CEH Footprinting, Reconnaissance and Scanning Practice Question
A security team observes repeated Nmap scans from an external IP address. The scans show fragmented IP packets. Which evasion technique is the attacker using?
⚠ Common exam trap
EC-Council often tests the distinction between fragmentation and decoy scans, as candidates may confuse 'splitting packets' with 'spoofing IPs' due to both being evasion techniques.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fragmentation
The attacker is using fragmentation to evade detection by splitting the Nmap probe packets into smaller fragments. This technique bypasses simple packet filters and intrusion detection systems (IDS) that lack IP fragment reassembly capabilities, as the fragments are typically allowed through individually. Nmap's `-f` flag or `--mtu` option is used to send fragmented IP packets, making the scan less conspicuous.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Fragmentation
Why this is correct
IP fragmentation involves splitting larger packets into smaller fragments, each with its own IP header, before transmission. This technique is primarily used by attackers to bypass network intrusion detection systems (IDS) and firewalls that perform signature-based analysis on full packets. By fragmenting packets, the IDS may only see partial data or fail to reassemble the fragments correctly, thus missing malicious signatures or policy violations that would otherwise trigger an alert.
- ✗
Decoy scan
Why it's wrong here
A decoy scan involves sending scan probes from multiple spoofed source IP addresses in addition to the actual scanner's IP. This technique aims to confuse network defenders by populating logs with numerous false scan sources, making it difficult to identify the true origin of the scan. While effective for obfuscating the scanner's identity and distributing the perceived attack source, it does not directly alter the structure of individual packets to evade deep packet inspection like fragmentation does.
- ✗
ACK scan
Why it's wrong here
An ACK scan sends TCP packets with only the ACK flag set to target ports, primarily to map firewall rules and determine if a port is filtered. Unlike other scan types that aim to determine port state, the ACK scan observes whether a RST packet is returned, indicating an unfiltered port, or no response, suggesting a stateful firewall is blocking the traffic. This method is focused on firewall rule enumeration and identifying stateful inspection rather than evading detection through packet manipulation or source obfuscation.
- ✗
Idle scan
Why it's wrong here
An Nmap idle scan, also known as a zombie scan, leverages an idle 'zombie' host to indirectly scan a target while completely spoofing the source IP address. It works by monitoring changes in the IP ID sequence number of the zombie host after sending a SYN packet to the target, inferring open ports without direct interaction from the scanner. This technique provides extreme anonymity for the attacker by making the scan appear to originate from the zombie, but it does not involve fragmenting packets to bypass network security devices.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.