CEH Footprinting, Reconnaissance and Scanning Practice Question
An attacker uses an idle scan with Nmap to probe a target. This technique relies on a third-party host with a predictable IP ID sequence to infer port states. Which Nmap flag enables an idle scan?
⚠ Common exam trap
Test-takers frequently confuse -sI with -sS (SYN scan) because both are stealthy, but -sI specifically requires a zombie host and IP ID manipulation, not just half-open connections.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
-sI
The idle scan (-sI) leverages a third-party host (zombie) with a predictable IP ID sequence to indirectly probe a target's ports. By spoofing the zombie's IP and observing changes in its IP ID counter, Nmap can infer whether a port is open, closed, or filtered without sending packets directly from the attacker's IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
-sS
Why it's wrong here
The -sS flag initiates a SYN scan, also known as a half-open scan. This technique sends SYN packets to target ports and analyzes the SYN/ACK or RST responses to determine port states without completing the TCP handshake. While efficient and stealthy, a SYN scan directly interacts with the target from the scanning machine's IP address, making it easily detectable and not an idle scan.
- ✓
-sI
Why this is correct
The -sI flag correctly specifies an idle scan, which is a highly stealthy port scanning technique. This method leverages a "zombie" host's predictable IP ID sequence to infer open ports on a target without sending any packets directly from the attacker's machine to the target. By observing changes in the zombie's IP ID after it receives a forged packet from the target, the attacker can deduce the target's port status, effectively making the zombie perform the scan indirectly.
- ✗
-sA
Why it's wrong here
The -sA flag performs an ACK scan, which sends TCP ACK packets to the target ports. This scan type is primarily used to map firewall rulesets and determine if a port is filtered or unfiltered, rather than identifying if a port is open or closed. An ACK scan directly interacts with the target, eliciting responses that reveal firewall state but do not utilize a zombie host or its IP ID sequence for stealthy port discovery, distinguishing it from an idle scan.
- ✗
-sT
Why it's wrong here
The -sT flag initiates a TCP connect scan, which is the most basic and least stealthy port scanning method. This scan attempts to complete the full three-way TCP handshake (SYN, SYN/ACK, ACK) with each target port. While effective for determining open ports, it leaves a complete connection record in the target's logs, making it easily detectable and directly attributable to the scanning host, completely contrary to the principles of an idle scan.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.