https://ru.wikipedia.org/wiki/DNS_spoofing
DNS spoofing is a threat that copies the legitimate server destinations to divert the domain's traffic. Ignorant these attacks, the users are redirected to malicious websites, which results in insensitive and personal data being leaked. It is a method of attack where your DNS server is tricked into saving a fake DNS entry. This will make the DNS server recall a fake site for you, thereby posing a threat to vital information stored on your server or computer.
The cache poisoning codes are often found in URLs sent through spam emails. These emails are sent to prompt users to click on the URL, which infects their computer. When the computer is poisoned, it will divert you to a fake IP address that looks like a real thing. This way, the threats are injected into your systems as well.
Different Stages of Attack of DNS Cache Poisoning:
- The attacker proceeds to send DNS queries to the DNS resolver, which forwards the Root/TLD authoritative DNS server request and awaits an answer.
- The attacker overloads the DNS with poisoned responses that contain several IP addresses of the malicious website. To be accepted by the DNS resolver, the attacker's response should match a port number and the query ID field before the DNS response. Also, the attackers can force its response to increasing their chance of success.
- If you are a legitimate user who queries this DNS resolver, you will get a poisoned response from the cache, and you will be automatically redirected to the malicious website.

According to CEH v13 Module 04: Enumeration and Module 08: Sniffing, packet sniffers such as Wireshark, tcpdump, and EtherApe are designed to capture and analyze network traffic at the data link (Layer 2) and network (Layer 3) layers of the OSI model.
At Layer 2 (Data Link), sniffers capture Ethernet frames, including MAC addresses and frame type.
At Layer 3 (Network), sniffers interpret IP headers, IP addresses, and transport layer protocols (TCP, UDP).
They do not operate at Layer 1 (Physical) as they do not deal with raw electrical signals.
Packet sniffers also do not manipulate traffic but passively monitor and capture packets that traverse the network.
Therefore, the correct statement is:
Packet Sniffers operate on both Layer 2 & Layer 3 of the OSI model.
Option Analysis:
A). Layer 1: # Incorrect. Layer 1 is the physical layer (electrical, optical signals).
B). Layer 2: # Partially correct but incomplete.
C). Both Layer 2 & Layer 3: Correct. Full coverage of packet sniffing capabilities.
D). Layer 3: # Partially correct but incomplete.
Reference from CEH v13 Courseware:
Module 08 - Sniffing, Section: How Packet Sniffers Work
CEH iLabs: Capturing Ethernet Frames and IP Packets Using Wireshark
OSI Model Mapping in CEH Official eBook

The Certified Ethical Hacker (CEH) Cloud Computing and Data Protection module emphasizes the importance of resilient backup strategies to protect against data tampering, ransomware, and unauthorized modification.
The 3-2-1 backup model is a widely recommended best practice referenced in CEH materials. It requires maintaining:
* 3 copies of data
* Stored on 2 different media types
* With 1 copy stored offsite
This approach ensures that even if cloud backups are compromised or altered, clean and uncompromised versions remain available. CEH documentation highlights this model as a core defense against data integrity attacks in cloud environments.
Option D directly mitigates the risk of backup tampering.
Options A, B, and C address unrelated security concerns and do not protect backup integrity.

The attackers remained undetected because there were no mechanisms to track activity or capture anomalies. This directly points to insufficient logging and monitoring, which is critical in serverless environments where visibility into function execution is essential for detecting and responding to security incidents.