Which of the following is an example of passive OS fingerprinting?

Sending a series of TCP packets with different flags to the target

Performing a ping sweep to identify live hosts

Using Nmap's -O option to detect the OS

Analyzing TTL values and TCP window sizes in captured packets

In the context of reconnaissance, what is the primary purpose of service discovery?

To identify the operating system version of the target

To identify which network services are running on target systems and their associated ports

To determine the physical location of the target server

To map the internal network topology and routing paths

A security analyst is investigating a suspected compromised host. The analyst has a packet capture of the host's outbound traffic and wants to determine the host's operating system without sending any additional packets to it. Which technique should the analyst use?

Banner grabbing from the host's open ports.

Active OS fingerprinting with Nmap's -O flag against the host.

Passive OS fingerprinting using TTL values and TCP window sizes from the capture.

Analyzing the host's DNS queries to infer the OS.

EC-CouncilCertified Ethical Hacker

Domain 2Objective 5

Service and OS Discovery CEH Practice Questions (Page 4)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

8concepts

Questions 16–20

16foundation · easy
Which of the following is an example of passive OS fingerprinting?
Select an answer first
17expert · hard
A security analyst is scanning a target that has a firewall that drops all incoming TCP packets with the SYN flag set. The analyst wants to identify open TCP ports. Which scan type is most likely to succeed?
Select an answer first
18foundation · easy
In the context of reconnaissance, what is the primary purpose of service discovery?
Select an answer first
19application · medium
A security analyst is investigating a suspected compromised host. The analyst has a packet capture of the host's outbound traffic and wants to determine the host's operating system without sending any additional packets to it. Which technique should the analyst use?
Select an answer first
20application · easy
A security engineer is scanning a web server and finds port 443 open. The engineer wants to determine the exact version of the web server software. Which Nmap command is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Service and OS Discovery CEH Practice Questions (Page 4)

Questions 16–20

Which of the following is an example of passive OS fingerprinting?

A security analyst is scanning a target that has a firewall that drops all incoming TCP packets with the SYN flag set. The analyst wants to identify open TCP ports. Which scan type is most likely to succeed?

In the context of reconnaissance, what is the primary purpose of service discovery?

A security analyst is investigating a suspected compromised host. The analyst has a packet capture of the host's outbound traffic and wants to determine the host's operating system without sending any additional packets to it. Which technique should the analyst use?

A security engineer is scanning a web server and finds port 443 open. The engineer wants to determine the exact version of the web server software. Which Nmap command is most appropriate?

Keep studying — Reconnaissance Techniques