A penetration tester wants to check manually if a "ghost" vulnerability exists in a system. Which of the following methods is the correct way to validate the vulnerability?

This choice is textually identical to choice C due to a question formatting error; based on technical context, a Windows-based approach is invalid because glibc does not exist on Windows.

Note - the answer choices in this question appear to contain a formatting error, as choices A and C are identical and choices B and D are identical, making it impossible to distinguish four unique options. Based on known technical facts, the GHOST vulnerability resides in glibc's gethostbyname() function, which is exclusive to Linux systems; therefore, correct manual validation requires downloading the proof-of-concept, compiling it on the target Linux system, and running it to observe whether the system crashes or behaves abnormally. A Windows system cannot be used because glibc is not a Windows component.

This choice is a duplicate of choice A and the same reasoning applies - the formatting corruption in this question prevents meaningful differentiation of the four options.

This choice is a duplicate of choice B and the same reasoning applies - the formatting corruption prevents a distinct analysis from being offered.