A Wireless Intrusion Prevention System (WIPS) is a network device that monitors the radio spectrum for the presence of unauthorized access points (intrusion detection), and can automatically take countermeasures (intrusion prevention).

The best security practice in this scenario is to implement IEEE 802.1X. This is a port-based Network Access Control (NAC) protocol that provides authentication for devices before they are allowed to transmit traffic on the network. It ensures that only authorized users/devices can access the network through physical (wired) or wireless connections.
CEH v13 Official Courseware states:
"802.1X provides a framework for authenticating and authorizing devices attached to a LAN port, enforcing port-based network access control. It helps prevent unauthorized users from connecting to an internal network, particularly in environments where physical access to network jacks cannot be fully controlled." Incorrect Options:
* A. Disabling unused ports is a good practice, but students may still use open ports intended for authorized personnel. It does not scale or provide identity-based access control.
* B. Separating users in VLANs helps in segmentation, but it does not prevent unauthorized physical access to ports.
* D. Asking students to use wireless is administrative, not a technical enforcement measure.
Reference - CEH v13 Guide:
Module 04: Enumeration
Topic: Network Access Control (802.1X) and Switch Port Security

Vulnerability scanning software is a tool that can help security analysts identify and prioritize known vulnerabilities in their systems and applications. However, it is not a perfect solution and has some limitations that need to be considered. One of the most critical limitations is that vulnerability scanning software is not immune to software engineering flaws that might lead to serious vulnerabilities being missed. This means that the software itself might have bugs, errors, or oversights that could affect its accuracy, reliability, or performance. For example, the software might:
Fail to detect some vulnerabilities due to incomplete or outdated databases, incorrect signatures, or insufficient coverage of the target system or application.
Produce false positives or false negatives due to misinterpretation of the scan results, incorrect configuration, or lack of context or validation.
Cause unintended consequences or damage to the target system or application due to intrusive or aggressive scanning techniques, such as exploiting vulnerabilities, modifying data, or crashing services.
Be vulnerable to attacks or compromise by malicious actors who could exploit its weaknesses, tamper with its functionality, or steal its data.
Therefore, the security analyst should be most cautious about this limitation of vulnerability scanning software, as it could lead to a false sense of security, missed opportunities for remediation, or increased exposure to threats. The security analyst should always verify the scan results, use multiple tools and methods, and update and patch the software regularly to mitigate this risk.
References:
[CEHv13 Module 03: Vulnerability Analysis]
7 limitations of vulnerability scanners
The pros and cons of vulnerability scanning tools

Btlejack is a tool used for attacking Bluetooth Low Energy (BLE) connections, including sniffing, jamming, and hijacking.
* The -f option specifies the access address of the BLE connection.
* The -j option is used to hijack an active BLE connection.
Therefore, the correct syntax to hijack a BLE connection is:
btlejack -f [access_address] -j
This matches Option A: btlejack -f 0x129f3244 -j
Incorrect Options:
* B. -c any is used for sniffing any advertising packet but not for hijacking.
* C. -d specifies device paths; -s starts a scan but does not hijack.
* D. This is likely a malformed or unrelated command in the context of hijacking.
Reference - CEH v13 Official Courseware:
Module 18: IoT and OT Hacking
Section: "Bluetooth Low Energy (BLE) Attacks"
Tool Focus: "Btlejack Command Usage"
CEH iLab: Btlejacking with micro:bit