The vulnerability is unlimited login attempts, which enables automated password guessing.
Implementing CAPTCHA introduces a challenge that prevents automated scripts from repeatedly submitting login attempts, effectively mitigating brute-force attacks without relying on account lockout alone.

Reconnaissance is the correct phase because the scenario explicitly states Sarah starts by gathering publicly available information about employees and infrastructure. In the Cyber Kill Chain, reconnaissance is the first phase where an attacker collects intelligence to understand the target and identify the most effective paths for compromise. In CEH-aligned methodology, this includes open-source intelligence activities such as discovering employee names, roles, emails, technology stack clues, exposed services, and organizational patterns that help craft realistic and convincing attack lures.
The question mentions that Sarah plans to craft a mock phishing email and later deploy a harmless payload.
Those actions map to later kill chain phases: delivery is when the phishing email or malicious link is sent to the target, and exploitation is when a vulnerability is triggered to execute code or gain access. Weaponization is the step where an attacker prepares the malicious artifact, such as packaging an exploit with a payload or preparing a document or link to deliver. However, the key wording is that Sarah "begins" by collecting public information and is asked which phase she should prioritize to simulate the adversary's approach effectively.
That is reconnaissance, because effective phishing and subsequent steps depend on accurate target profiling, believable pretexts, and identifying likely weak points based on what is learned during intelligence gathering.
Therefore, to match the described starting point and the kill chain sequence, the prioritized phase is Reconnaissance.

Sarah actively intercepts and injects packets into a live session, disrupting the legitimate client's connection while taking control of the session. This direct manipulation and takeover of an active communication session is characteristic of active session hijacking.

Comprehensive and Detailed Explanation From CEH v13 Guide Topics:
The correct answer is D. SYN. TCP (Transmission Control Protocol) establishes reliable communication between a client and a server through a process known as the three-way handshake. This mechanism ensures that both parties are ready to communicate and agree on sequence numbers before data transfer begins.
The three steps are:
* SYN (Synchronize): The client initiates the connection by sending a TCP packet with the SYN flag set to the server. This packet contains the client ' s initial sequence number (ISN).
* SYN-ACK (Synchronize-Acknowledge): The server responds with a packet containing both SYN and ACK flags. This acknowledges the client ' s request and provides the server ' s own sequence number.
* ACK (Acknowledge): The client sends an ACK packet back to the server, confirming receipt of the server ' s sequence number. At this point, the TCP connection is established and data transmission can begin.
Option A (RST) is used to reset or terminate a connection. Option B (ACK) is used to acknowledge received packets but does not initiate a connection. Option C (SYN-ACK) is sent by the server as the second step of the handshake, not by the client to begin it.
Understanding the TCP three-way handshake is fundamental in CEH network security topics because many attacks, such as SYN flooding, exploit this connection establishment process. Therefore, the client begins the negotiation by sending a SYN packet.