CEH Footprinting, Reconnaissance and Scanning Practice Question
A penetration tester runs `nmap -sI 192.168.1.10 -p 80 10.0.0.1` and receives output indicating port 80 is open. The scan uses a zombie host. Which type of scan is this?
⚠ Common exam trap
Candidates often confuse the `-sI` flag with decoy scans (`-D`) because both involve spoofing, but idle scans uniquely require a zombie host and IP ID analysis, not just multiple decoy IPs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Idle scan
The `-sI` flag in Nmap specifies an idle scan, which uses a zombie host (192.168.1.10) to probe the target (10.0.0.1). By observing changes in the zombie's IP ID sequence, the attacker can infer whether a port on the target is open or closed without revealing their own IP address. The output indicating port 80 is open confirms the scan type as an idle scan.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Idle scan
Why this is correct
The Nmap idle scan (-sI) is a highly stealthy technique that allows a penetration tester to scan a target without sending any packets directly from their own IP address. Instead, it leverages a "zombie" host's IP ID sequence to infer open ports on the target. By observing changes in the zombie's IP ID, the scanner can determine if the target responded to a forged packet sent from the zombie, thus achieving a truly blind scan, matching the 'si' flag in the command.
- ✗
SYN scan
Why it's wrong here
A SYN scan (-sS), also known as a half-open scan, sends a SYN packet to the target port and waits for a SYN/ACK response. If received, Nmap immediately sends an RST packet to prevent a full TCP connection, making it faster and less likely to be logged by the target application. While efficient and stealthier than a full TCP connect scan, the command `nmap si` does not specify the `-sS` flag, making this option incorrect for the given input.
- ✗
Decoy scan
Why it's wrong here
A decoy scan (-D) involves sending scan packets from multiple spoofed IP addresses alongside the actual scanner's IP, making it difficult for the target to determine the true source of the scan. This technique aims to obfuscate the penetration tester's identity by blending their traffic with that of several decoys. The provided Nmap command `nmap si` does not include the `-D` flag or specify any decoy IP addresses, therefore it is not a decoy scan.
- ✗
Fragmentation scan
Why it's wrong here
A fragmentation scan (-f) attempts to bypass simple packet filters and intrusion detection systems by splitting the TCP header into several smaller packets. Instead of sending one large packet, Nmap sends fragments that, when reassembled by the target, form the complete TCP header. This technique exploits systems that only inspect the first fragment, but the command `nmap si` does not utilize the `-f` flag to enable packet fragmentation.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.