D: The scenario describes LDAP enumeration over port 389 with anonymous bind allowed. In CEH coverage, LDAP is a directory access protocol commonly used by enterprise directory services, including Active Directory via LDAP interfaces. When anonymous bind is enabled or misconfigured access controls allow broad read permissions, an attacker can query directory objects without valid credentials and extract valuable reconnaissance data such as user accounts, group membership, organizational units, and directory structure. That is exactly what John is doing: connecting to LDAP, performing searches for user objects, and retrieving organizational information and group relationships.
The Kali utility that fits this behavior is ldapsearch. It is a standard command-line LDAP client used to bind to an LDAP server and execute directory queries using LDAP filters and a base DN. With anonymous bind, ldapsearch can run queries like searching for objectClass=user and requesting attributes such as cn, sAMAccountName, memberOf, and organizational details. CEH materials emphasize LDAP enumeration as a high-value recon step because it helps map the domain, identify privileged groups, and select targets for later attacks, especially when directory permissions are overly permissive.The other options do not match LDAP directory interaction. smtp-user-enum targets SMTP for user enumeration through mail server responses. nbtstat -A queries NetBIOS name tables, typically for host and share-related information, not LDAP directory trees. dig AXFR attempts DNS zone transfers, which is DNS reconnaissance, not directory service enumeration. Therefore, ldapsearch is the most appropriate tool for this anonymous LDAP enumeration on port 389.

The Certified Ethical Hacker (CEH) Cloud Computing module emphasizes that serverless environments rely heavily on granular permission models. Attacks involving compromised APIs often succeed because functions are granted excessive privileges.
Option D is correct because enforcing function-level permissions and the principle of least privilege directly limits what a compromised function can execute. CEH documentation states this is the primary defense against serverless abuse.
Option A is beneficial but reactive.
Option B focuses on SaaS governance rather than FaaS execution control.
Option C provides visibility but does not directly prevent privilege misuse.
CEH highlights identity and access management (IAM) as critical in serverless security.

ARP spoofing-based session hijacking is identified in CEH v13 Web Application and Network Attacks as one of the most stealthy and difficult-to-detect session compromise techniques, especially within internal or VPN-connected networks.
In ARP spoofing, attackers poison ARP caches to position themselves as a man-in-the-middle (MitM). Once in place, they can silently intercept, modify, or replay session data-even when encryption is used-by redirecting traffic transparently between endpoints.
Option A (sidejacking) is mitigated by HTTPS. Option C (session guessing) is noisy and detectable. Option D (cookie poisoning) relies on weak validation and is easier to detect via integrity checks.
CEH v13 highlights ARP spoofing as particularly dangerous because:
* It exploits trusted local network behavior
* It does not require breaking encryption directly
* It is often invisible to users and applications
Therefore, Option B is the most challenging to detect and mitigate and is the correct answer.

Ransomware encrypts a victim's files and demands payment in exchange for the decryption key, preventing access to data until the ransom is paid or recovery measures are applied.