Exam 312-50v12 topic 1 question 129 discussion

Actual exam question from ECCouncil's 312-50v12

Question #: 129
Topic #: 1

A skilled ethical hacker was assigned to perform a thorough OS discovery on a potential target. They decided to adopt an advanced fingerprinting technique and sent a TCP packet to an open TCP port with specific flags enabled. Upon receiving the reply, they noticed the flags were SYN and ECN-Echo. Which test did the ethical hacker conduct and why was this specific approach adopted?

A. Test 3: The test was executed to observe the response of the target system when a packet with URC, PSH, SYN, and FIN flags was sent, thereby identifying the OS
B. Test 2: This test was chosen because a TCP packet with no flags enabled is known as a NULL packet and this would allow the hacker to assess the OS of the target
C. Test 1: The test was conducted because SYN and ECN-Echo flags enabled to allow the hacker to probe the nature of the response and subsequently determine the OS fingerprint
D. Test 6: The hacker selected this test because a TCP packet with the ACK flag enabled sent to a closed TCP port would yield more information about the OS

Show Suggested Answer

Suggested Answer: C 🗳️

by DarioReymag at Feb. 6, 2024, 10:44 p.m.

Comments

Submit Cancel

yicx1

1 year ago

Test 6: send to closed port. Test 2: send empty packet to open port. Test 3: send packet with set flags SYN|FIN|URG|PSH on open port without any options So the answer is Test 1: send packet with SYN flag with TCP options on open ports

upvoted 1 times

...