nerdexam
EC-Council

212-82 · Question #41

Henry Is a cyber security specialist hired by BlackEye -Cyber security solutions. He was tasked with discovering the operating system (OS) of a host. He used the Unkornscan tool to discover the OS of

The correct answer is B. 128. 128 is the TTL value that Henry obtained, which indicates that the target OS is Windows. TTL (Time to Live) is a field in the IP (Internet Protocol) header that specifies how long a packet can remain in a network before it is discarded or dropped. TTL is usually expressed in seco

Submitted by andreas_gr· Mar 6, 2026Cloud Security Operations & Incident Response

Question

Henry Is a cyber security specialist hired by BlackEye -Cyber security solutions. He was tasked with discovering the operating system (OS) of a host. He used the Unkornscan tool to discover the OS of the target system. As a result, he obtained a TTL value, which Indicates that the target system is running a Windows OS. Identify the TTL value Henry obtained, which indicates that the target OS is Windows.

Options

  • A64
  • B128
  • C255
  • D138

How the community answered

(62 responses)
  • A
    3% (2)
  • B
    89% (55)
  • C
    2% (1)
  • D
    6% (4)

Explanation

128 is the TTL value that Henry obtained, which indicates that the target OS is Windows. TTL (Time to Live) is a field in the IP (Internet Protocol) header that specifies how long a packet can remain in a network before it is discarded or dropped. TTL is usually expressed in seconds or hops (the number of routers or gateways that a packet passes through). TTL is used to prevent packets from looping endlessly in a network or consuming network resources.Different operating systems have different default TTL values for their packets. By observing the TTL value of a packet from a target system or network, one can infer the operating system of the target.Some common TTL values and their corresponding operating systems are: 64: Linux, Unix, Android In the scenario, Henry used Nmap tool to discover the OS of the target system. Nmap (Network Mapper) is a tool that can perform various network scanning and enumeration tasks, such as port scanning, OS detection, service identification, etc.Nmap can use various techniques to detect the OS of a target system, such as TCP/IP fingerprinting, which involves analyzing various TCP/IP characteristics of packets from the target system, such as TTL value. In the scenario, Henry obtained a TTL value of 128 , which indicates that the target OS is Windows.

Topics

#OS fingerprinting#TTL#Network scanning#Reconnaissance

Community Discussion

No community discussion yet for this question.

Full 212-82 Practice