The correct answer is C. Rogue DHCP Server Attack because the observed impact is that client machines on the LAN begin receiving incorrect network configuration parameters-specifically altered default gateways and DNS server addresses-shortly after Priya connects her laptop. In CEH-aligned LAN attack concepts, a rogue DHCP attack occurs when an attacker introduces an unauthorized DHCP service that responds to DHCP discovery requests faster than the legitimate DHCP server. As a result, endpoints accept the attacker- provided lease options, which can redirect traffic through attacker-controlled infrastructure.
The redirection to "fake login portals hosted on Priya's machine" is consistent with malicious DHCP option abuse. By supplying a rogue DNS server (or altering DNS-related options), the attacker can resolve internal hostnames (like intranet URLs) to the attacker's IP, enabling credential harvesting via spoofed portals. By supplying a rogue default gateway, the attacker can position themselves as the network path for victim traffic, enabling man-in-the-middle style interception, traffic manipulation, and session hijacking. The mention of
"temporary IP conflicts" further supports rogue DHCP behavior, because an attacker DHCP server can hand out addresses that overlap with the legitimate scope or cause duplicate assignments, producing conflicts and instability.
Why the other options are less accurate: DHCP starvation involves exhausting the legitimate DHCP pool by flooding requests with spoofed MAC addresses, often as a precursor to then standing up a rogue DHCP server. The scenario emphasizes that clients are actively receiving malicious settings (gateway/DNS), which is the hallmark of the rogue server stage rather than starvation alone. DNS cache poisoning targets DNS resolvers/caches and does not by itself cause clients to suddenly obtain new gateway/DNS configurations.
Packet sniffing is passive and does not explain clients being reconfigured or redirected.
Therefore, Priya most likely performed a rogue DHCP server attack to reconfigure endpoints and redirect users to phishing portals.

Simple Network Management Protocol enumeration queries managed devices for information stored in their Management Information Bases. SNMP agents commonly operate on UDP port 161 and expose structured objects identified by object identifiers. Depending on the available MIBs and permissions, a query may disclose system descriptions, interfaces, IP addresses, routing tables, traffic counters, device names, contact information, and network relationships.
The unauthenticated response described in the question may indicate an insecure SNMPv1 or SNMPv2c configuration using a default, weak, or exposed community string. Those versions use community strings as basic access controls and do not provide the strong authentication and encryption available in SNMPv3.
NTP enumeration concerns time synchronization services and may disclose peers or configuration information. SMTP enumeration generally identifies mail users, relays, and server capabilities. LDAP enumeration retrieves directory objects such as users, groups, organizational units, and policies. Only SNMP is primarily designed to expose the network-management statistics and routing information specified in the scenario.
Defenses include adopting SNMPv3 authentication and privacy, removing default community strings, restricting management access to approved hosts, applying ACLs, segmenting management networks, and monitoring unexpected queries. RFC 6632 explains that SNMP uses managers, agents, and MIB objects, with agents on devices such as routers and servers providing information about local resources and activity. RFC
6632

The issue occurs because once the device is unlocked, the business application provides direct access to sensitive data without requiring additional authentication. Implementing application- level passwords (or re-authentication controls inside the app) ensures that even if the device is unlocked, unauthorized users cannot access corporate data without separate verification.

Per CEH v13 Official Courseware - Module 01: Introduction to Ethical Hacking, ethical hackers and penetration testers are bound by legal and professional standards. When illegal activities such as human trafficking are discovered:
The ethical response is to cease operations and report the findings to the appropriate legal authorities.
Continuing work, ignoring the findings, or confronting the client personally is both unprofessional and may potentially expose the tester to legal liability.
Reference: CEH v13 eCourseware - Module 01: Introduction to Ethical Hacking # "Legal Implications and Reporting Requirements" CEH v13 Code of Conduct for Certified Ethical Hackers