CEH Footprinting, Reconnaissance and Scanning Practice Question
A security analyst receives an alert about a scan originating from an IP address that appears to be using a 'sIdle scan' technique. Which of the following characteristics would confirm this?
⚠ Common exam trap
Watch out — candidates often confuse the idle scan with other spoofing or relay techniques like FTP bounce or decoy scans, but the idle scan is uniquely defined by the use of a zombie host's IPID changes to infer port states, not by hiding the attacker's IP via relays or multiple decoys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The scan sends SYN packets with the zombie host's IP address as the source and monitors IPID changes on the zombie to determine open ports
An idle scan (also known as a zombie scan) relies on sending SYN packets to the target with the spoofed source IP address of a zombie host, then monitoring the IPID sequence on that zombie to infer whether the target port is open, closed, or filtered. The key characteristic is the use of the zombie's IP as the source and the observation of IPID changes on the zombie, which is exactly what option C describes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The scan uses fragmented packets and decoy IP addresses
Why it's wrong here
This statement describes common evasion techniques used to bypass intrusion detection systems or obscure the attacker's true origin. Packet fragmentation involves splitting a single packet into multiple smaller ones, while decoy IP addresses involve sending packets from multiple spoofed sources to confuse monitoring. However, these methods are not integral to the idle scan's fundamental operation, which relies on observing IPID changes of a zombie host, making this an incorrect description of an idle scan's core mechanism.
- ✗
The scan uses FTP bounce to hide the true source IP
Why it's wrong here
FTP bounce scanning is a distinct technique where an attacker uses a vulnerable FTP server's PORT command to instruct the server to establish a connection to a target host and port on behalf of the attacker. This method effectively proxies the scan through the FTP server, thereby masking the attacker's true source IP address. This mechanism is entirely different from an idle scan, which exploits predictable IPID increments of an idle host.
- ✓
The scan sends SYN packets with the zombie host's IP address as the source and monitors IPID changes on the zombie to determine open ports
Why this is correct
This option accurately describes the idle scan's core methodology. The attacker first probes an idle "zombie" host to record its current IPID (IP Identification field). Subsequently, the attacker sends spoofed SYN packets to the target, using the zombie's IP address as the source. If the target port is open, it responds with a SYN-ACK to the zombie, causing the zombie to send an RST to the target and increment its IPID. If the target port is closed, it responds with an RST to the zombie, which does not increment the zombie's IPID. A final probe to the zombie reveals whether its IPID has incremented, indicating an open port on the target.
- ✗
The scan shows a SYN packet with the attacker's real IP but uses a zombie host to relay replies
Why it's wrong here
This description is incorrect for an idle scan. A fundamental aspect of an idle scan is that the attacker *spoofs* the zombie host's IP address as the source for the SYN packets sent to the target, not their own real IP. The zombie host does not actively "relay replies" back to the attacker; instead, the attacker passively monitors the zombie's IPID sequence to infer whether the target responded to the spoofed SYN packets, indicating an open or closed port.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.