CEH v13 emphasizes that advanced injection attacks often evade input validation through encoding and obfuscation. A Web Application Firewall (WAF) with evasion detection can analyze request patterns, payload behavior, and anomalies in real time.
Code reviews are important but reactive. SIEM correlates logs after attacks. 2FA does not prevent injection.
Thus, Option B provides the most effective immediate protection.

The correct answer is D. ntpq -p [host].
The scenario requires querying the active NTP service to review its current associations and operational state.
The ntpq utility is designed to query and monitor the NTP daemon. CEH-aligned NTP enumeration material states that ntpq is a command-line utility used to query the NTP server, monitor ntpd operations, and determine performance. It also states that the -p option prints a list of peers known to the server and summarizes their state .
Option A. ntptrace is incorrect because ntptrace follows the chain of NTP servers back to the primary time source. The scenario specifically says Kevin is not tracing the upstream hierarchy.
Option B. ntpq [-inp] [-c command] [host] [...] is a general syntax form for ntpq, but the most precise command for viewing peer associations and state is ntpq -p [host].
Option C. ntpdc is incorrect because although ntpdc can query ntpd, it is more associated with querying daemon state and requesting state changes. The question asks for the command to review current associations and operational status, which is most directly matched by ntpq -p.
Option D. ntpq -p [host] is correct because it directly queries the NTP service and prints peer association
/status information.
Therefore, the best answer is D. ntpq -p [host].

This scenario describes steganographic sniffing, a highly sophisticated technique covered in CEH v13 Network Sniffing and Steganography. By embedding sensitive data inside legitimate image files-such as CT scans-attackers can intercept or exfiltrate patient information while avoiding detection.
Option D represents a steganography-based covert channel, which is extremely difficult to identify because:
* The file appears legitimate
* Standard encryption and IDS tools do not flag it
* Medical images naturally contain large data volumes
Options A and B involve malware, which is more detectable. Option C involves text-based covert channels, which are easier to analyze than binary image embedding.
CEH v13 identifies steganography as one of the hardest data-hiding techniques to detect, making Option D correct.

The method described-sending TCP packets with no flags set-is a NULL scan. In TCP header terminology, a NULL packet has all control flags cleared (no SYN, ACK, FIN, RST, PSH, URG). The scanner then interprets the target's response behavior to infer port state. Traditionally, for many TCP/IP stacks, a closed port responds with RST, while an open port may respond with no reply (silence) because the packet does not correspond to any valid state in the TCP state machine. This behavior can vary by OS and filtering devices, but the defining characteristic is the "no flags" probe.
The scenario also highlights stealth: compared to a TCP connect scan, which completes a full three-way handshake and is easily logged, NULL scans can be less conspicuous because they avoid a normal connection setup. Some intrusion detection systems focus heavily on repeated SYN handshakes or completed connections; unusual flag scans may slip through weak detection, though modern IDS/IPS can still detect them.
Why the other options are incorrect:
TCP Connect Scan (A) uses the operating system's connect() call to establish a full TCP connection; it is not a "no flags" technique and is generally noisier.
FIN Scan (B) sends packets with the FIN flag set; it is a different "stealth" scan type, but not "no flags." ACK Scan (D) sends packets with the ACK flag set and is typically used to map firewall rules (filtered vs unfiltered), not to determine open vs closed ports in the same way, and again it is not "no flags." Therefore, the scanning method is C. NULL Scan.