During an authorized security assessment of a smart home product manufacturer in San Jose, California,...

The correct answer is C. DNS Rebinding Attack.

The key behavior is that an external website causes the victim’s browser to send requests to an internal, locally hosted IoT management interface. This is characteristic of DNS rebinding, where the attacker abuses browser trust and DNS resolution behavior so that a malicious web page can interact with private-network resources.

CEH-aligned IoT material identifies Insecure Web Interface and Insufficient Authentication/Authorization as important IoT weaknesses, especially because many device interfaces are intended to be exposed only on internal networks but can still be threatened from internal users or browser-based interaction paths . DNS rebinding specifically abuses this condition by using the victim’s browser as a bridge into the private network.

Option A. Forged Malicious Device Attack is incorrect because no rogue IoT device is being introduced.

Option B. SDR-Based Attack is incorrect because software-defined radio attacks target wireless/radio communications, not browser-based access to local web interfaces.

Option D. Distributed Denial-of-Service (DDoS) Attack is incorrect because the scenario is not about flooding or service exhaustion.

Therefore, the best answer is C. DNS Rebinding Attack.