CAS-002 · Question #839
Company policy requires that all unsupported operating systems be removed from the network. The security administrator is using a combination of network based tools to identify such systems for the…
The correct answer is A. Passive banner grabbing F. 09:18:16.262743 IP (tos 0x0, ttl 64, id 9870, offset 0, flags [none], proto TCP (6), length 40) G. Nmap. Identifying the operating system of network devices relies on passive observation and active scanning techniques that reveal OS-specific characteristics such as TTL values and service banners.
Question
Company policy requires that all unsupported operating systems be removed from the network. The security administrator is using a combination of network based tools to identify such systems for the purpose of disconnecting them from the network. Which of the following tools, or outputs from the tools in use, can be used to help the security administrator make an approximate determination of the operating system in use on the local company network? (Select THREE).
Options
- APassive banner grabbing
- BPassword cracker
- D443/tcp open http
- Edig host.company.com
- F09:18:16.262743 IP (tos 0x0, ttl 64, id 9870, offset 0, flags [none], proto TCP (6), length 40)
- GNmap
How the community answered
(41 responses)- A83% (34)
- B2% (1)
- D10% (4)
- E5% (2)
Why each option
Identifying the operating system of network devices relies on passive observation and active scanning techniques that reveal OS-specific characteristics such as TTL values and service banners.
Passive banner grabbing captures service banners from running network services without sending active probes; these banners frequently include OS or software version strings that directly identify the underlying operating system.
A password cracker is used to recover authentication credentials and provides no information about the operating system running on a target device.
The output '443/tcp open http' only indicates a web service is running on port 443 and contains no OS-specific indicators useful for fingerprinting.
The 'dig' command performs DNS queries and returns DNS record data, which contains no operating system identification information.
The tcpdump packet capture output shows a TTL value of 64, which is the default TTL used by Linux/Unix systems - different operating systems use characteristic default TTL values (Linux: 64, Windows: 128, Cisco: 255), enabling OS fingerprinting through passive capture.
Nmap includes an active OS detection engine (-O flag) that analyzes TCP/IP stack behaviors such as TTL, window size, and sequence number patterns to fingerprint the operating system of remote hosts with high accuracy.
Concept tested: OS fingerprinting via passive and active network reconnaissance
Source: https://nmap.org/book/man-os-detection.html
Topics
Community Discussion
No community discussion yet for this question.