nerdexam
EC-Council

312-50V9 · Question #519

You have initiated an active operating system fingerprinting attempt with nmap against a target system: What operating system is the target host running based on the open ports shown above?

The correct answer is D. Windows 2000 Server. The combination of open ports revealed by nmap OS fingerprinting - including RPC endpoint mapper (135), NetBIOS (139), SMB (445), and others typical of a domain-capable server - matches the Windows 2000 Server profile.

Scanning Networks

Question

You have initiated an active operating system fingerprinting attempt with nmap against a target system:

What operating system is the target host running based on the open ports shown above?

Exhibit

312-50V9 question #519 exhibit

Options

  • AWindows XP
  • BWindows 98 SE
  • CWindows NT4 Server
  • DWindows 2000 Server

How the community answered

(37 responses)
  • A
    14% (5)
  • B
    3% (1)
  • C
    5% (2)
  • D
    78% (29)

Why each option

The combination of open ports revealed by nmap OS fingerprinting - including RPC endpoint mapper (135), NetBIOS (139), SMB (445), and others typical of a domain-capable server - matches the Windows 2000 Server profile.

AWindows XP

Windows XP was released after Windows 2000 and has a distinct TCP/IP stack fingerprint with different TTL and window-size characteristics not matching the shown output.

BWindows 98 SE

Windows 98 SE uses an older TCP/IP stack without native SMB-over-445 support and lacks the RPC endpoint mapper port pattern seen on server editions.

CWindows NT4 Server

Windows NT4 Server predates native SMB-over-port-445 and has a distinct TCP sequence number generation pattern that nmap distinguishes from Windows 2000.

DWindows 2000 ServerCorrect

Windows 2000 Server exposes a characteristic set of ports including 135 (RPC endpoint mapper), 139 (NetBIOS session), 445 (SMB over TCP), and 1025+ (dynamic RPC), which together form a fingerprint nmap's OS detection engine maps to Windows 2000 Server. Earlier Windows versions such as NT4 lack the native SMB-over-445 stack, and desktop editions such as XP and 98 SE do not present the same server-grade service combination or TCP/IP stack behavior.

Concept tested: nmap active OS fingerprinting via open port analysis

Source: https://nmap.org/book/osdetect.html

Topics

#OS fingerprinting#nmap output interpretation#open ports#Windows OS detection

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice