CEH Footprinting, Reconnaissance and Scanning Practice Question
During a penetration test, the tester needs to identify the operating system of a remote host without sending any packets to it. Which technique should the tester use?
⚠ Common exam trap
Test-takers frequently confuse 'passive OS fingerprinting' with 'banner grabbing' or 'Shodan queries,' assuming any non-intrusive method qualifies, but the key constraint is 'without sending any packets,' which eliminates all options except passive analysis of already-captured traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Passive OS fingerprinting using captured packets
Passive OS fingerprinting (Option B) is correct because it analyzes captured network traffic—such as TCP/IP packet headers, TTL values, window sizes, and DF flags—to infer the remote host's operating system without sending any packets. This technique relies on subtle differences in how various OS stacks implement RFC 793, making it ideal for stealthy reconnaissance where no direct contact with the target is permitted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Banner grabbing with Telnet
Why it's wrong here
Banner grabbing with Telnet is an active reconnaissance technique that involves directly connecting to a target service, such as an HTTP or FTP port, to retrieve its identifying banner. This interaction sends packets to the target system, making the activity detectable by intrusion detection systems or network logs. Therefore, it does not align with the requirement of identifying information without sending packets or directly interacting with the target.
- ✓
Passive OS fingerprinting using captured packets
Why this is correct
Passive OS fingerprinting analyzes network traffic that has already been captured or is passively observed, without sending any new packets to the target. Tools like p0f examine characteristics within TCP/IP headers, such as initial Time-To-Live (TTL) values, window sizes, Don't Fragment (DF) bit settings, and TCP options, to infer the operating system. This method is highly stealthy as it leaves no trace on the target system, making it ideal for undetected reconnaissance.
- ✗
Querying Shodan for the target IP
Why it's wrong here
Querying Shodan for a target IP address retrieves information from Shodan's pre-existing database of internet-connected devices. While the penetration tester themselves is not actively sending packets to the target at that moment, this method relies on Shodan's prior active scanning of the internet. It is not "passive OS fingerprinting using captured packets" because the tester is not directly analyzing live or captured network traffic from the target to deduce its OS.
- ✗
Active OS fingerprinting with Nmap -O
Why it's wrong here
Active OS fingerprinting using Nmap -O involves sending a series of specially crafted probes to the target system to elicit specific responses. Nmap analyzes these responses, including TCP SYN, FIN, NULL, and Xmas packets, along with various IP and ICMP probes, to determine the operating system based on its unique TCP/IP stack implementation. This direct interaction generates network traffic originating from the tester to the target, making it an active and potentially detectable reconnaissance method.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.