CEH Footprinting, Reconnaissance and Scanning Practice Question

An attacker uses a technique where they send a SYN packet with a spoofed source IP address to the target, and the target responds with SYN/ACK to the spoofed IP. The attacker never completes the handshake. This technique is known as:

⚠ Common exam trap

Many exam-takers confuse the idle scan with a half-open scan because both involve not completing the handshake, but the idle scan uniquely requires a spoofed source IP and a zombie host to measure IPID changes, whereas a half-open scan uses the attacker's own IP and sends a RST directly.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Idle scan

The idle scan (option C) is correct because it uses a spoofed SYN packet with a zombie host's IP address to probe open ports on the target. The target sends a SYN/ACK to the zombie, but the attacker never completes the handshake; instead, the attacker monitors the zombie's IPID (IP Identification) field to infer whether the target's port is open or closed. This technique is defined in RFC 793 and leverages the zombie's predictable IPID sequence to perform a blind, stealthy scan.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
SYN flood
Why it's wrong here
A SYN flood is a denial-of-service (DoS) attack where an attacker sends a high volume of SYN packets to a target server, often with spoofed source IP addresses. The server responds with SYN/ACK packets and allocates resources for each half-open connection, quickly exhausting its connection table and memory. This prevents legitimate users from establishing connections, but it does not reveal open ports in a stealthy manner; its primary goal is service disruption.
✗
TCP connect scan
Why it's wrong here
A TCP connect scan attempts to establish a full three-way TCP handshake (SYN, SYN/ACK, ACK) with each target port. This method relies on the operating system's connect() system call, which completes the connection if the port is open. While effective for port discovery, it is easily detectable by firewalls and intrusion detection systems because it leaves complete connection logs on the target, and it does not involve IP spoofing.
✓
Idle scan
Why this is correct
An Idle scan is a highly stealthy port scanning technique that leverages a "zombie" host, an idle machine with a predictable IPID (IP Identification field) sequence. The attacker spoofs the zombie's IP address to send SYN packets to the target port. By observing changes in the zombie's IPID after the target responds (or doesn't respond) to the spoofed packet, the attacker can infer whether the target port is open, closed, or filtered, without directly interacting with the target.
✗
Half-open scan
Why it's wrong here
A half-open scan, also known as a SYN scan, sends a SYN packet to a target port. If a SYN/ACK is received, indicating an open port, the scanner immediately sends an RST (reset) packet to tear down the connection before a full three-way handshake is completed. This technique is stealthier than a TCP connect scan as it avoids creating full connection logs, but it does not involve IP address spoofing and still originates directly from the attacker's IP.

Visual reference

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question