CEH Enumeration and System Hacking Practice Question
Which of the following is a passive OS fingerprinting technique?
⚠ Common exam trap
Test-takers frequently confuse 'passive' with 'stealthy' scanning, often picking nmap -O with stealth flags (e.g., -sS) as passive, but any active packet injection, regardless of stealth, constitutes active fingerprinting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Capturing packets and analyzing TTL values
Passive OS fingerprinting involves observing network traffic without actively sending packets to the target. Option D is correct because capturing packets and analyzing TTL (Time to Live) values allows an attacker to infer the operating system, as different OSes use default TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255). This technique does not generate any probe traffic, making it passive.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using nmap -O
Why it's wrong here
Using nmap -O is an active OS fingerprinting technique because the '-O' flag instructs Nmap to send a series of specially crafted TCP/IP probes (e.g., SYN, FIN, NULL, Xmas, ACK, ICMP echo) to the target system. Nmap then analyzes the responses, observing characteristics like initial TCP window size, TCP options supported, IP ID sequences, and initial TTL values. This direct interaction and generation of new network traffic to elicit a response is the hallmark of an active reconnaissance method.
- ✗
Performing a ping sweep
Why it's wrong here
Performing a ping sweep is an active reconnaissance method, not a passive OS fingerprinting technique. A ping sweep involves actively sending ICMP Echo Request packets to a range of IP addresses within a network segment. The purpose is to identify which hosts are currently online by observing their ICMP Echo Reply packets, thereby generating new network traffic and directly interacting with each potential target system.
- ✗
Sending SYN packets and analyzing responses
Why it's wrong here
Sending SYN packets and analyzing responses constitutes an active OS fingerprinting technique. This method involves deliberately initiating a TCP handshake by sending SYN packets to various ports on a target system and then meticulously examining the characteristics of the SYN-ACK or RST packets received in response. Key indicators like the initial TCP window size, specific TCP options present, and the initial Time-To-Live (TTL) value are analyzed to infer the operating system, all of which require direct interaction and new traffic generation.
- ✓
Capturing packets and analyzing TTL values
Why this is correct
Capturing packets and analyzing TTL values is a classic passive OS fingerprinting technique because it involves observing existing network traffic without sending any new packets to the target system. By passively sniffing packets that the target has already transmitted as part of its normal communication, an analyst can examine the Time-To-Live (TTL) field in the IP header. Different operating systems initialize TTL to distinct default values (e.g., 64, 128, 255), allowing for OS identification without any direct interaction or traffic generation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.