CEH Footprinting, Reconnaissance and Scanning Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The analyst used the wrong port number

  Why it's wrong here

  The Nmap idle scan (`-sI`) primarily leverages the predictable IP ID sequence of a zombie host to infer target port states. While specifying an incorrect probe port (e.g., `-p 80` instead of `-p 443`) would indeed yield inaccurate information for that specific port, it would not inherently prevent the underlying idle scan mechanism from attempting to function. The core issue of unreliable results in an idle scan typically stems from the zombie's state, not the specific port number chosen for the probe.

• ✗

  The target has a firewall blocking the decoy packets

  Why it's wrong here

  In an Nmap idle scan, the target host receives SYN packets directly from the designated zombie host, not from the attacker's IP address. If a firewall on the target were blocking these incoming packets, the target would simply not respond to the zombie, leading Nmap to report the port as `filtered` or `closed|filtered`. This outcome indicates a network obstruction but does not cause the 'false results' that arise from an active zombie whose IP ID sequence increments unpredictably, independent of target responses.

• ✗

  The target host is offline

  Why it's wrong here

  If the target host were genuinely offline, it would not respond to any packets sent by the zombie host during the idle scan process. Consequently, the zombie's IP ID sequence would not increment in response to any target activity, leading Nmap to report all ports as `closed` or `filtered`, or the host as `down`. This is a distinct scenario from 'false results' caused by an active zombie, where the zombie's independent network traffic unpredictably alters its IP ID, making it impossible to accurately infer target port states.

• ✓

  The zombie host is not truly idle, causing false results

  Why this is correct

  The Nmap idle scan (`-sI`) fundamentally relies on the zombie host's IP ID sequence number incrementing predictably by one for each packet it sends. The attacker sends spoofed SYN packets to the target, appearing to originate from the zombie. If the zombie is not truly idle and sends its own packets for other reasons, its IP ID sequence will increment unpredictably, making it impossible for the attacker to discern whether an IP ID increment was due to the target's response or the zombie's independent activity, thus leading to unreliable or false results.

Go deeper

Related to this question