CEH Footprinting, Reconnaissance and Scanning Practice Question
During a vulnerability assessment, a security analyst receives an alert from the IDS that a scan with fragmented packets and spoofed source IPs is targeting the internal network. Which Nmap command MOST likely caused this alert?
⚠ Common exam trap
Candidates often confuse `-f` with other scan types like SYN or UDP scans, but the key is recognizing that fragmentation and spoofed source IPs are explicitly enabled by `-f` and `-D` respectively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
nmap -f -D 10.0.0.1,10.0.0.2 192.168.1.1
The `-f` flag fragments the packets into smaller IP fragments, and the `-D` flag performs a decoy scan by spoofing source IPs. This combination causes the IDS to detect fragmented packets with spoofed source addresses, matching the alert description.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
nmap -sS -O 192.168.1.1
Why it's wrong here
This command performs a SYN stealth scan (-sS), which is efficient for discovering open ports without completing the full TCP handshake. It also attempts operating system detection (-O) by analyzing responses from the target. However, this command does not employ any packet fragmentation or source IP spoofing techniques, making it easily detectable by most modern Intrusion Detection Systems (IDS) and thus not fitting a scenario where evasion is implied.
- ✗
nmap -sV -p 80 192.168.1.1
Why it's wrong here
The -sV option is used for version detection, probing open ports to identify the specific service and its version running, while -p 80 restricts this scan to only target TCP port 80. This is a common enumeration technique to gather detailed service information from a known open port. Crucially, this command does not incorporate any evasion tactics such as packet fragmentation or the use of decoy source IP addresses, making it straightforward for an IDS to log the scanner's true origin and intent.
- ✗
nmap -sU 192.168.1.1
Why it's wrong here
This command executes a UDP scan (-sU), which attempts to discover open UDP ports by sending UDP packets and waiting for ICMP port unreachable messages or application-layer responses. UDP scans are often slower and less reliable than TCP scans due to the connectionless nature of the protocol and lack of explicit 'closed' responses. While a distinct scanning method, it does not utilize any techniques like packet fragmentation or IP decoys to obscure the scanner's identity or activity from an Intrusion Detection System.
- ✓
nmap -f -D 10.0.0.1,10.0.0.2 192.168.1.1
Why this is correct
This Nmap command employs two significant evasion techniques: -f for packet fragmentation and -D for decoy IP addresses. Packet fragmentation breaks the scan probes into smaller, non-standard-sized IP fragments, which can bypass simple stateful firewalls or IDS rules that only inspect the initial fragment. The -D option generates multiple decoy source IP addresses, making it difficult for an IDS to determine the actual scanner's IP from the network logs, effectively obscuring the attacker's origin and distributing the perceived attack source.
Go deeper
Related to this question
Learn chapter
Vulnerability Analysis
Key term
Port Scanning Techniques
Port scanning techniques are methods used to probe a computer or network to discover which network ports are open and which services are running on those ports.
Key term
Vulnerability assessment
A vulnerability assessment is a systematic review of security weaknesses in an information system, evaluating if the system is susceptible to any known vulnerabilities, assigning severity levels, and recommending remediation or mitigation.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.