CEH Footprinting, Reconnaissance and Scanning Practice Question
An attacker uses `nmap -sI 10.0.0.5 192.168.1.10` to scan a target. This technique is known as an idle scan. Which condition is REQUIRED for this scan to work correctly?
⚠ Common exam trap
EC-Council often tests the misconception that the zombie must be idle or that the target must have a specific service, but the core requirement is the zombie's IP ID sequence being incremental and not reset by other traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The zombie host must have an incremental IP ID sequence that is not reset by other traffic
The idle scan (nmap -sI) relies on the zombie host's IP ID sequence being predictable and incremental. The attacker probes the zombie's IP ID, sends a spoofed SYN packet to the target (appearing from the zombie), and then re-checks the zombie's IP ID. If the IP ID has increased by exactly 2 (or more if other traffic occurred), the target responded to the zombie, confirming the port is open. The zombie must not reset or randomize its IP ID, and other traffic to the zombie must be minimal or accounted for, making an incremental IP ID sequence the essential condition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The zombie host must be running a Windows operating system
Why it's wrong here
The Nmap idle scan technique, as implemented by `-sI`, relies on observing the IP ID sequence of the zombie host. This sequence generation behavior is a function of the TCP/IP stack implementation, not exclusively tied to a specific operating system like Windows. Many operating systems, including various Linux distributions and older Windows versions, exhibit predictable, incrementally increasing IP ID values, making them suitable zombies regardless of their specific OS.
- ✗
The attacker must have root access on the target machine
Why it's wrong here
The Nmap idle scan is a covert technique where the attacker spoofs the zombie host's IP address to send probes to the target. The attacker's machine initiates the scan and observes the zombie's IP ID changes, never directly requiring privileged access or credentials on the target machine itself. This method is designed to be stealthy, making the zombie appear as the source of the scan activity, not the attacker's machine.
- ✓
The zombie host must have an incremental IP ID sequence that is not reset by other traffic
Why this is correct
The Nmap idle scan fundamentally relies on the zombie host's IP ID sequence incrementing predictably for each outgoing packet. If the zombie's IP ID sequence is not strictly incremental or is reset by unrelated network traffic, the attacker cannot reliably infer the target port's status. This predictability is crucial because the scan deduces open/closed ports based on whether the zombie's IP ID increments by one (indicating no RST from target) or by two (indicating a RST from target, causing the zombie to send a RST back).
- ✗
The target must be running a Linux server with SSH enabled
Why it's wrong here
The Nmap idle scan is a generic port scanning technique that probes TCP ports on any IP-addressable host. Its effectiveness does not depend on the target machine running a specific operating system like Linux or having particular services such as SSH enabled. The scan simply observes the target's response to spoofed SYN packets, which is a fundamental TCP/IP behavior, making it universally applicable to any compliant TCP/IP stack.
Visual reference
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An attacker uses a technique where they send a SYN packet with a spoofed source IP address to the target, and the target responds with SYN/ACK to the spoofed IP. The attacker never completes the handshake. This technique is known as:
medium- A.SYN flood
- B.TCP connect scan
- ✓ C.Idle scan
- D.Half-open scan
Why C: The idle scan (option C) is correct because it uses a spoofed SYN packet with a zombie host's IP address to probe open ports on the target. The target sends a SYN/ACK to the zombie, but the attacker never completes the handshake; instead, the attacker monitors the zombie's IPID (IP Identification) field to infer whether the target's port is open or closed. This technique is defined in RFC 793 and leverages the zombie's predictable IPID sequence to perform a blind, stealthy scan.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.