CEH Introduction to Ethical Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use random source ports

  Why it's wrong here

  Using random source ports primarily aims to bypass stateless firewall rules that might block specific source ports or to make traffic analysis slightly more complex by obscuring the origin application. However, this technique does not alter the total number of packets sent per unit of time from the scanning host. Therefore, it is ineffective against Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS) that monitor and trigger alerts based on high packet rates originating from a single source IP address, regardless of the source port used.

• ✗

  Use a decoy scan

  Why it's wrong here

  A decoy scan involves sending packets from multiple spoofed IP addresses in addition to the actual attacker's IP, making it harder for the target to identify the true source of the scan. While this technique can obscure the attacker's origin, it inherently increases the overall packet volume directed at the target. Each decoy IP, along with the real attacker's IP, contributes to the total packet rate observed by the target's IDS/IPS, potentially increasing the likelihood of triggering rate-based detection thresholds rather than evading them.

• ✓

  Slow down the scan rate

  Why this is correct

  Slowing down the scan rate directly reduces the number of packets sent per second (PPS) or connections attempted per minute. This strategic reduction keeps the scanning activity below the predefined thresholds set by rate-based Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), which are designed to detect anomalous traffic volumes. By maintaining a low packet rate, the ethical hacker can conduct reconnaissance without triggering alerts that would otherwise flag the activity as a potential port scan or denial-of-service attempt, thus evading detection.

• ✗

  Use fragmented packets

  Why it's wrong here

  Using fragmented packets involves splitting a single packet into multiple smaller fragments, forcing the target system to reassemble them. This technique is primarily effective against signature-based IDS/IPS that might fail to properly reassemble or inspect fragmented packets, thus missing specific attack signatures. However, fragmentation does not reduce the total number of packets sent over the network; in fact, it increases it for a given amount of data. Consequently, it offers no benefit against rate-based detection mechanisms that simply count the volume of packets arriving from a source within a specific timeframe.