The correct answer is C. Container orchestration because the described features-automated deployment, scaling, service discovery, and workload management across multiple nodes-are the defining functions of a container orchestration platform, and Kubernetes is the most widely used orchestration system for containers.
In CEH-aligned cloud and container security discussions, orchestration refers to the automated coordination of containerized workloads so that applications remain available, scalable, and manageable without administrators manually placing or maintaining each container instance.
In Kubernetes, orchestration is achieved through the control plane and a set of components that continuously maintain the desired state of applications. For example, scheduling places pods onto nodes based on resource availability and constraints; controllers ensure that the correct number of replicas are running; services and DNS enable stable naming and service discovery; and autoscaling mechanisms adjust capacity according to demand. These combined behaviors allow the platform to keep critical services operating "smoothly" even as nodes change, workloads shift, or failures occur.
Why the other options are not the best match: Self-healing is a specific benefit of orchestration (Kubernetes restarts failed containers, reschedules pods, and replaces unhealthy instances), but it does not fully encompass the broader set of capabilities listed, such as deployment automation, scaling, and service discovery. Kube- controller-manager is a particular Kubernetes control-plane component that runs controller processes; it contributes to orchestration internally, but the question asks for the overarching capability responsible for the set of functions, which is container orchestration as a whole. Container vulnerabilities is not a Kubernetes capability; it is a security risk category (e.g., vulnerable images, misconfigurations, runtime exploits).
Therefore, the capability primarily responsible for automated deployment, scaling, service discovery, and multi-node workload management in Kubernetes is container orchestration.

A NULL scan is a type of TCP scan where no TCP flags are set in the packet. This unconventional packet is used to evade firewalls and intrusion detection systems and to determine the state of a port based on the response.
Behavior:
Open port # No response
Closed port # RST (Reset)
From CEH v13 Courseware:
Module 3: Scanning Networks
Topic: TCP Flag Scanning Methods
CEH v13 Study Guide states:
"A NULL scan sends a TCP packet with all flags turned off. The system's response (or lack thereof) allows the attacker to infer whether a port is open or closed, especially on UNIX-based systems." Incorrect Options:
B: Vague and inaccurate
C: Refers to Xmas scan (URG, PSH, FIN)
D/E: Irrelevant to TCP flags
Reference:CEH v13 Study Guide - Module 3: Scanning Networks # TCP NULL ScansRFC 793 - TCP Protocol Behavior
======

The protocol that you would recommend to the team to achieve the secure exchange of the symmetric key is the Diffie-Hellman protocol. The Diffie-Hellman protocol is a key agreement protocol that allows two or more parties to establish a shared secret key over an unsecured communication channel, without having to exchange the key itself. The Diffie-Hellman protocol works as follows12:
* The parties agree on a large prime number p and a generator g, which are public parameters that can be known by anyone.
* Each party chooses a random private number a or b, which are kept secret from anyone else.
* Each party computes a public value A or B, by raising g to the power of a or b modulo p, i.e., A = g^a mod p and B = g^b mod p.
* Each party sends their public value A or B to the other party over the unsecured channel.
* Each party computes the shared secret key K, by raising the received public value to the power of their own private number modulo p, i.e., K = A^b mod p = B^a mod p.
* The parties can now use the shared secret key K to encrypt and decrypt the data using a symmetric key encryption algorithm, such as AES or 3DES.
The Diffie-Hellman protocol can ensure the secure exchange of the symmetric key because it relies on the mathematical difficulty of computing discrete logarithms, which means that it is hard to find the private numbers a or b given the public values A or B, g, and p. Therefore, an attacker who intercepts the public values A or B cannot easily compute the shared secret key K, and thus cannot decrypt the data encrypted with K12.
The other options are not as appropriate as option B for the following reasons:
* A. Implementing SSL certificates on your company's web servers: This option is not relevant because SSL certificates are not used to exchange symmetric keys, but to authenticate the identity of the web servers and to establish a secure connection using public key encryption. SSL certificates are digital certificates that contain the public key and the identity information of the web server, and are issued and signed by a trusted certificate authority (CA). When a client connects to a web server, the web server sends its SSL certificate to the client, who verifies it with the CA. If the verification is successful, the client and the web server use the public key in the certificate to exchange a symmetric key, which is then used to encrypt and decrypt the data. However, this option does not address the scenario of transmitting data over an unsecured communication channel, which may not involve web servers or SSL certificates34.
* C. Switching all data transmission to the HTTPS protocol: This option is not sufficient because HTTPS protocol is not a protocol for exchanging symmetric keys, but a protocol for securing web traffic using SSL or TLS encryption. HTTPS protocol is a combination of HTTP protocol and SSL or TLS protocol, which means that it uses HTTP for the application layer communication and SSL or TLS for the transport layer encryption. When a client requests a web page from a web server using HTTPS protocol, the client and the web server establish a secure connection using SSL or TLS protocol, which involves the exchange of SSL certificates and a symmetric key, as explained in option A. Then, the client and the web server use the symmetric key to encrypt and decrypt the HTTP data. However, this option does not address the scenario of transmitting data over an unsecured communication channel, which may not involve web servers or HTTPS protocol5 .
* D. Utilizing SSH for secure remote logins to the servers: This option is not applicable because SSH is not a protocol for exchanging symmetric keys, but a protocol for securing remote access to servers using public key authentication and encryption. SSH is a protocol that allows a client to securely connect to a server and execute commands or transfer files over an encrypted channel. SSH uses public key cryptography to authenticate the identity of the server and the client, and to exchange a symmetric key, which is then used to encrypt and decrypt the data. However, this option does not address the scenario of transmitting data over an unsecured communication channel, which may not involve remote logins or SSH protocol .
References:
1: Diffie-Hellman key exchange - Wikipedia
2: Diffie-Hellman Key Exchange - an overview | ScienceDirect Topics
3: SSL Certificate - an overview | ScienceDirect Topics
4: What is an SSL Certificate? | DigiCert.com
5: HTTPS - Wikipedia
6: What is HTTPS? | Cloudflare
7: SSH (Secure Shell) - Wikipedia
8: What is SSH? | SSH.COM

Priya's machine assigns unauthorized IP configuration, including gateways and DNS servers, causing traffic redirection and fake login portals. This behavior is characteristic of a rogue DHCP server attack, where an attacker provides malicious network settings to clients.

Researching the identified vulnerability to understand its impact and determine whether a reliable public exploit exists allows the tester to validate exploitability and assess real-world risk before attempting any exploitation.