The correct answer is B because an ACK scan is mainly used to determine firewall filtering rules, not to identify services or directly confirm open and closed ports. In CEH scanning methodology, an ACK scan sends TCP packets with only the ACK flag set and analyzes how the target or intermediate firewall responds.
CEH material states that ACK probe scanning helps identify filtering systems: if an RST packet is returned, packets to that port are not being filtered; if there is no response, a stateful firewall is likely filtering the packet. Another CEH exam-focused reference similarly notes that ACK probes check filtering at the remote end; no response indicates a stateful firewall between the attacker and host, while an RST response indicates there is not. Services are better identified through version detection or banner grabbing, while open ports are commonly identified with SYN or TCP connect scans. Therefore, the best CEH answer is firewall rules.

Bluesnarfing is a Bluetooth attack described in CEH v13 Wireless Network Hacking, where attackers exploit misconfigured Bluetooth devices to access sensitive data such as contacts, messages, and files-often without user interaction.
One of the most critical enablers of Bluesnarfing is Bluetooth discoverable mode. When devices are discoverable, attackers can easily identify them and attempt unauthorized connections or exploit vulnerabilities in Bluetooth services.
Disabling discoverable mode significantly reduces the attack surface by preventing unauthorized devices from locating Bluetooth-enabled systems. CEH v13 explicitly recommends setting Bluetooth devices to non- discoverable mode when not pairing.
While firmware updates (Option B) are important, they do not immediately prevent discoverability-based attacks. Stronger PINs (Option C) help against pairing attacks but do not stop unauthorized queries. Network- level encryption (Option D) is inherent in Bluetooth protocols and does not mitigate discovery abuse.
CEH v13 highlights that visibility control is the most immediate and effective defense against Bluesnarfing.
Therefore, Option A is the correct answer.

Manipulating input parameters to make the application retrieve and display files from local directories without authorization is characteristic of a Local File Inclusion (LFI) vulnerability.

Tailgating, as defined in CEH v13 Social Engineering, is a physical social engineering attack where an unauthorized individual gains access by following an authorized person into a restricted area.
The attacker exploits human courtesy rather than technical vulnerabilities. Options B, C, and D describe phishing, pretexting, and baiting respectively.
Thus, option A is the correct representation of tailgating.