The correct answer is D. Anomaly-Based Detection because the scenario explicitly states that the system
"monitors traffic for deviations from established baselines" and flags behavior that does not match normal network activity. In CEH-aligned IDS/IPS concepts, anomaly-based detection (also called behavior-based detection) works by building a profile of what "normal" looks like-such as typical packet rates, protocol usage, session patterns, timing, connection distributions, and expected traffic flows-and then identifying events that deviate significantly from those norms. This makes it particularly useful against evasion techniques and previously unseen patterns, because it is not limited to matching known signatures.
Sophia's tactic-packet fragmentation-is a classic evasion approach intended to bypass simplistic inspection systems by splitting malicious payloads or attack patterns across multiple fragments so they are harder to reconstruct or match. A baseline-driven anomaly system can still detect the attack because fragmentation itself (or the resulting traffic characteristics) may appear abnormal: unusual fragment counts, unexpected fragment sizes, atypical reassembly behavior, irregular session characteristics, or protocol violations compared to normal traffic profiles. Because the detection is based on behavior rather than a fixed pattern, it can trigger alerts even if the exact malicious payload is not recognized.
Why the other options are less correct: Signature-based detection relies on known patterns and may be evaded when attackers modify payloads or fragment traffic to avoid matches. Stateful packet inspection tracks connection state and can help with session validation, but it is not inherently a baseline deviation detector.
Deep packet inspection inspects packet contents and can sometimes reassemble fragments depending on implementation, but the question's key clue is "deviations from established baselines," which directly points to anomaly-based detection.
Therefore, the IT team is most likely using anomaly-based detection.

In CEH v13 Module 09: Social Engineering, spear-phishing is described as a targeted email-based attack in which malicious actors craft highly personalized emails to specific individuals within an organization.
Characteristics from the scenario:
The attacker sends a fraudulent email to an employee.
The email contains a malicious attachment.
Once opened, malware is installed, targeting ICS/SCADA components.
The attack spreads and ultimately damages industrial systems.
This is a classic spear-phishing attack used as the initial infection vector in Advanced Persistent Threats (APT) targeting industrial control systems.
Why Others Are Incorrect:
B). SMiShing: SMS-based phishing; not email-related.
C). Reconnaissance: Pre-attack information gathering, not execution.
D). HMI-based attack: Targets Human-Machine Interface devices, but that's not how the attack started here.
Reference:
Module 09 - Social Engineering # Spear Phishing in Critical Infrastructure CEH iLabs: ICS Infection via Spear Phishing Simulation

In CEH v13 Module 06: Malware Threats, a worm is described as a self-replicating piece of malware that spreads independently from one system to another without needing to attach itself to any file or program (unlike viruses).
Key Characteristics of Worms:
Capable of network propagation without human interaction.
Often used in mass attacks (e.g., WannaCry, Conficker).
Can cause significant damage by:
Consuming bandwidth.
Spreading payloads (e.g., ransomware).
Modifying or deleting files.
Option Clarification:
A: Rootkit: Hides presence of malware or attacker activities.
B: Trojan: Disguised as legitimate software; does not replicate.
C: Worm: Correct - self-replicating and spreads automatically.
D: Adware: Primarily shows ads; not typically destructive or self-replicating.
Reference:
Module 06 - Types of Malware # Worms
CEH iLabs: Network Infection with Self-Spreading Worms

The correct answer is D, ciphertext-only attack, because the attackers possess only encrypted data and have neither the encryption key nor any confirmed samples of the original plaintext. In CEH-aligned cryptography concepts, cryptanalytic attacks are categorized by what information and capabilities the attacker has. A ciphertext-only attack is the most constrained model: the attacker attempts to infer the plaintext or key by analyzing ciphertext alone, often leveraging statistical properties, repetitions, formatting assumptions, and structural patterns that may leak information when encryption is misused.
The scenario highlights that the attacker "examines encrypted outputs in bulk" to detect "structural or statistical patterns." That wording maps directly to ciphertext-only analysis: looking for patterns caused by weak modes of operation, poor IV/nonce handling, deterministic encryption, repeated blocks (common in ECB mode), predictable headers, or consistent record templates. With block ciphers, large datasets increase the chance that repeated plaintext blocks produce repeated ciphertext blocks if the system uses an unsafe mode or reuses IVs, allowing an attacker to correlate records, identify fields, or sometimes recover content when combined with protocol or file-format knowledge.
The other options require more attacker capability than the prompt provides. Known-plaintext attacks require some plaintext-ciphertext pairs. Chosen-plaintext attacks require the ability to encrypt attacker-chosen inputs.
Chosen-ciphertext attacks require a decryption oracle or the ability to submit ciphertext for decryption. Since none of those are present here, Emma should evaluate ciphertext-only exposure and specifically validate the cipher mode, IV/nonce uniqueness, padding behavior, and whether encryption is semantically secure for stored patient records.

Fragmentation is a well-known firewall and IDS evasion technique covered in CEH materials. The attacker breaks a malicious packet into smaller IP fragments so that simple filtering devices, especially those relying mainly on basic header checks or stateless rules, may fail to reconstruct the original payload and therefore miss the malicious content. To counter this, defenses must track packet state and perform reassembly or validation of fragmented traffic so the security control can evaluate the complete communication stream rather than isolated fragments.
Stateful Packet Inspection is the control most aligned with this requirement. A stateful inspection firewall maintains a state table of active connections and monitors traffic as part of an ongoing session. Because it tracks session context, it can handle fragmented packets more effectively by correlating fragments to the original flow and applying policy after reconstructing or normalizing traffic. In CEH-aligned descriptions, this directly reduces the effectiveness of fragmentation-based evasion, overlapping with the concept of traffic normalization that removes ambiguity attackers try to exploit.
Deep Packet Inspection examines payload beyond headers, but the key success factor in stopping fragmentation evasion is state tracking and reassembly, which is characteristic of stateful inspection and state- aware security devices. Signature-based and anomaly-based detection can help detect malicious patterns or unusual behavior, but without reliable reassembly and session context, fragmented payloads may not match signatures and may appear benign in isolation. Therefore, the most likely measure used to identify and block fragmented packets in this scenario is Stateful Packet Inspection.