Certified Ethical Hacker CEH (CEH) — Questions 676–750

The prevalence of default or hard-coded credentials represents a severe and common weakness in IoT devices. Many manufacturers ship devices with easily guessable default usernames and passwords (e.g., 'admin/admin', 'root/password') or embed unchangeable credentials directly into the firmware. Attackers frequently exploit these known credentials through automated scanning and brute-force attacks, gaining unauthorized access to devices, which can then be used for botnets, data exfiltration, or further network penetration.

A worm is a standalone malware computer program that replicates itself to spread to other computers. Unlike a virus, it does not need to attach to an existing program or host file to propagate. Worms often exploit network vulnerabilities to spread autonomously across networks, consuming bandwidth and system resources, and can carry payloads like backdoors or ransomware. This self-contained, network-aware replication is its defining characteristic.

When hping3 sends a TCP SYN packet to a target port, the receipt of a SYN-ACK packet in response is the definitive indication that the port is open and an application is actively listening. This response signifies the second step of the TCP three-way handshake, where the target acknowledges the SYN and sends its own synchronization request. Therefore, a SYN-ACK from 10.0.0.1 on port 80 confirms that the port is open and ready to establish a connection.

A Smurf attack is a classic distributed denial-of-service (DDoS) technique that leverages an intermediary network to amplify traffic against a victim. The attacker sends an ICMP echo request packet to a network's IP broadcast address, but with the source IP address spoofed to that of the intended victim. All hosts on the intermediary network that receive the broadcast then reply to the spoofed source IP, flooding the victim with numerous ICMP echo replies. This amplification effect can quickly overwhelm the victim's network resources.

Local File Inclusion (LFI) vulnerabilities allow an attacker to read arbitrary files from the server's file system. By manipulating the vulnerable parameter with paths like /etc/passwd or /etc/shadow, an attacker can directly access and disclose critical system configuration files, user credentials, or application source code. This exposure of sensitive data is a primary and direct impact of LFI, providing valuable information for further exploitation.

The SameSite=Strict attribute is a powerful defense against CSRF attacks by instructing the browser to only send the cookie with requests originating from the same site as the cookie's domain. This means if a user is logged into `example.com` and then visits `malicious.com`, any requests `malicious.com` attempts to make back to `example.com` will not include the session cookie. Consequently, the malicious request will not be authenticated, effectively preventing the forgery.

Regardless of the cloud service model (IaaS, PaaS, SaaS), the customer always retains primary responsibility for the security of their data itself. This encompasses implementing appropriate encryption for data at rest and in transit, configuring robust access controls and identity management, and ensuring data integrity and compliance. The cloud provider secures the underlying infrastructure that stores the data, but the data's content security is the customer's domain.

CSRF tokens are the most effective defense against Cross-Site Request Forgery (CSRF) attacks. These unique, unpredictable, and secret values are generated server-side for each user session and embedded within critical state-changing requests, such as form submissions. The server then validates the presence and correctness of this token upon receiving the request, ensuring that the request originated from the legitimate application and not from an attacker's malicious site.

Whaling is a specialized form of spear phishing that specifically targets high-profile individuals, such as senior executives, CEOs, or government officials, or impersonates them to deceive employees. In this scenario, an email appearing to be from the CEO directly aligns with the definition of whaling, as it leverages the authority of a top executive to induce a specific action. The objective is often to trick recipients into making large financial transfers or divulging sensitive corporate data, exploiting the perceived urgency and command from a C-level executive.

The differing server responses to the VRFY command—typically a '250 OK' for valid users and a '550 No such user' or similar for invalid ones—unambiguously confirm the server is revealing valid usernames. This behavior allows an attacker to systematically enumerate existing user accounts on the system. Such information is a critical vulnerability, enabling subsequent attacks like brute-force password attempts or targeted phishing campaigns.

Session hijacking via Cross-Site Scripting (XSS) occurs when an attacker injects malicious client-side scripts into a web page viewed by other users. If the session cookie lacks the HttpOnly flag, the injected script can access document.cookie to read and exfiltrate the victim's session identifier. With the stolen session cookie, the attacker can then impersonate the victim, gaining unauthorized access to their authenticated session without needing their credentials. This directly targets the client-side session token.

The command `hping3 -S --flood -p 80 <target_ip>` is specifically engineered to launch a SYN flood denial-of-service attack. By rapidly sending a massive volume of TCP SYN packets to port 80, the target's web server is forced to allocate resources for numerous half-open connections. This quickly exhausts the server's connection queue, preventing legitimate users from establishing new connections and effectively denying service.

Rate limiting is a crucial DDoS mitigation technique that restricts the number of requests a server or application will accept from a specific source within a defined time window. By setting thresholds for connections, requests per second, or bandwidth usage, it prevents a single attacker or a small group of bots from overwhelming server resources. This method helps to differentiate between legitimate traffic spikes and malicious floods, allowing the system to maintain availability for valid users while shedding excessive, potentially harmful traffic.

Ophcrack is a dedicated password cracker specifically designed to recover Windows LM and NTLM hashes by employing precomputed rainbow tables. This tool efficiently performs lookups within its extensive tables to reverse hashes back into their original plaintext passwords, making it exceptionally fast for common password sets. Its specialized focus on these hash types, combined with its user-friendly graphical interface, positions it as the optimal choice for this particular hash cracking method in a penetration testing scenario.

Adware is specifically designed to display unwanted advertisements, often in the form of pop-ups, banners, or injected ads within web pages. This constant display and the underlying processes required to generate these ads consume significant CPU and RAM, leading directly to noticeable system sluggishness. It frequently alters browser settings, making it a direct cause for both the reported performance degradation and persistent pop-ups.

enum4linux is a comprehensive tool specifically designed for enumerating information from Windows and Samba hosts. It automates the process of extracting user lists, group memberships, shared resources, password policies, and other critical details by querying NetBIOS and SMB services. This makes it highly effective for gathering intelligence on a Windows target, going beyond simple port identification to deep service enumeration.

Tailgating exploits the human element of physical security: the attacker gains entry by closely following an authorised employee through a secured door, bypassing badge authentication entirely. The stem's constraint is unauthorised physical access without credentials, which tailgating satisfies precisely.

Slowloris is a low-bandwidth attack that does not generate a high volume of data packets. Instead, it exploits the server's connection handling by opening numerous legitimate-looking HTTP connections and then keeping them alive for extended durations. This is achieved by sending partial HTTP requests and periodically sending additional, non-terminating HTTP headers, preventing the server from timing out the connection and freeing up resources. The prolonged open state of these connections, despite minimal data transfer, exhausts the server's available connection pool.

The Simple Mail Transfer Protocol (SMTP) is the correct answer because it includes specific commands like `VRFY` (verify) and `EXPN` (expand) that can be leveraged for user enumeration. The `VRFY` command attempts to validate a specific email address or username on the target mail server, often returning a 250 OK response if the account exists. Similarly, `EXPN` can reveal members of a mailing list or alias, indirectly confirming valid user accounts. When not disabled or restricted, these commands provide a direct method for attackers to identify valid user accounts on a system.

Ophcrack is a free, open-source password cracker specifically designed for Windows passwords, making it the correct answer. It leverages precomputed rainbow tables, often distributed as a live CD or USB, which are highly optimized for cracking LM (LAN Manager) and NTLM hashes. Its primary function and user-friendly interface are tailored to exploit the known weaknesses of these Windows authentication protocols, providing an efficient and straightforward solution for recovering Windows user passwords.

For HTTP Response Splitting to occur, user-supplied input containing CRLF sequences must be directly incorporated into an HTTP response header. This allows an attacker to terminate the current header line and inject new, arbitrary header fields or even an entirely new response body. Without this direct reflection in the headers, the injected CRLF sequences would not be interpreted as control characters for the HTTP protocol, making the attack impossible.

SMiShing, a portmanteau of 'SMS' and 'phishing,' is a specific type of social engineering attack that utilizes text messages to deceive recipients. Attackers send fraudulent SMS messages, often containing malicious links that lead to credential harvesting sites or malware downloads, or instructing victims to call a fraudulent number. This method exploits the trust users place in their mobile devices and the immediacy of text messages to prompt quick, unthinking responses, making it the direct answer for an SMS-based attack.

A brute force attack is an exhaustive password cracking method that systematically attempts every possible character combination (letters, numbers, symbols) of a specified length until the correct password or key is discovered. While computationally intensive, especially for long and complex passwords, it guarantees success given sufficient time and processing resources. This makes it a fundamental and powerful technique in a cracker's arsenal.

SUID (Set User ID) and SGID (Set Group ID) are special permissions in Linux that allow an executable to run with the privileges of the file's owner or group, respectively, rather than the user executing it. If a program with SUID permissions is owned by root and can be manipulated (e.g., by executing arbitrary commands or writing to sensitive files), it can be abused for privilege escalation. This is a common and effective technique on Linux systems.

MAC flooding is an attack designed to overwhelm a network switch's MAC address table (CAM table) by sending a large number of frames with unique, spoofed source MAC addresses. When the CAM table becomes full, the switch often enters a "fail-open" mode, behaving like a hub by broadcasting all incoming traffic to all ports. The `macof` utility, part of the `dsniff` suite, automates this process by rapidly generating and sending thousands of frames with random source MAC and IP addresses, effectively causing the switch to flood traffic.

Pacu is specifically engineered as an open-source exploitation framework for AWS, providing a comprehensive suite of modules tailored for active penetration testing. It excels in the exploitation phase by leveraging identified misconfigurations or weak credentials to gain unauthorized access or elevate privileges within an AWS account. Furthermore, Pacu facilitates post-exploitation activities such as establishing persistence, enumerating sensitive data, performing lateral movement across AWS services, and backdooring resources, making it a powerful tool for simulating real-world attacks.

Banner grabbing involves connecting to a network service (e.g., HTTP, FTP, SSH) and observing the initial data or "banner" it sends back. This banner frequently contains crucial information such as the service name, its specific version number, and sometimes even the underlying operating system or patch level. Identifying these versions is critical for penetration testers to pinpoint known vulnerabilities associated with particular software releases, enabling targeted exploit attempts.

Object-Relational Mappers (ORMs) provide an effective defense against SQL injection by abstracting database interactions and typically generating parameterized queries. Instead of concatenating user input directly into SQL strings, ORMs bind input values as parameters, ensuring they are treated as data and not executable code. This fundamental separation prevents malicious input from altering the query's structure, thereby neutralizing injection attempts.

Phishing is a prevalent cyberattack where adversaries employ deceptive emails to trick recipients into divulging confidential information or executing malicious actions. The Social Engineering Toolkit (SET) is frequently used to craft convincing fake login pages or deliver malware via email attachments, making it a classic vector for credential harvesting or system compromise. This method leverages trust and urgency to bypass security awareness and technical controls.

Mantraps are highly effective physical security controls consisting of two interlocking doors, designed to permit only one person to pass through at a time after successful authentication. This physical barrier directly prevents tailgating by making it impossible for a second individual to enter behind an authorized person. Coupling this technical control with a strictly enforced policy reinforces security protocols, ensuring both physical and administrative measures actively mitigate the tailgating threat.

Time-based blind SQL injection is the appropriate technique when the application provides no direct output and no discernible boolean difference in its responses. This method relies on making the database server pause for a specific duration (e.g., using `SLEEP()`, `WAITFOR DELAY`, or `PG_SLEEP()`) if a particular injected condition is met. By measuring the time taken for the server to respond, the penetration tester can infer the truthfulness of conditions and extract data character by character.

Spear phishing is a highly targeted form of phishing that uses personalized information to increase the credibility and effectiveness of the attack. Attackers conduct reconnaissance to gather details about the target, such as their name, job title, company, and even internal relationships, to craft a convincing email. An email appearing to be from the CEO to a specific employee leverages this personalized context and perceived authority, making it a classic example of a spear phishing attempt designed to elicit a specific response.

Server-Side Request Forgery (SSRF) occurs when an attacker exploits a vulnerability in a web application to compel the server itself to make arbitrary requests. These requests can target internal network resources, such as other services, databases, or cloud metadata APIs, which are typically inaccessible directly from the internet. The server acts as a proxy, fetching data or performing actions on behalf of the attacker, often bypassing firewall rules and network segmentation. This allows for reconnaissance, port scanning, and even direct interaction with sensitive internal systems.

ARP poisoning floods the segment with forged ARP replies binding the gateway IP to an attacker MAC, so victims send traffic to the attacker instead of the real router. The mismatched MAC in the captured replies is the defining signature.

Collecting data from Open Source Intelligence (OSINT) sources, such as Shodan for internet-facing device information or social media for organizational details, is a purely passive reconnaissance technique. This method involves querying publicly available databases and websites, generating no direct network traffic to the target's infrastructure, thus ensuring complete undetectability.

Using a gelatin mold is a classic and often effective method for creating a spoofed fingerprint, as gelatin can accurately capture and replicate the unique ridge patterns and valleys of an authorized user's print. When pressed against a scanner, particularly older optical or capacitive types lacking advanced liveness detection, the gelatin replica can mimic the electrical or optical properties of a real finger. This allows the penetration tester to deceive the biometric system into granting access.

Correct: `airodump-ng` is utilized to monitor wireless traffic and capture the WPA/WPA2 4-way handshake, which is essential for offline password cracking. To expedite this process, a deauthentication attack (typically executed with `aireplay-ng` alongside `airodump-ng`) is employed. This attack forces an authenticated client to disconnect and then immediately reconnect to the access point, thereby generating the necessary handshake frames for `airodump-ng` to record.

MAC flooding overwhelms the switch's CAM table with forged source MAC addresses, exhausting its capacity. Once full, the switch cannot map addresses to ports and floods all incoming frames out of every port, satisfying the described symptom of indiscriminate flooding.

A mantrap at the main entrance is a robust physical security control that effectively prevents tailgating and unauthorized physical access to the premises. Simultaneously, requiring multi-factor authentication (MFA) for all password reset requests significantly strengthens logical security by making it much harder for social engineers to gain unauthorized account access, even if they successfully trick an employee into initiating a reset. This combination addresses both physical and social engineering vulnerabilities comprehensively.

The `--dbs` option explicitly instructs sqlmap to enumerate and display the names of all accessible databases on the target system by querying the database's information schema or system tables. Concurrently, the `--batch` option ensures that sqlmap operates in a non-interactive mode, automatically accepting default choices and proceeding without requiring user input for any prompts or questions that might arise during the enumeration process. This combination efficiently retrieves database names without interruption, which is ideal for automated scripting.

Correct. Rate limiting can throttle attack traffic.

DNS zone transfers, specifically AXFR (full zone transfer) and IXFR (incremental zone transfer), are designed to replicate DNS zone data between primary and secondary name servers. By configuring the authoritative DNS server to only permit these transfers from a predefined list of trusted IP addresses (typically the secondary DNS servers), an administrator directly prevents unauthorized entities from enumerating an entire domain's host records. This access control mechanism is the primary and most effective defense against malicious reconnaissance via zone transfers.

Burp Proxy is the core interception component of Burp Suite, acting as a man-in-the-middle between the browser and the target web server. It is specifically designed to capture all HTTP and HTTPS traffic flowing through it, allowing security professionals to view, analyze, and modify requests and responses in real-time before they reach their destination. This real-time interception capability is fundamental for understanding application logic, identifying vulnerabilities, and manipulating data during penetration testing.

SNMP Management Information Bases (MIBs) are structured databases that store a wealth of information about network devices. Many standard MIB objects, such as those under the `host` or `users` branches, are designed to expose system details like operating system versions, running services, and even lists of local user accounts. This information, often accessible with a default read-only community string, is invaluable for attackers performing reconnaissance to identify potential vulnerabilities or valid login names.

SSRF enables a malicious actor to force the vulnerable server to make requests to internal endpoints. Cloud instance metadata services, such as AWS IMDS (Instance Metadata Service), are often accessible from the instance itself via a well-known internal IP address (e.g., 169.254.169.254). An SSRF vulnerability can be leveraged to query these services, potentially retrieving sensitive information like temporary IAM role credentials, user data, or network configuration details, which can then be used for privilege escalation or further attacks within the cloud environment.

OSINT (Open Source Intelligence) using WHOIS queries is a highly effective passive information gathering technique. It involves querying public databases to retrieve domain registration details such as registrant names, contact information, registration and expiration dates, and nameservers. This method is considered passive because it does not directly interact with the target's live systems or network, relying solely on publicly available records.

Utilizing Shodan for target infrastructure searches is a quintessential passive reconnaissance technique because it relies entirely on pre-collected, publicly available data. Shodan continuously scans the internet and indexes information about internet-connected devices, services, and their configurations, storing this data in its own databases. An analyst querying Shodan does not send any direct network traffic to the target's systems, thereby avoiding detection and remaining completely non-intrusive.

The `ldapsearch -x -h <host>` command initiates an anonymous or simple authenticated query against an LDAP server. If successful, it enumerates directory attributes. The discovery of plaintext passwords within the returned LDAP attributes signifies a critical security misconfiguration, as sensitive user credentials are directly exposed. This poses a severe risk of credential theft, allowing attackers to reuse these passwords for lateral movement or access to other systems.

WEP key recovery using tools like aircrack-ng is the correct answer because WEP's fundamental cryptographic weakness stems from its inefficient use of Initialization Vectors (IVs) with the RC4 stream cipher. Attackers exploit the small 24-bit IV space and the plaintext transmission of IVs, leading to frequent IV reuse with the same WEP key. By collecting a large number of unique IVs, often hundreds of thousands to millions, statistical analysis can be performed to deduce the WEP key by observing patterns in the keystream generated from the IV and the key.

An evil twin is a rogue access point that impersonates a legitimate Wi-Fi network to trick clients into connecting. Once the victim connects, the attacker can capture the WPA2 handshake or credentials. This matches the scenario where the tester creates a fake AP with the corporate SSID to capture the handshake from a connecting client.

Weak service binary permissions represent a critical privilege escalation vulnerability where an attacker possesses write access to the executable file of a Windows service. By replacing the legitimate service binary with a malicious payload, such as a reverse shell or a user-creation script, the attacker can achieve elevated privileges. When the compromised service is subsequently started or restarted by the operating system, it will execute the attacker's code, typically under the SYSTEM account, granting full control over the machine.

The -sV flag instructs Nmap to perform service version detection on the specified port, which in this context is port 22, commonly used for SSH. Nmap achieves this by sending various probes to the port and analyzing the responses, often comparing banner grabs or protocol handshakes against its extensive service signature database. This process accurately identifies the specific SSH daemon and its version, such as OpenSSH 8.2p1, providing crucial intelligence for vulnerability assessment.

This option accurately describes the Nmap command's functionality. The -sU flag specifically instructs Nmap to perform a UDP port scan, targeting services that communicate via the User Datagram Protocol. Concurrently, the -sV flag enables service version detection, attempting to identify the application and its version running on any discovered open UDP ports. The -p 53,161,162 argument precisely limits this comprehensive scan to three specific UDP ports.

A downgrade attack specifically targets the SSL/TLS handshake process by forcing the communicating parties to negotiate and use an older, weaker, and often vulnerable version of the protocol. During the ClientHello message, an attacker intercepts and modifies the list of supported protocol versions, removing stronger options like TLS 1.2 or 1.3. This manipulation tricks the server into agreeing upon an outdated protocol, such as SSL 3.0 or TLS 1.0, which may contain known cryptographic weaknesses that can then be exploited for decryption or further compromise.

The `volatility -f memory.dmp netscan` command is crucial for initial malware investigation because it enumerates all active network connections present in the memory dump. This allows incident responders to quickly identify suspicious outbound connections to unknown or malicious IP addresses, which are strong indicators of command and control (C2) communication, data exfiltration, or botnet activity. Confirming such network activity is a primary step in validating a potential infection.

Tailgating is a physical security breach where an unauthorized individual gains access to a restricted area by following an authorized person through a controlled entry point without proper authentication. Once physically inside the secured perimeter, the attacker can connect their device to the internal network, potentially assigning themselves an unauthorized internal IP address, which would then be logged by the firewall attempting connections like SMB, indicating an internal compromise.

Log manipulation precisely describes the act of an attacker altering, deleting, or fabricating entries within system logs to obscure their malicious activities. This technique is crucial for covering tracks, evading detection by security monitoring systems, and hindering forensic investigations by removing evidence of unauthorized access or actions. Modifying log files directly addresses the scenario of removing specific entries.

A De-authentication attack specifically targets the IEEE 802.11 (Wi-Fi) standard by exploiting its management frames. An attacker spoofs the MAC address of either the legitimate access point or a client and sends de-authentication frames, which are unauthenticated, to force clients to disconnect from the wireless network. This denial-of-service technique directly leverages the stateless nature of 802.11 management frames, making it an attack inherently specific to wireless local area networks (WLANs).

Baiting is a social engineering attack that leverages human curiosity or greed by leaving physical media, such as USB drives or CDs, infected with malware in public or semi-public locations. The attacker relies on the victim finding the device and inserting it into their computer, thereby executing the malicious payload. The Social Engineering Toolkit (SET) is specifically designed to create such malicious payloads and facilitate the setup for baiting attacks, making it a direct match for this technique.

When an snmpwalk command successfully retrieves data using common or default community strings, it signifies that the device's SNMP agent is configured insecurely. This allows an attacker to access extensive Management Information Base (MIB) data, which frequently includes critical system details, network interface configurations, routing tables, and even potentially sensitive user account information. Such information leakage provides valuable reconnaissance for further targeted attacks.

Cross-Site Scripting (XSS) occurs when a web application incorporates untrusted data into a web page without proper validation or encoding, allowing attackers to inject client-side scripts. In the case of reflected XSS, the malicious script is immediately returned by the web server in its response and executed by the user's browser, directly impacting the content displayed to the user. This vulnerability directly manifests as unsanitized input being rendered in the browser.

Sniffing network traffic is a fundamental component of the CHPSET (Cracking, Hiding, Planting, Sniffing, Executing, Erasing) methodology, specifically corresponding to the 'Sniffing' phase. This involves passively capturing and analyzing data packets traversing a network segment to intercept sensitive information such as credentials, session tokens, or proprietary data. Attackers utilize tools like Wireshark or tcpdump to monitor network communications, gaining insights into network topology and identifying potential vulnerabilities for further exploitation.

Worms are a distinct category of malware known for their ability to self-replicate and propagate independently across computer networks without requiring user interaction. They exploit vulnerabilities in network protocols or services to spread from one system to another, consuming bandwidth and system resources. This autonomous replication is their defining characteristic, enabling rapid and widespread infection.

An SSRF vulnerability allows an attacker to manipulate a vulnerable server-side application into making arbitrary requests to internal network resources on behalf of the attacker. In cloud environments, this is critically dangerous as it can be leveraged to query the cloud provider's instance metadata service, typically found at a well-known, non-routable IP address like 169.254.169.254. Accessing this service often reveals temporary IAM credentials, instance profiles, and other sensitive configuration data, leading to privilege escalation or data exfiltration within the cloud infrastructure.

Installing a rootkit is a highly effective technique for covering an attacker's tracks by providing stealthy, persistent access. Rootkits are designed to modify the operating system's core functions, either at the kernel or userland level, to conceal files, processes, network connections, and other malicious artifacts from legitimate system utilities and security software. This sophisticated level of hiding allows an attacker to maintain a covert presence, making detection extremely challenging for administrators and forensic analysts.

Insecure MQTT (Message Queuing Telemetry Transport) protocol exploitation via default credentials is a common and critical vulnerability in IoT deployments. Many MQTT brokers are configured with weak or absent authentication, or rely on easily guessable default usernames and passwords. An attacker exploiting these weaknesses can subscribe to all topics, publish malicious commands, exfiltrate sensitive data, and gain unauthorized control over connected IoT devices, directly aligning with active exploitation behavior.

Phishing is a broad social engineering technique characterized by mass-distributed, generic fraudulent communications, typically via email, designed to trick recipients into revealing sensitive information like login credentials, credit card numbers, or installing malware. These attacks often impersonate well-known entities such as banks, social media platforms, or online services, using urgent or alarming language to prompt immediate action. The email described, claiming to be from a bank and likely seeking credentials from a general user, perfectly aligns with the characteristics of a classic phishing campaign.

This option represents the most common and standard configuration for a modern web server. A single instance of web server software, such as Apache or Nginx, is typically configured to listen on both port 80 for unencrypted HTTP traffic and port 443 for secure HTTPS communication. The Nmap output identifying the same server version on both ports directly supports this interpretation, as the server handles both protocols from a unified configuration.

Setting up a rogue RADIUS server is a highly effective attack against WPA2-Enterprise networks. By impersonating the legitimate authentication server, the rogue RADIUS server can trick clients into authenticating against it. During this process, it captures the challenge-response hashes, such as NTLMv2 hashes from PEAP/MSCHAPv2, which are exchanged during the EAP authentication phase. These captured hashes can then be subjected to efficient offline dictionary or brute-force attacks to recover the actual user credentials, providing unauthorized access.

Pretexting is a highly targeted social engineering technique where an attacker creates a fabricated scenario or 'pretext' to manipulate a victim into divulging sensitive information or performing an action. This often involves extensive research to develop a believable false identity and backstory, making the attacker appear legitimate and authoritative during direct interactions like phone calls. The tester's action of calling with a false identity to extract information perfectly aligns with this method's characteristics.

Reflected XSS occurs when a malicious script injected into an HTTP request is immediately returned in the server's HTTP response without being permanently stored. The payload is non-persistent, executing only once in the victim's browser as part of that specific request and response cycle. The observation that the application 'reflects' the input directly aligns with this immediate, one-time execution characteristic, making it the correct answer.

This option directly addresses data confidentiality for Zigbee communications within the smart building. The Zigbee security suite, specifically utilizing AES-128 symmetric encryption, encrypts data packets exchanged between sensor devices and the coordinator. This prevents unauthorized eavesdropping and ensures the privacy of sensitive sensor readings, which is crucial for maintaining the security and integrity of the smart building's operational data.