Insecure communication is defined in CEH's mobile and IoT security modules as the failure to encrypt sensitive data transmitted between a device and a server. When applications use plain HTTP instead of HTTPS, all traffic-including authentication tokens, user identifiers, and session data-can be monitored and altered by an attacker through network sniffing or man-in-the-middle attacks. CEH emphasizes that insecure transport channels represent one of the most common and critical weaknesses in mobile ecosystems, allowing attackers to harvest credentials or inject malicious commands. Security misconfiguration refers to improper server settings, while SSL pinning issues involve certificate validation bypassing. Insufficient input validation pertains to application-side data validation. None of these align as directly as insecure communication, which precisely describes the unencrypted data exposure.

Gathering Information using Reverse Image Search Reverse image search helps an attacker in tracking the original source and details of images, such as photographs, profile pictures, and memes Attackers can use online tools such as Google Image Search, TinEye Reverse Image Search, and Yahoo Image Search to perform reverse

With HTTP-only cookies, session ID regeneration on login, and strict timeouts in place, application-level session attacks such as fixation, CSRF, or token prediction are effectively mitigated. A network-level man-in-the-middle attack allows interception and reuse of session tokens during active sessions without relying on application flaws, making it the most viable advanced technique in this scenario.

The host command in Linux is used for DNS lookup operations. The switch -t specifies the type of DNS record you are querying.
host -t a domain.com queries for A (Address) records, which return the IP address associated with a domain.
host -t ns queries for name servers (NS records).
host -t soa queries for the Start of Authority (SOA) record.
host -t AXFR attempts a zone transfer (not a standard resolution method and typically blocked).
Hence, option A correctly resolves a domain name to its IP address.
Reference:
CEH v13 eCourseware - Module 02: Footprinting and Reconnaissance # DNS Enumeration Tools CEH v13 Study Guide - Chapter: Reconnaissance Techniques # "host Command Usage for DNS Information Gathering"
===

Users are redirected to a fraudulent website that closely mimics the legitimate portal, leading them to voluntarily submit credentials. This behavior aligns with pharming, where attackers direct victims to a fake site resembling a trusted one without altering the organization's internal DNS.