CEH Footprinting, Reconnaissance and Scanning Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  It increases the timing template to T5 (insane)

  Why it's wrong here

  Increasing the timing template to T5 (insane) in tools like Nmap prioritizes scan speed over stealth and reliability. While it makes the scan very fast, it also generates a high volume of traffic in a short period, making it significantly easier for an Intrusion Detection System (IDS) to detect. IDSs are specifically designed to flag such aggressive and rapid network activity as suspicious, thus T5 is counterproductive for evasion.

• ✗

  It uses an idle scan by bouncing off a zombie host

  Why it's wrong here

  An idle scan (-sI) operates by bouncing off a "zombie" host, inferring open ports on a target by observing changes in the zombie's IP ID sequence. While this technique provides excellent source IP anonymity by never sending packets directly from the attacker's machine to the target, it does not inherently make the scan pattern itself less detectable by an IDS monitoring the target network. The target still receives the scan packets, which an IDS can analyze for signatures or anomalies.

• ✗

  It sends packets with a spoofed source IP address

  Why it's wrong here

  Sending packets with a spoofed source IP address, often using options like -D (decoy) or -S (source IP) in Nmap, aims to obscure the true origin of the scan or make it appear as if multiple hosts are scanning. Although this complicates traceback and attribution for network defenders, it does not directly alter the characteristics or signatures of the scan packets themselves. An IDS primarily analyzes the content and behavior of the packets arriving at the target, regardless of whether the source IP is legitimate or spoofed, making it ineffective for evading signature-based detection of the scan type.

• ✓

  It fragments the IP packets into 8-byte fragments

  Why this is correct

  Fragmenting IP packets into small segments, such as 8-byte fragments using the -f flag, is a classic IDS evasion technique. Many Intrusion Detection Systems struggle with the efficient and accurate reassembly of highly fragmented packets, especially if they arrive out of order or are unusually small. This difficulty can cause the IDS to miss the complete signature of a malicious payload or scan, allowing the fragmented traffic to bypass detection and reach the target.

Go deeper

Related to this question