CEH Footprinting, Reconnaissance and Scanning Practice Question
A security analyst receives an alert from the IDS indicating a port scan originating from IP 10.0.0.5. Upon investigation, the analyst finds that 10.0.0.5 is a legitimate internal server. Which type of scan is the attacker likely using to evade detection?
⚠ Common exam trap
A common mix-up: candidates confuse a decoy scan with an idle scan, mistakenly thinking that using a legitimate internal server as a decoy is the same as using a zombie host, but idle scans rely on IP ID side-channel analysis and do not involve spoofing the attacker's own traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Decoy scan
A decoy scan (option C) is the correct answer because it allows the attacker to blend their real IP address with multiple spoofed IP addresses, making it appear as though the scan originates from several hosts. In this scenario, the IDS alerts on IP 10.0.0.5, which is a legitimate internal server, indicating that the attacker is using that server's IP as a decoy to evade detection and misdirect the analyst's investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SYN scan
Why it's wrong here
A SYN scan, also known as a half-open scan, sends TCP SYN packets to target ports and waits for a SYN/ACK response to identify open ports without completing the three-way handshake. Crucially, this technique uses the attacker's actual source IP address, meaning an IDS would accurately log the attacker's machine as the origin of the scan, not a spoofed or decoy IP. Therefore, it does not involve hiding the true source among multiple IPs.
- ✗
Idle scan
Why it's wrong here
An Idle scan leverages a 'zombie' host's IP ID sequence to infer open ports on a target without sending packets directly from the attacker's machine. The attacker spoofs the zombie's IP address as the source for probe packets sent to the target. While it hides the attacker's true IP, the IDS would primarily register the zombie's IP as the source of the scan, not multiple arbitrary legitimate servers or decoys.
- ✓
Decoy scan
Why this is correct
A Decoy scan is specifically designed to obscure the true source of a port scan by interspersing the attacker's real IP address with several spoofed IP addresses. The target receives scan packets appearing to originate from multiple hosts simultaneously, including the attacker's actual IP and numerous fake decoys. This technique generates significant noise in IDS logs, making it challenging to distinguish the legitimate attacker from the fabricated sources, potentially flagging one of the decoy IPs as the source.
- ✗
Fragmentation scan
Why it's wrong here
A Fragmentation scan attempts to evade network security devices, such as firewalls and IDSs, by splitting the TCP header across multiple IP fragments. This technique aims to bypass rules that only inspect the initial fragment for specific flags or port numbers. However, a fragmentation scan does not involve IP spoofing; the source IP address in all fragments remains the attacker's actual IP, making the origin traceable despite the packet manipulation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.