CEH Footprinting, Reconnaissance and Scanning Practice Question
A security analyst runs `nmap -sS -sV -A 192.168.1.100` and obtains open ports and service versions. However, the analyst suspects the target is behind an IDS/IPS. Which Nmap technique would BEST evade detection while still performing a similar scan?
⚠ Common exam trap
EC-Council often tests the misconception that faster scans (`-T5`) are stealthier, when in reality they increase noise and detection risk, while fragmentation (`-f`) is a recognized evasion technique for bypassing packet inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add -f to fragment IP packets
Using the `-f` flag fragments the IP packets, splitting the TCP header across multiple packets. This helps evade simple IDS/IPS signatures that rely on detecting a complete SYN scan in a single packet, as the fragmented packets may bypass pattern-matching rules or reassembly buffers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add -f to fragment IP packets
Why this is correct
Adding -f to fragment IP packets instructs Nmap to split the TCP header across multiple smaller IP packets. This technique, known as IP fragmentation, can bypass stateless firewalls and basic Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS) that are not configured to reassemble fragmented packets before inspection. By scattering the critical header information, it becomes more challenging for signature-based detection mechanisms to identify the scan pattern, thus aiding in evasion.
- ✗
Use -sT instead of -sS to perform a full TCP connect scan
Why it's wrong here
Using -sT performs a full TCP three-way handshake, which involves sending a SYN, receiving a SYN/ACK, and then sending an ACK to establish a complete connection. This full connection establishment is logged by target systems and network devices much more readily than the stealthy -sS (SYN scan), which only sends a SYN and then RSTs the connection, never completing the handshake. Consequently, a -sT scan significantly increases the likelihood of detection by host-based firewalls and network monitoring tools.
- ✗
Increase timing to -T5 for a faster scan
Why it's wrong here
Increasing timing to -T5 (Insane) makes the Nmap scan extremely aggressive, sending probes at a very high rate with minimal delays and timeouts. While this significantly speeds up the scan, the rapid succession of packets from a single source IP address is a strong indicator of scanning activity. Modern Intrusion Detection/Prevention Systems (IDS/IPS) are highly effective at identifying such high-volume, rapid-fire network traffic patterns, leading to quicker detection and potential blocking of the scanning host.
- ✗
Replace -sV with -sU to scan UDP services
Why it's wrong here
Replacing -sV (version detection) with -sU initiates a UDP port scan, which targets User Datagram Protocol services instead of TCP. While -sU is crucial for discovering open UDP ports and associated services, it does not inherently offer any evasion benefits against detection mechanisms designed for TCP-based scans. In fact, UDP scans can be slow and often generate significant network traffic, making them potentially detectable by network monitoring tools looking for unusual UDP activity.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.