CEH Footprinting, Reconnaissance and Scanning Practice Question
A penetration tester wants to perform a stealthy TCP scan that does not complete the three-way handshake. Which Nmap flag should be used?
⚠ Common exam trap
A common mix-up: candidates confuse -sS (SYN scan) with -sT (TCP connect scan), mistakenly thinking that -sT is stealthy because it uses TCP, but -sT actually completes the full handshake and is easily logged, while -sS is the true stealthy option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
-sS
(-sS) is correct because it performs a SYN scan, which sends a TCP SYN packet and waits for a SYN-ACK response without completing the three-way handshake (i.e., it sends a RST instead of an ACK). This makes the scan stealthy as it avoids establishing a full TCP connection, reducing the chance of being logged by the target.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
-sU
Why it's wrong here
The -sU option instructs Nmap to perform a UDP scan, which sends UDP packets to target ports to determine their state. This method is entirely distinct from TCP scanning, as it operates on a different protocol layer and does not involve the TCP three-way handshake mechanism. Therefore, it is irrelevant for performing a stealthy *TCP* scan, as it cannot detect TCP port states or employ TCP-specific stealth techniques.
- ✓
-sS
Why this is correct
The -sS option initiates a SYN scan, often referred to as a 'stealth scan,' because it does not complete the full TCP three-way handshake. Nmap sends a SYN packet and, if a SYN/ACK is received, immediately responds with an RST packet, preventing the target system from logging a fully established connection. This technique allows the penetration tester to identify open TCP ports while minimizing the footprint and avoiding detection by many intrusion detection systems and application logs.
- ✗
-sV
Why it's wrong here
The -sV option is used for version detection, not as a primary port scanning technique to determine port state or achieve stealth. After Nmap identifies open ports, -sV sends various probes to those ports to identify the specific service and its version running on them. This process often involves completing TCP connections and exchanging application-layer data, which is inherently not stealthy and serves a different purpose than initial port discovery.
- ✗
-sT
Why it's wrong here
The -sT option performs a full TCP connect scan, which is the least stealthy of the TCP scanning methods. This scan relies on the operating system's native `connect()` system call to establish a complete TCP three-way handshake with the target port. Because a full connection is established and then torn down, it is easily logged by the target's operating system, firewalls, and application services, making it highly detectable.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.