100 Free CEH v13 312-50 Practice Questions and Answers

Why D is right

To verify vulnerabilities discovered during a scan, a penetration tester should use publicly available tools to exploit them in a controlled manner and confirm their actual impact. This validates that the vulnerabilities are real and exploitable within the authorized scope of the engagement, rather than false positives.

Why B is right

This scenario best represents gaining physical access by assuming the identity of a trusted internal staff member (network technician). The attacker impersonates a legitimate employee, uses this false identity to bypass physical security controls, and then exploits the trust to roam freely and access sensitive information. This is a classic impersonation- based social engineering attack targeting physical security.

Why C is right

The provider tracks compute hours, storage usage, and bandwidth consumption in detail, enabling pay-per-use billing and audit support. This directly describes Measured Service, the cloud characteristic where resource usage is monitored, controlled, and metered to support transparent billing and usage tracking.

Why A is right

A Nondisclosure Agreement (NDA) is the legal document that specifically restricts what information, findings, and details from the penetration test can be publicly disclosed or shared with unauthorized parties.

Why C is right

Impersonation is the technique where Rachel assumes the identity of Mark Stevens, a senior finance manager, to manipulate the HR staffer. She uses this false identity combined with authority and urgency to pressure the target into divulging sensitive information. This is a direct impersonation attack.

Why D is right

eMailTrackerPro can track geolocation, device type, and email addresses associated with a domain through email headers and tracking pixels. However, the time spent reading an email cannot be directly measured by eMailTrackerPro because reading time is not inherently captured in email metadata or tracking mechanisms. While pixel tracking confirms an email was opened, the duration of reading is not technically obtainable.

Why C is right

Agent Smith is an Android malware known for silently replacing legitimate applications on infected devices and displaying excessive advertisements while collecting user data for external transmission. The behavior described, installing a utility app from a third-party marketplace that then secretly replaces legitimate apps with compromised versions designed to generate ads and exfiltrate data, matches Agent Smith's modus operandi exactly. This malware specifically targets application replacement and ad injection.

Why A is right

TCP port 21 is FTP (File Transfer Protocol), which matches Amanda's discovery of an open port used for file transfer with anonymous login capabilities. UDP ports 137 and 138 are related to NetBIOS, and Amanda observed UDP NetBIOS traffic. However, the primary service of concern for the file transfer enumeration weakness is TCP 21 (FTP). While NetBIOS is present, the main vulnerability Amanda is exploiting involves the FTP service on TCP 21.

Why C is right

Sarah's scenario is a textbook social engineering attack: an attacker impersonates an authority figure (IT department) and uses psychological manipulation to trick the victim into revealing sensitive credentials. This involves deception and exploitation of human psychology rather than technical exploits. Option A describes legitimate security monitoring, option B describes accidental malware introduction through system administration, and option D describes physical security breach. Only option C involves the core social engineering technique of manipulation through false pretenses to obtain sensitive information.

Why B is right

Zero-Day Exploits pose the greatest detection and mitigation challenge because they exploit previously unknown vulnerabilities for which no signatures, patches, or documented mitigations exist. In a healthcare context targeting mobile platforms accessing EHR, zero-day exploits can bypass all traditional security measures (antivirus, patches, known vulnerability scanning) and provide attackers with immediate unauthorized access to sensitive patient data, causing maximum harm before discovery.

Why C is right

Qualys VM is specifically designed for hybrid infrastructure vulnerability management with agent-based detection, cloud-native scanning, constant monitoring, and centralized visibility across on-premises and cloud systems. The requirements emphasize agent- based detection, constant alerting, hybrid infrastructure coverage, and centralized real- time assessment, Qualys VM's core strengths. While Nessus is capable, Qualys is the market leader for enterprise-scale hybrid cloud vulnerability management.

Why B is right

A green hat hacker is a beginner in cybersecurity who is actively learning through online communities and experimenting with basic tools on low-risk targets to build skills without causing significant harm. This profile directly matches the description of someone new to the field, learning techniques, using foundational tools, and focusing on skill-building rather than malicious intent.

Why D is right

The ATT&CK Persistence tactic encompasses techniques that allow attackers to maintain long-term access to compromised systems, even after initial exploitation or if the system restarts. This includes methods like creating backdoor accounts, scheduled tasks, and persistence mechanisms.

Why A is right

HTTP Response Splitting attacks exploit improper input handling by injecting carriage return and line feed characters (CRLF) to split a single HTTP request/response into multiple ones, allowing injection of malicious data. This input validation flaw belongs in the same category as XSS, CSRF, and SQL injection, and matches Elena's observation of one request being processed as two separate ones.

Why A is right

Hashing algorithms are specifically designed to guarantee message integrity by creating a fixed-size hash value that changes if any bit of the original message is altered. Any modification to the message will result in a completely different hash, making tampering detectable.

Why D is right

A MAC flooding attack overwhelms the switch's Content Addressable Memory (CAM) table by sending thousands of frames with random spoofed MAC addresses. When the CAM table becomes full, the switch can no longer learn new MAC addresses and reverts to hub- like behavior, flooding all unicast frames out all ports instead of selectively forwarding to specific ports. This causes previously isolated unicast traffic to be broadcast to all connected devices, allowing the attacker's promiscuous interface to capture traffic not destined for their machine.

Why A is right

The default Time-To-Live (TTL) value for Windows operating systems is 128. This is a well-established baseline used in network fingerprinting and OS detection. Linux systems typically use 64, and older systems may use 255. Unicornscan and similar tools use TTL values to help identify the target OS, and a TTL of 128 is the standard indicator for Windows systems.

Why C is right

The scenario describes side-channel attacks, specifically power analysis and timing analysis. The attacker observes hardware signals (power consumption fluctuations and timing variations) to deduce secret keys, which is the core characteristic of side-channel exploitation. This is a passive observation-based attack against hardware implementations.

Why D is right

Infoga is a tool specifically designed for email reconnaissance and OSINT. It extracts information from emails including sender identities, mail servers, sender IP addresses, and sender locations from public sources. It also integrates with haveibeenpwned.com to check if email addresses have been compromised in data breaches, which matches all the activities described.

Why B is right

Netcraft and DNSdumpster are passive reconnaissance tools that leverage historical DNS records, WHOIS data, and search engine caches to enumerate subdomains without sending any probes or active queries to the target. This meets the strict rules of engagement requirement to avoid alerting security monitoring systems while effectively discovering subdomains.

Why C is right

Deprecated SSH ciphers enable downgrade attacks where attackers force the use of weaker cryptographic algorithms, potentially breaking encryption that would otherwise be secure. This allows attackers to compromise the confidentiality and integrity of SSH sessions.

Why B is right

Ping of Death works by sending oversized or malformed packets, typically fragmented ICMP packets that reassemble to more than the 65,535-byte IP maximum, so the target's stack mishandles the reassembly buffer and crashes, freezes or reboots. Sofia's use of a small number of deliberately oversized, malformed packets that caused processing failures and intermittent crashes, rather than a traffic volume overload, matches this technique exactly.

Why B is right

Nicolas is a white hat hacker because he discovered a zero-day vulnerability and responsibly disclosed it by informing both the affected system owner and Microsoft (the vendor). White hat hackers practice ethical hacking and responsible disclosure to help organizations fix vulnerabilities. His actions follow proper disclosure procedures by notifying stakeholders and providing protection guidance.

Why D is right

Pharming is a cyber attack that uses malicious code to redirect users' web traffic from legitimate websites to fraudulent ones without their knowledge. This can be accomplished through DNS poisoning, host file modifications, or malware that alters network settings to intercept and redirect traffic, making it distinct from phishing-based social engineering attacks.

Why B is right

BetterCAP is a comprehensive network attack toolkit that performs ARP spoofing to link an attacker's MAC address with a target system's IP address. It enables man-in-the-middle attacks to intercept, steal, modify, and block communications. Wireshark is a passive packet analyzer, DerpNSpoof is not a widely recognized tool, and Gobbler is not associated with ARP spoofing attacks.

Why A is right

Agent Smith is a well-documented Android malware attack that specifically involves replacing legitimate applications with malicious counterparts. The malware silently overwrites legitimate apps (like WhatsApp and SHAREit) with fake versions that maintain the original appearance while harvesting credentials and displaying intrusive ads. The attack vector of embedding malicious code in seemingly harmless utility apps and communicating with a C&C server for command execution perfectly matches the Agent Smith attack pattern described in this scenario.

Why C is right

The malware exhibits classic fileless characteristics: no unfamiliar executables or altered binaries found on disk, encoded command sequences executed within trusted processes, activity visible only during live execution, and cessation after restart. The malware resides and executes in memory and system processes without leaving traditional file artifacts, matching fileless malware behavior where scripts or commands are injected into legitimate system utilities.

Why C is right

Preparation is the phase where the incident response team is built, roles and responsibilities are defined, communication systems are tested, and tools are configured. This occurs before an incident happens. Containment is limiting damage, notification is alerting stakeholders, and recovery is restoring systems.

Why A is right

In an IDLE scan using IPID sequence analysis, when the IPID increases by 2 after the scan sequence, it indicates that the idle host sent one packet during the scan window. This pattern is consistent with the idle host receiving a response from the target, which occurs when the target port is open. A closed port would not generate a response, resulting in no IPID increment.

Why C is right

To detect and counter steganography-based data exfiltration, a specialized steganalysis tool is required. Steganalysis examines files to detect hidden data patterns, decode embedded information, and reveal the steganographic methodology used by the attacker. This is a specialized forensic technique that goes beyond general security tools, a firewall and IPS cannot detect data hidden within images, and a general network analyzer lacks the sophistication to identify steganographic patterns.

Why B is right

When discovering sensitive data like credit card numbers and PII during a penetration test, the immediate responsibility is to stop the test and report to management. This prevents further exposure, maintains proper chain of custody, and allows the organization to respond appropriately. Copying data creates liability and legal issues, continuing the test ignores the discovery, and contacting the employee bypasses the proper reporting chain.

Why C is right

Network segmentation is the most effective recommendation for protecting IoMT devices from ransomware and other attacks. By isolating IoMT devices onto a separate network segment, any breach of those devices is contained and prevented from spreading to the main IT infrastructure. This approach maintains functionality while reducing risk. Disabling wireless (A) may compromise device functionality. Changing IP addresses (B) provides no real security benefit. Multi-factor authentication (D) is less practical for medical devices and doesn't prevent network-based lateral movement.

Why D is right

WPA2/WPA3 encryption is the most suitable for a public Wi-Fi network requiring simple management. It provides strong encryption at the network level without requiring users to manage VPN clients or the shop to maintain complex filters. Disabling SSID broadcast provides minimal security (easily discovered via monitoring), MAC filtering is impractical for public networks with constantly changing users, and requiring VPN is overly complex for casual coffee shop users. Encryption at the network level balances security and usability.

Why B is right

Robots.txt is a critical file for discovering website structure as it contains directives indicating which paths should not be crawled by search engines, thereby revealing the sensitive or important directories and files on the web server that the administrator wants to hide.

Why C is right

Tier-3 (Registries) is where container images are stored after being verified, validated, signed, and prepared for deployment. Abel is performing image validation, signing, and sending to registries, which is the core function of the registry tier in the five-tier container architecture.

Why B is right

Lateral movement, also called pivoting, refers to an attacker's technique of moving from one compromised system to another within a network after gaining initial access. It allows attackers to expand their foothold and access additional resources, users, or sensitive data across the network infrastructure.

Why A is right

To meet the requirement of maintaining full control over encryption keys for data at rest in a public cloud, the client must encrypt data on their side before uploading it. This ensures the client retains complete control of the encryption keys, which never need to be shared with or managed by the cloud provider. This approach satisfies regulatory compliance requirements for key custody.

Why D is right

Session Sidejacking is the most challenging to detect and mitigate because it exploits unencrypted session tokens transmitted over public Wi-Fi networks. Unlike ARP spoofing which is limited to local networks, sidejacking affects remote employees on public networks where HTTPS isn't enforced, making it difficult to detect without examining traffic patterns. It directly compromises confidentiality of corporate data by capturing authentication tokens in plaintext, and is particularly effective against multinational corporations with distributed remote workforces.

Why D is right

The vulnerability described is that once the device is unlocked, corporate applications open directly to sensitive information without any additional authentication or verification. The direct mitigation is to require passwords or authentication within the application itself (option D), which would prevent an unlocked phone from automatically granting access to sensitive data. Even though the device passcode is important, it does not address the issue of applications requiring their own access controls once the OS is unlocked.

Why C is right

After identifying a high-risk vulnerability, the tester should verify its exploitability before attempting exploitation. Checking for known exploits determines if the vulnerability is practically exploitable in the organization's environment. Brute-force attacks are premature without confirmation of exploitability, low-risk vulnerabilities should be addressed after high-risk ones, and ignoring high-risk findings violates testing protocols and professional standards.

Why D is right

A passive assessment involves observing and collecting information without actively probing or interacting with systems. Morris performed network sniffing to identify active systems, services, and users, which is passive observation that does not require credentials or active scanning, making this a passive assessment.

Why D is right

Pass-the-hash is an attack where an attacker uses captured NTLM password hashes directly for authentication without needing to crack or know the plaintext password. The hash itself serves as the credential. Brute force requires cracking passwords, replay uses intercepted traffic, and Kerberoasting targets Kerberos service tickets, none match using hashes directly for authentication.

Why B is right

Port 48101 is commonly associated with Mirai and other IoT botnet malware command- and-control communications and lateral movement. Blocking this port first helps prevent botnet propagation and C2 communications. Ports 22, 80, and 443 are standard legitimate services (SSH, HTTP, HTTPS) that may have legitimate purposes, whereas 48101 is primarily associated with IoT malware activity.

Why A is right

Semi-untethered jailbreaking allows the device to boot normally without a computer connection and retain jailbroken status, but requires launching a special on-device application to reapply the jailbreak modifications after a restart. This matches the scenario where elevated access is temporarily lost after reboot until the user runs an app to restore it.

Why B is right

The scenario describes an agent-like tool installed on a compromised machine that scans other machines on the same network for vulnerabilities. This is characteristic of a network- based scanner, which operates from within the network to identify vulnerable systems. The scanner identifies vulnerabilities across multiple networked machines from a single compromised point, which is the definition of network-based scanning.

Why B is right

Website mirroring is the process of copying an entire website including all content, directory structure, files, images, and links to a local system for offline analysis and mapping. This technique allows penetration testers to understand the complete structure and organization of a target website without repeatedly accessing the live server.

Why D is right

The scenario explicitly describes using a high-performance CPU setup with hashcat to attempt millions of password combinations per second, which is the definition of leveraging hardware acceleration. While the tester does have a hash dump, the question asks what technique is being optimized, which is the acceleration method itself. The setup drastically reduces cracking time compared to standard CPU methods, demonstrating hardware acceleration optimization.

Why C is right

Bollards are short, sturdy posts installed in front of buildings to prevent vehicles from driving through doors, windows, or other entry points. They are a standard perimeter security measure against vehicular attacks.

Why B is right

Docker is an open-source containerization platform that enables developers to package, deploy, and run applications in isolated containers. It provides OS-level virtualization through containers, delivers containerized software packages, and facilitates fast software delivery by isolating applications from the underlying infrastructure. Docker uses well- defined channels (APIs and networking) for inter-container communication and has become the standard for containerized application deployment.

Why D is right

An Application Keylogger operates at the application level to capture keyboard input from specific applications without requiring browser injection, kernel driver installation, or physical hardware access. The scenario describes capturing employee logins, email drafts, and data entered into desktop applications, all application-level activities, without kernel drivers or physical device access. This matches application keyloggers perfectly, which hook into application-level input mechanisms to log keystrokes.

Why A is right

A brute force attack is a direct, aggressive exploitation technique that would immediately alert the target system and defeat the purpose of detecting honeypots without alerting the target. The question explicitly states the attacker needs to 'detect and bypass these honeypots without alerting the target,' making a brute force approach counterproductive. The other options (probing services, using detection tools, analyzing MAC addresses) are passive reconnaissance techniques suitable for honeypot detection.

Why B is right

WPA3 is the modern wireless security standard that directly addresses all stated requirements: it protects against offline dictionary attacks using Simultaneous Authentication of Equals (SAE), provides per-session encryption keys, and includes Opportunistic Wireless Encryption (OWE) for unauthenticated devices, allowing IoT devices to connect securely without a shared password. WPA3 eliminates the weaknesses present in earlier standards and satisfies management's goals for modern wireless security.

Why C is right

Windows Vista and later versions disable LM hashing by default as a security measure. LM hashes are considered cryptographically weak and were disabled in modern Windows versions to prevent rainbow table attacks. The blank LM hashes indicate that the system is not generating them anymore, which is the default behavior in Vista and later OS versions.

Why D is right

Spear-phishing with specific references to real financial audit details is the most effective technique because it demonstrates credibility and reduces suspicion. By incorporating concrete details about actual ongoing projects and audits, the tester establishes perceived legitimacy and urgency, making executives more likely to comply with credential requests. This targeted approach leveraging specific organizational intelligence is more effective than generic phishing attempts or impersonation without supporting details.

Why B is right

Insecure deserialization is the vulnerability where untrusted serialized data is deserialized without proper validation, allowing attackers to execute arbitrary code. This is a well- known OWASP Top 10 vulnerability that directly leads to Remote Code Execution when exploited.

Why A is right

Comprehensive employee training on social engineering tactics and the risks of disclosing confidential information is the most effective countermeasure against phone-based social engineering attacks. Since the attack specifically exploited an employee's lack of awareness during an innocent conversation, education and awareness training directly addresses this vulnerability by teaching employees to recognize and resist social engineering attempts.

Why A is right

The -D switch in Nmap enables decoy scanning, which spoofs the source IP address by sending packets from decoy IPs alongside real scan packets. This obfuscates the true source of the scan and makes it harder for IDS/firewall systems to identify and block the attacker's actual IP address, effectively evading detection mechanisms.

Why A is right

Daniel's attack involves multiple compromised workstations silently communicating with a central command server, receiving synchronized commands, and performing coordinated background tasks including burst outbound traffic. This is the defining behavior of botnet agents, malware that turns infected systems into remote-controlled nodes in a larger malicious network.

Why A is right

When attempting to enumerate an IPC$ share during authorized penetration testing, the most appropriate technique is to attempt credential brute forcing against the identified share. IPC$ shares can be accessed with valid credentials, making credential enumeration the logical enumeration approach. Options B, C, and D are enumeration techniques but not appropriate for directly enumerating IPC share contents.

Why A is right

The query 'filetype:pdf intitle:"admin access" site:onion' best targets the objective of finding administrative documents on .onion sites. It specifically searches for PDF files with "admin access" in the title, which directly suggests management-related content. The use of 'site:onion' restricts results to .onion domains, and PDF format is commonly used for formal administrative documentation. This combination is the most precise for identifying confidential administrative documents.

Why D is right

The scenario explicitly describes converting traffic measurements into signal components and evaluating their energy across multiple frequency ranges. This is the core methodology of wavelet-based signal analysis, which decomposes traffic signals into spectral components to identify anomalies based on frequency characteristics rather than baselines or statistical change-points. Wavelet analysis is particularly effective for DDoS detection because it can identify abnormal traffic bursts by analyzing their frequency domain representation without requiring explicit baseline definitions or statistical hypothesis testing.

Why B is right

Webhooks are user-defined HTTP callbacks triggered by events that push real-time data to other applications. The description explicitly matches webhooks: HTTP callbacks raised by trigger events that supply data to other applications for instant real-time information updates. Web shells are malicious scripts, REST and SOAP are API architectures for request-response, not event-driven pushes.

Why B is right

Enabling WPA2 or WPA3 encryption is the highest priority security measure for wireless networks, as it provides strong cryptographic protection for all traffic. This single measure prevents unauthorized access and protects data in transit. While other measures like SSID hiding, MAC filtering, and password rotation have value, encryption is the foundational security control without which other measures provide minimal protection.

Why C is right

This is a classic Time-of-Validation/Time-of-Execution (TOCTOU or TOCTTOU) vulnerability. The system validates access rights at one point in time (time-of-validation), but the file is used later (time-of-execution) without re-validating. An attacker exploits the race condition window between validation and execution to swap the legitimate file with a malicious one, causing the system to process the malicious file as if it had passed validation.

Why D is right

Against a well-secured web application using HTTPS, secure cookies, and strict session management, a Cross-Site Scripting (XSS) attack is the most viable technique to steal session tokens. XSS allows the attacker to execute JavaScript in the user's browser to access and exfiltrate session cookies, bypassing transport-layer protections like HTTPS.

Why B is right

The attack succeeds primarily through the perception of authority (dressed as technician, fake credentials, internal terminology) combined with reliance on third-party familiarity (recognized vendor name). The receptionist trusts the vendor name and the attacker's confident demeanor rather than verifying actual credentials. This exploits human psychology around authority figures and known entities.

Why A is right

Sofia's crafted requests manipulating resource paths to access restricted system files through improper input validation directly describes a directory traversal attack. The scenario explicitly eliminates header manipulation, cached content issues, and credential compromise, leaving path manipulation as the core vulnerability.

Why C is right

ISO/IEC 27001:2022 is the comprehensive framework standard that defines the requirements for establishing, implementing, maintaining, and continually improving an organization's information security management system (ISMS). It provides the overarching structure for managing information security programs across the entire organization and is the certification standard against which organizations are audited.

Why B is right

The scenario describes a memory leak vulnerability specific to HTTP/2, the multiplexed communication protocol. The fact that memory steadily increases despite stable request volume, doesn't recover after client disconnection, only occurs with the multiplexed protocol enabled, and requires service restart to recover points directly to HTTP/2 stream memory not being reclaimed on RST frames. This is a known Apache vulnerability (CVE-2019-9511) where stream resources aren't properly freed when reset frames are processed, causing memory exhaustion over time.

Why C is right

The scenario describes a non-elevated process launching a signed Microsoft binary (auto- elevating executable like fodhelper.exe) that executed unauthorized code without user prompts, with registry manipulation under the current user hive. This is a classic UAC bypass technique where attackers redirect legitimate auto-elevating binaries to execute malicious code by modifying shell-related registry keys. The technique exploits the fact that certain Microsoft binaries auto-elevate without displaying a UAC prompt, allowing privilege escalation from a standard user context.

Why A is right

Insufficient logging and monitoring is the critical threat because the investigation revealed that attackers remained undetected due to the absence of mechanisms tracking function- level activity and capturing anomalous events. The serverless architecture increases the importance of comprehensive logging and monitoring for security functions, making this the primary vulnerability John should address to detect and prevent future breaches.

Why B is right

This is SaaS (Software as a Service). The provider manages hardware, operating system, software, patching, and monitoring, while the customer only manages user accounts. The software is cloud-hosted and accessed via subscription. IaaS provides virtual computing resources, PaaS provides development platforms, and CaaS provides containerized application deployment, all requiring more customer-side management than described.

Why C is right

The scenario describes a portable multi-antenna device with approximately 120-meter coverage affecting multiple frequency bands (Wi-Fi and cellular) with roughly one hour of operational time before recharge. The CPB-2920 Jammer is consistent with these specifications, it is a multi-band portable jamming device designed for wide-area disruption of multiple wireless standards with substantial coverage radius and battery duration.

Why A is right

Unauthenticated Scanning occurs without providing credentials to the target systems. The key indicators are: no credential failures logged in SIEM, system login prompts were never triggered, and only surface-level information was retrieved (open ports, version banners). Deeper system details like registry settings, user policies, and patch information require authenticated access.

Why B is right

Google Hacking uses advanced search operators to find sensitive information indexed by search engines, including exposed source code, configuration files, backup files, and other web-accessible data that reveals implementation details and potential vulnerabilities in code and systems. This directly supports identifying weaknesses in web code and architecture. While Google Hacking can reveal some information about web presence, it cannot reliably map internal networks, identify phishing sites (that's a different technique), or access Deep Web content which by definition is not indexed by Google.

Why C is right

Connections that arrive from legitimate-looking IPs, trickle HTTP headers a few bytes at a time, and never terminate the request are the classic Slowloris pattern. Each incomplete request occupies a server thread or connection slot indefinitely; once the concurrent connection limit is reached the server can no longer serve real customers, producing the latency, timeouts and instability seen at peak hours without any packet malformation or bandwidth spike.

Why C is right

Disabling Android Debug Bridge (ADB) except in strictly controlled environments is the most potent countermeasure because ADB is the direct attack vector exploited in this scenario. Eliminating the vector itself is more effective than mitigating secondary defenses. While updates, biometrics, and VPNs add security layers, they don't address the root cause of ADB exploitation.

Why D is right

A bootkit installs below the operating system and executes before drivers or services load during the boot process. It achieves persistence and stealth by loading before antivirus and endpoint detection tools can monitor system activity, making it invisible to forensic scans looking for user-level or kernel-level malicious processes. This matches Daniel's scenario perfectly.

Why D is right

Directory traversal (also called path traversal) is an attack where an attacker uses sequences like '../' to navigate to parent directories and access files outside the intended directory structure. The scenario describes exactly this vulnerability, the web server not properly sanitizing '../' input, allowing access to higher folder levels.

Why B is right

When multiple machines are coordinating to send traffic to unknown IP addresses for spam campaigns, they are part of a botnet, a network of compromised devices controlled by an attacker. This describes the hallmark behavior of botnet-enslaved machines executing commands from a command-and-control server. Keyloggers harvest credentials, worms self-replicate, and adware redirects browsers, none of which cause coordinated spam campaigns.

Why D is right

BOLA (Broken Object-Level Authorization) is when an API accepts user-provided object IDs without verifying the user has permission to access that object. An attacker can modify ID parameters to access other users' data.