The Forbidden attack exploits nonce reuse in Galois/Counter Mode, particularly AES-GCM. GCM is an authenticated-encryption mode that provides confidentiality and integrity, but its security requires a unique nonce for every encryption performed under the same key. Repeating a nonce causes the counter-mode keystream to be reused and creates algebraic relationships between authentication tags. With suitable ciphertext-tag pairs, an attacker may recover information about the authentication process and generate forged data that the receiver accepts as valid.
That outcome precisely matches the scenario: encrypted contents initially remain unreadable, cryptographic values expected to be unique recur across sessions, and the tester ultimately constructs an authenticated forgery. CRIME instead exploits compression-related information leakage in TLS. MITM describes an attacker's network position but does not by itself explain the nonce-reuse forgery. MITB involves malicious code operating within a user's browser.
The proper controls include generating nonces according to the authenticated-encryption specification, preventing counter resets after restarts, avoiding key-and-nonce reuse across distributed systems, monitoring nonce-generation failures, and rotating affected keys. Research into practical GCM forgery attacks found that repeated nonces can fully break connection authenticity. Practical Forgery Attacks on GCM in TLS

Brute-force attack when an attacker uses a set of predefined values to attack a target and analyze the response until he succeeds. Success depends on the set of predefined values. It will take more time if it is larger, but there is a better probability of success. In a traditional brute-force attack, the passcode or password is incrementally increased by one letter/number each time until the right passcode/password is found.

Webhooks are one of a few ways internet applications will communicate with one another.
It allows you to send real-time data from one application to another whenever a given event happens.
For example, let's say you've created an application using the Foursquare API that tracks when people check into your restaurant. You ideally wish to be able to greet customers by name and provide a complimentary drink when they check in.
What a webhook will is notify you any time someone checks in, therefore you'd be able to run any processes that you simply had in your application once this event is triggered.
The data is then sent over the web from the application wherever the event originally occurred, to the receiving application that handles the data.

Here's a visual representation of what that looks like:
A webhook url is provided by the receiving application, and acts as a phone number that the other application will call once an event happens.
Only it's more complicated than a phone number, because data about the event is shipped to the webhook url in either JSON or XML format. this is known as the "payload." Here's an example of what a webhook url looks like with the payload it's carrying:

What are Webhooks? Webhooks are user-defined HTTP callback or push APIs that are raised based on events triggered, such as comment received on a post and pushing code to the registry. A webhook allows an application to update other applications with the latest information. Once invoked, it supplies data to the other applications, which means that users instantly receive real-time information. Webhooks are sometimes called
"Reverse APIs" as they provide what is required for API specification, and the developer should create an API to use a webhook. A webhook is an API concept that is also used to send text messages and notifications to mobile numbers or email addresses from an application when a specific event is triggered. For instance, if you search for something in the online store and the required item is out of stock, you click on the "Notify me" bar to get an alert from the application when that item is available for purchase. These notifications from the applications are usually sent through webhooks.

According to the CEH Network Scanning module, a SYN scan works by analyzing TCP handshake responses.
SYN # SYN/ACK = Port OPEN
SYN # RST = Port CLOSED
No response = FILTERED
Option A is correct.
CEH emphasizes SYN scanning as stealthy because the handshake is never completed.