Comprehensive and Detailed Explanation From CEH v13 Guide Topics:
The correct answer is A. HTTP cookies often store session identifiers or authentication-related tokens after a user logs in to a website. If these cookies remain on the system after the browser closes, an attacker with access to the device, malware, or stolen browser data may reuse those cookies to impersonate the authenticated user. This is commonly associated with session hijacking, cookie theft, or unauthorized reuse of trusted browser sessions.
Automatically deleting cookies when the browser terminates reduces the chance that an attacker can recover valid session cookies later. Option B relates more to privacy tracking and browsing history analysis, not the main authentication risk. Option C refers to SQL database compromise, which cookie deletion does not directly prevent. Option D refers to locally stored passwords, which are separate from HTTP cookies.
Therefore, the policy is primarily intended to mitigate unauthorized access to trusted websites through stolen authentication/session data.

This compromise is best explained by ADB exploitation via TCP 5555. CEH mobile testing material highlights ADB, or Android Debug Bridge, as a remote device communication mechanism commonly used for debugging, command execution, package management, and interaction with device internals. The scenario states that the phones were not attached by USB but were reachable over the wireless network on a well- known remote debugging port, and the attacker could capture screenshots, enumerate apps, forward ports, and install packages. Those are classic ADB-enabled actions. Device Administration API abuse involves misuse of Android administrative capabilities, but the question specifically points to debugging connectivity and command-driven device control rather than administrative policy abuse. Android rooting would imply privilege escalation on the device itself, yet the access method described is remote and operational through the debug interface. FRP bypass concerns factory reset protection and is unrelated to ongoing remote management commands. CEH mobile security guidance consistently warns that exposed debugging interfaces significantly expand attack surface because they can provide powerful control channels if enabled on production devices and exposed over the network.

The routine operator successfully performs functions reserved for a higher-privilege role. This demonstrates missing or improperly enforced authorization. Authentication established who Lena was, but the HMI failed to restrict what that identity was permitted to change. The broad answer "Lack of Authorization and Authentication" is therefore the only option that encompasses the access-control failure described.
Code injection would require untrusted input to be interpreted as executable code or commands. Memory corruption involves invalid memory access, such as an overflow or use-after-free, and is not evidenced by ordinary navigation through HMI controls. Credential management concerns how passwords, tokens, or keys are created, stored, rotated, and revoked; no stolen or mishandled credential is required because the routine operator account itself has excessive authority.
The recording's Memory Corruption selection conflicts with the scenario. Option D is technically correct. In SCADA environments, authorization failures can have physical consequences because HMI actions may directly change process values or disable safety functions. Controls should include role-based access, least privilege, reauthentication for safety-critical operations, independent safety interlocks, command logging, dual approval for exceptional changes, and testing of server-side authorization. OWASP defines privilege escalation as obtaining resources or functions beyond those authorized to the user's existing role. OWASP privilege-escalation testing

The issue involves rogue or unauthorized DHCP activity causing incorrect IP assignments.
Enabling DHCP snooping on a specific VLAN filters DHCP messages and prevents unauthorized DHCP servers from assigning IP addresses, resolving the connectivity problem.

LAN Manager (LM) hashes are legacy password hashing methods used in older Windows systems (including Windows 2000 for backward compatibility). LM hashing works by:
* Converting the password to uppercase.
* Padding or truncating it to 14 characters.
* Splitting it into two 7-character halves.
* Using each half as a DES key to encrypt a known constant ("KGS!@#$%").
Therefore, LM hashing uses the DES (Data Encryption Standard) algorithm.
From CEH v13 Official Courseware:
* Module 6: Malware Threats # Password Storage and LM Hash Structure
Reference:CEH v13 Study Guide - Module 6: Windows Password StorageMicrosoft Security Documentation
- LM/NTLM Authentication