RID cycling is an SMB enumeration technique used to identify user and group accounts on Windows systems by querying relative identifiers (RIDs) associated with security identifiers (SIDs).

This scenario describes fileless malware using covert command-and-control (C2) channels over commonly allowed protocols such as HTTP and DNS, a technique heavily emphasized in CEH v13 Malware Threats.
Such malware avoids writing files to disk and instead leverages memory, legitimate system tools, and trusted protocols to evade traditional defenses.
Signature-based antivirus updates (Option A) are ineffective against fileless malware because there are no static artifacts to match. Blocking known malware ports (Option C) is also ineffective, as the malware intentionally uses ports 80 and 53, which must remain open for normal business operations. Restricting plain HTTP (Option B) may reduce visibility but does not stop DNS tunneling or encrypted malicious traffic.
CEH v13 identifies behavioral analytics as the most effective countermeasure against advanced malware.
Behavioral solutions establish a baseline of normal system and network activity, then detect anomalies such as:
Unusual outbound DNS query patterns
Abnormal HTTP beaconing intervals
Legitimate applications behaving suspiciously
PowerShell or system tools generating network traffic unexpectedly
By monitoring how systems behave rather than what files exist, behavioral analytics can identify stealthy C2 communications and disrupt them early. Therefore, Option D is the most effective and CEH-aligned response.

In CEH v13 Module 11: Hacking Wireless Networks, Wardriving is explained as the practice of driving around with a Wi-Fi-enabled device to detect open or vulnerable wireless networks.
Key Characteristics of Wardriving:
Involves using laptops, smartphones, or specialized devices with Wi-Fi antennas.
Tools like NetStumbler, Kismet, or WiGLE may be used.
Often includes GPS tagging of discovered networks.
Used to identify unsecured access points for later exploitation.
Option Clarification:
A). GPS mapping: May be used with wardriving, but not the act itself.
B). Spectrum analysis: Measures RF spectrum usage; not network discovery.
C). Wardriving: Correct - searching for Wi-Fi networks while driving.
D). Wireless sniffing: Captures traffic; can happen during wardriving, but broader in scope.
Reference:
Module 11 - Wireless Attack Techniques # Wardriving Explained
CEH iLabs: Wi-Fi Network Discovery with Kismet

https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol
LDAP, the Lightweight Directory Access Protocol, is a mature, flexible, and well supported standards-based mechanism for interacting with directory servers. It's often used for authentication and storing information about users, groups, and applications, but an LDAP directory server is a fairly general-purpose data store and can be used in a wide variety of applications.
The LDAP protocol can deal in quite a bit of sensitive data: Active Directory usernames, login attempts, failed-login notifications, and more. If attackers get ahold of that data in flight, they might be able to compromise data like legitimate AD credentials and use it to poke around your network in search of valuable assets.
Encrypting LDAP traffic in flight across the network can help prevent credential theft and other malicious activity, but it's not a failsafe-and if traffic is encrypted, your own team might miss the signs of an attempted attack in progress.
While LDAP encryption isn't standard, there is a nonstandard version of LDAP called Secure LDAP, also known as "LDAPS" or "LDAP over SSL" (SSL, or Secure Socket Layer, being the now-deprecated ancestor of Transport Layer Security).
LDAPS uses its own distinct network port to connect clients and servers. The default port for LDAP is port
389, but LDAPS uses port 636 and establishes TLS/SSL upon connecting with a client.