To secure DNS infrastructure, best practices include:
* B. Harden DNS Servers: Disable unused services, apply patches, implement secure configurations.
* C. Use Split-Horizon DNS: Present different DNS data to internal vs. external users to prevent data leakage.
* D. Restrict Zone Transfers: Prevent unauthorized replication of zone data using IP-based access control or TSIG.
* E. Subnet Diversity: Place DNS servers on different subnets or networks to enhance resilience.
From CEH v13 Official Courseware:
* Module 3: Scanning Networks
* Module 20: Cryptography
Incorrect Option:
* A: Hosting DNS on multi-purpose servers increases the attack surface and violates security best practices.
Reference:CEH v13 Study Guide - Module 3: DNS Hardening & Zone Transfer SecurityNIST SP 800-81r2 - Secure Domain Name System Deployment Guide

https://en.wikipedia.org/wiki/SQL_injection#Blind_SQL_injection
Blind SQL injection is used when a web application is vulnerable to an SQL injection but the results of the injection are not visible to the attacker. The page with the vulnerability may not be one that displays data but will display differently depending on the results of a logical statement injected into the legitimate SQL statement called for that page. This type of attack has traditionally been considered time-intensive because a new statement needed to be crafted for each bit recovered, and depending on its structure, the attack may consist of many unsuccessful requests. Recent advancements have allowed each request to recover multiple bits, with no unsuccessful requests, allowing for more consistent and efficient extraction.

The correct answer is C. Container Escape.
The scenario describes a compromised containerized workload breaking out of its intended isolation boundary and accessing host-level resources or adjacent workloads. This is the defining behavior of a container escape.
CEH-aligned cloud and virtualization material explains that containerization can suffer from container breakouts/leaks, where an attacker may gain unauthorized access to other containers on the same host, leading to privilege escalation and data leakage .
Option A. Man-in-the-Cloud Attack is incorrect because that attack abuses cloud synchronization tokens or cloud account access mechanisms, not container isolation boundaries.
Option B. Side-Channel Attack is incorrect because a side-channel attack infers sensitive data indirectly through shared resource behavior, timing, cache, or other indirect signals.
Option D. Golden SAML Attack is incorrect because Golden SAML involves forging SAML authentication assertions using stolen identity-provider signing material.
Therefore, the best answer is C. Container Escape.

After the attacker completes preparations, subsequent step is an effort to realize an edge within the target's environment. a particularly common entry tactic is that the use of spearphishing emails containing an internet link or attachment. Email links usually cause sites where the target's browser and related software are subjected to varied exploit techniques or where the APT actors plan to social engineer information from the victim which will be used later. If a successful exploit takes place, it installs an initial malware payload on the victim's computer. Figure 2 illustrates an example of a spearphishing email that contains an attachment.
Attachments are usually executable malware, a zipper or other archive containing malware, or a malicious Office or Adobe PDF (Portable Document Format) document that exploits vulnerabilities within the victim's applications to ultimately execute malware on the victim's computer. Once the user has opened a malicious file using vulnerable software, malware is executing on the target system. These phishing emails are often very convincing and difficult to differentiate from legitimate email messages. Tactics to extend their believability include modifying legitimate documents from or associated with the organization. Documents are sometimes stolen from the organization or their collaborators during previous exploitation operations.
Actors modify the documents by adding exploits and malicious code then send them to the victims. Phishing emails are commonly sent through previously compromised email servers, email accounts at organizations associated with the target or public email services. Emails also can be sent through mail relays with modified email headers to form the messages appear to possess originated from legitimate sources. Exploitation of vulnerabilities on public-facing servers is another favorite technique of some APT groups. Though this will be accomplished using exploits for known vulnerabilities, 0-days are often developed or purchased to be used in intrusions as required .

Gaining an edge within the target environment is that the primary goal of the initial intrusion. Once a system is exploited, the attacker usually places malware on the compromised system and uses it as a jump point or proxy for further actions. Malware placed during the initial intrusion phase is usually an easy downloader, basic Remote Access Trojan or an easy shell. Figure 3 illustrates a newly infected system initiating an outbound connection to notify the APT actor that the initial intrusion attempt was successful which it's able to accept commands.