A firewall or ACL is actively filtering the traffic is correct because silently discarding probes (stealth mode) indicates a security device is blocking the scanner's requests; The target system is in a powered-down state is incorrect because the host must be active to interact with (drop) incoming packets; The host has zero listening network ports is incorrect because the host is known to be running multiple services; and The vulnerability assessment finished without errors is incorrect because the scan produced a false negative and failed to identify the true state of the host. OBJ. 3.2

Adversary-in-the-middle (On-path) attack is correct because the consultant has positioned himself to intercept and monitor live traffic flowing between network endpoints; Database command injection is incorrect because the scenario involves network traffic interception rather than exploiting web forms to query a database; Vertical privilege elevation is incorrect because the consultant gained full administrative access immediately via default settings rather than exploiting a low-level account to gain higher rights; and Social engineering lure is incorrect because the breach was achieved through technical misconfiguration rather than psychological manipulation of a person.

Service Location (SRV) is correct because these records are specifically designed to advertise the hostname, port, and priority for specialized protocols like SIP; Descriptive Metadata (TXT) is incorrect because it is used for general information or security policies (like SPF) rather than defining service ports; Mail Routing (MX) is incorrect because it only identifies servers responsible for receiving email; and Authoritative Servers (NS) is incorrect because it points to the DNS servers for a zone rather than specific application services.

Pluggable scanning components is correct because SpiderFoot utilizes over 200 individual modules to automatically query different data sources (DNS, WHOIS, social media, etc.) based on the user's scan requirements; External visualization linking is incorrect because while it can export data to other tools, the automation happens within its own architecture; Live event notifications is incorrect because alerts are a monitoring feature rather than the mechanism for automated data collection; and Hand-keyed data input is incorrect because it contradicts the goal of using an automated OSINT tool. 

Deployment of full-disk or file-level encryption at rest is correct because it ensures that data remains ciphertext and unreadable if the physical storage is accessed without the decryption key; Implementation of dynamic data redaction is incorrect because masking typically protects data during display/output but does not secure the raw files on the disk; Mandatory use of encrypted tunnels for remote access is incorrect because a VPN only secures data in motion, not data already stored on the laptop's drive; and Execution of legally binding non-disclosure agreements is incorrect because an NDA is an administrative control that provides no technical barrier against a thief.

Perform decompilation using JAD is correct because it converts Java bytecode back into human-readable source code, which is necessary for static code analysis; Attach a low-level debugger like GDB is incorrect because GDB is used for dynamic analysis of native machine code, not for reconstructing Java source files; Reconstruct the logic using Hydra is incorrect because Hydra is a network-based password-cracking tool; and Conduct an automated fuzzing session with Peach is incorrect because fuzzing is a dynamic testing method used to find runtime crashes, not to analyze source code structure.

Scheduled window and duration of the assessment is correct because load testing can intentionally crash services, so it must be performed during off-peak hours to avoid impacting real users; Static network identifiers for the target nodes is incorrect because while necessary for targeting, knowing the IP doesn't mitigate the risk of an accidental outage; The level of architectural transparency provided is incorrect because whether the test is "black box" or "white box" is a methodology choice that doesn't solve the risk associated with high-traffic testing; and Authorization to bypass public key pinning is incorrect because this relates to intercepting encrypted traffic, not evaluating system scalability or load limits.

Windows Remote Management (WinRM) is correct because it is the Microsoft implementation of the WS-Management protocol, which specifically uses SOAP over HTTP/HTTPS for remote administration; Windows Management Instrumentation (WMI) is incorrect because it traditionally relies on DCOM and RPC (port 135) for its transport mechanism rather than the SOAP standard; Remote Process Execution (PsExec) is incorrect because it operates over the Server Message Block (SMB) protocol on port 445; and Automated Task Scheduling is incorrect because it is an execution or persistence technique that does not define a communication protocol like SOAP.

Wordlist-driven (Dictionary) attack is correct because the script utilizes a predefined set of likely passwords rather than trying every possible character combination; Adversary-in-the-middle interception is incorrect because the attack is performed locally on a file, not by intercepting network traffic; Active token theft is incorrect because the target is an encrypted file, not a live authenticated session; and Exhaustive character-space (Brute force) attempt is incorrect because it would attempt every mathematical possibility (e.g., 0001, 0002, 0003...) instead of relying on a targeted list of meaningful words.

Identity assumption (Impersonation) is correct because the tester now possesses the necessary credentials to pose as the legitimate user and send authentic-looking instructions (like fraudulent invoices) to other staff; Voice-based deception (Vishing) is incorrect because while it is a social engineering method, the tester already has the direct email access needed to influence processes; Broad email solicitation (Phishing) is incorrect because this is a primary delivery method used to obtain credentials, which the tester already has; and Protocol security reduction (Downgrade attack) is incorrect because it involves forcing a system to use a weaker encryption version, which is a technical network exploit rather than a business process manipulation.