The correct answer is A, Long dwell time. In CEH security operations and threat-detection concepts, an Advanced Persistent Threat, or APT, is characterized by advanced techniques, persistence, stealth, and a long- term objective. CEH-related material describes an APT as a continuous process of stealing information, often focused on private organizations or political motives, and explains that "persistent" involves continuous monitoring and data fetching from a target. It also lists APT criteria such as timeliness, meaning time spent probing and accessing the target, and risk tolerance, meaning the ability to remain undetected. Long dwell time means the attacker remains inside the environment for an extended period before detection, often performing internal reconnaissance, privilege escalation, lateral movement, credential theft, persistence, and quiet data exfiltration. Malware spam is usually broad and noisy, a one-time exploit lacks persistence, and brute force is only a technique. Therefore, long dwell time best indicates APT behavior.

DNS tunneling may be a method wont to send data over the DNS protocol, a protocol which has never been intended for data transfer. due to that, people tend to overlook it and it's become a well-liked but effective tool in many attacks.Most popular use case for DNS tunneling is obtaining free internet through bypassing captive portals at airports, hotels, or if you are feeling patient the not-so-cheap on the wing Wi-Fi.On those shared internet hotspots HTTP traffic is blocked until a username/password is provided, however DNS traffic is usually still allowed within the background: we will encode our HTTP traffic over DNS and voila, we've internet access.This sounds fun but reality is, browsing anything on DNS tunneling is slow. Like, back to
1998 slow.Another more dangerous use of DNS tunneling would be bypassing network security devices (Firewalls, DLP appliances...) to line up an immediate and unmonitored communications channel on an organisation's network. Possibilities here are endless: Data exfiltration, fixing another penetration testing tool... you name it.To make it even more worrying, there's an outsized amount of easy to use DNS tunneling tools out there.There's even a minimum of one VPN over DNS protocol provider (warning: the planning of the web site is hideous, making me doubt on the legitimacy of it).As a pentester all this is often great, as a network admin not such a lot .
How does it work:For those that ignoramus about DNS protocol but still made it here, i feel you deserve a really brief explanation on what DNS does: DNS is sort of a phonebook for the web , it translates URLs (human-friendly language, the person's name), into an IP address (machine-friendly language, the phone number). That helps us remember many websites, same as we will remember many people's names.For those that know what DNS is i might suggest looking here for a fast refresh on DNS protocol, but briefly what you would like to understand is:* A Record: Maps a website name to an IP address.example.com ? 12.34.52.67* NS Record (a.k.a. Nameserver record): Maps a website name to an inventory of DNS servers, just in case our website is hosted in multiple servers.example.com ? server1.example.com, server2.example.comWho is involved in DNS tunneling?* Client. Will launch DNS requests with data in them to a website .* One Domain that we will configure. So DNS servers will redirect its requests to an outlined server of our own.* Server. this is often the defined nameserver which can ultimately receive the DNS requests.The 6 Steps in DNS tunneling (simplified):1. The client encodes data during a DNS request. The way it does this is often by prepending a bit of knowledge within the domain of the request. for instance : mypieceofdata.server1.example.com2. The DNS request goes bent a DNS server.3. The DNS server finds out the A register of your domain with the IP address of your server.4. The request for mypieceofdata.server1.example.com is forwarded to the server.5. The server processes regardless of the mypieceofdata was alleged to do. Let's assume it had been an HTTP request.6.
The server replies back over DNS and woop woop, we've got signal.
Bypassing Firewalls through the DNS Tunneling Method DNS operates using UDP, and it has a 255-byte limit on outbound queries. Moreover, it allows only alphanumeric characters and hyphens. Such small size constraints on external queries allow DNS to be used as an ideal choice to perform data exfiltration by various malicious entities. Since corrupt or malicious data can be secretly embedded into the DNS protocol packets, even DNSSEC cannot detect the abnormality in DNS tunneling. It is effectively used by malware to bypass the firewall to maintain communication between the victim machine and the C&C server. Tools such as NSTX (https://sourceforge.net), Heyoka (http://heyoka.sourceforge.netuse), and Iodine (https://code.kryo.se) use this technique of tunneling traffic across DNS port 53. CEH v11 Module 12 Page
994

Social engineering is the term used for a broad range of malicious activities accomplished through human interactions. It uses psychological manipulation to trick users into making security mistakes or giving away sensitive information.
Social engineering attacks typically involve some form of psychological manipulation, fooling otherwise unsuspecting users or employees into handing over confidential or sensitive data. Commonly, social engineering involves email or other communication that invokes urgency, fear, or similar emotions in the victim, leading the victim to promptly reveal sensitive information, click a malicious link, or open a malicious file. Because social engineering involves a human element, preventing these attacks can be tricky for enterprises.

The given rule syntax is consistent with Snort, a popular open-source Intrusion Detection System (IDS). This rule alerts when any TCP traffic from any source IP and port is sent to IPs within the 192.168.100.0/24 subnet on port 21 (FTP), triggering the alert message: "FTP on the network!" The Snort rule format is:
alert protocol source_IP source_port -> destination_IP destination_port (rule_options) CEH v13 course materials teach this rule format under IDS/IPS configuration.
From CEH v13 Guide:
"Snort rules are used in IDS/IPS to define suspicious traffic patterns. An example rule: alert tcp any any ->
192.168.1.0/24 21 (msg: 'FTP detected') triggers an alert on FTP traffic within a subnet." Incorrect Options:
A/C. IP tables are used in firewalls and routers but follow a completely different syntax.
B). FTP servers do not use such alerting rules.
Reference - CEH v13 Study Guide:
Module 12: Evading IDS, Firewalls, and Honeypots
Section: Snort IDS Configuration
=

After discovering the base distinguished name of the directory, the logical next step in LDAP enumeration is to use that base DN in ldapsearch queries to enumerate directory objects such as users, groups, computers, and organizational units, expanding visibility into the Active Directory structure.