTP floods-cannot be effectively mitigated by traditional firewalls, IPS devices, or local traffic filters.
These systems become overwhelmed or risk blocking legitimate clients. CEH emphasizes the use of cloud- based DDoS mitigation platforms that provide traffic scrubbing, distributed filtering, rate shaping, and automatic scaling to absorb massive volumes of malicious traffic. Such services differentiate legitimate versus malicious traffic using global intelligence, behavioral analysis, and multi-layer protection strategies.
Increasing bandwidth or blocking broad traffic categories is ineffective and harmful to users. An IPS cannot scale to handle volumetric attacks. Only cloud scrubbing solutions (e.g., Cloudflare, Akamai, AWS Shield Advanced) meet CEH's recommended defenses for high-volume distributed attacks. These services ensure continuous availability and minimize collateral damage by filtering traffic upstream before it reaches the organization's infrastructure.