The correct answer is that the zombie host must have an incremental IP ID sequence that is not reset by other traffic. This condition is essential because the idle scan technique, executed with `nmap -sI`, works by probing the zombie’s current IP ID, sending a spoofed SYN packet to the target that appears to come from the zombie, and then re-checking the zombie’s IP ID. If the target responds to the zombie, the zombie’s IP ID increments by exactly 2 (one for the probe, one for the response), confirming an open port; if the ID is randomized or reset by unrelated traffic, the attacker cannot reliably detect this change. On the Certified Ethical Hacker CEH exam, this question tests your understanding of stealth scanning and the zombie’s role as a decoy, with a common trap being that any idle host will work—but the critical requirement is a predictable, monotonic IP ID. For a quick memory tip, think “Zombie ID must tick, not trick”—the IP ID must increment steadily, not randomize or reset.
CEH Footprinting, Reconnaissance and Scanning Practice Question
This CEH practice question tests your understanding of footprinting, reconnaissance and scanning. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An attacker uses `nmap -sI 10.0.0.5 192.168.1.10` to scan a target. This technique is known as an idle scan. Which condition is REQUIRED for this scan to work correctly?
The zombie host must be running a Windows operating system
Why wrong: Zombie host OS does not matter; what matters is its IP ID generation.
B
The attacker must have root access on the target machine
Why wrong: No, the attacker does not need access to the target; the scan is performed from the attacker's machine using a zombie.
C
The zombie host must have an incremental IP ID sequence that is not reset by other traffic
The idle scan relies on observing changes in the zombie's IP ID to infer port status. If the zombie receives other traffic, the IP ID may increment, causing false results.
D
The target must be running a Linux server with SSH enabled
Why wrong: The target does not require any specific configuration for the idle scan to work.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The zombie host must have an incremental IP ID sequence that is not reset by other traffic
The idle scan (nmap -sI) relies on the zombie host's IP ID sequence being predictable and incremental. The attacker probes the zombie's IP ID, sends a spoofed SYN packet to the target (appearing from the zombie), and then re-checks the zombie's IP ID. If the IP ID has increased by exactly 2 (or more if other traffic occurred), the target responded to the zombie, confirming the port is open. The zombie must not reset or randomize its IP ID, and other traffic to the zombie must be minimal or accounted for, making an incremental IP ID sequence the essential condition.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The zombie host must be running a Windows operating system
Why it's wrong here
Zombie host OS does not matter; what matters is its IP ID generation.
✗
The attacker must have root access on the target machine
Why it's wrong here
No, the attacker does not need access to the target; the scan is performed from the attacker's machine using a zombie.
✓
The zombie host must have an incremental IP ID sequence that is not reset by other traffic
Why this is correct
The idle scan relies on observing changes in the zombie's IP ID to infer port status. If the zombie receives other traffic, the IP ID may increment, causing false results.
Related concept
Read the scenario before looking for a memorised answer.
✗
The target must be running a Linux server with SSH enabled
Why it's wrong here
The target does not require any specific configuration for the idle scan to work.
Common exam traps
Common exam trap: answer the scenario, not the keyword
EC-Council often tests the misconception that the zombie must be idle or that the target must have a specific service, but the core requirement is the zombie's IP ID sequence being incremental and not reset by other traffic.
Detailed technical explanation
How to think about this question
The idle scan exploits the IP ID field in the IPv4 header, which many older OS kernels increment by 1 for each packet sent. The attacker uses a three-step process: (1) probe the zombie's IP ID, (2) send a spoofed SYN to the target with the zombie's source IP, and (3) re-probe the zombie's IP ID. If the target responds (SYN-ACK for open ports or RST for closed), the zombie's IP ID increases by 2 (one for the spoofed SYN response, one for the attacker's probe). A real-world challenge is that modern OSes (e.g., Windows 10, Linux with randomized IP IDs) break this technique, and network congestion can cause false positives.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the CEH exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CEH question in full detail.
Footprinting, Reconnaissance and Scanning — This question tests Footprinting, Reconnaissance and Scanning — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The zombie host must have an incremental IP ID sequence that is not reset by other traffic — The idle scan (nmap -sI) relies on the zombie host's IP ID sequence being predictable and incremental. The attacker probes the zombie's IP ID, sends a spoofed SYN packet to the target (appearing from the zombie), and then re-checks the zombie's IP ID. If the IP ID has increased by exactly 2 (or more if other traffic occurred), the target responded to the zombie, confirming the port is open. The zombie must not reset or randomize its IP ID, and other traffic to the zombie must be minimal or accounted for, making an incremental IP ID sequence the essential condition.
What should I do if I get this CEH question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An attacker uses a technique where they send a SYN packet with a spoofed source IP address to the target, and the target responds with SYN/ACK to the spoofed IP. The attacker never completes the handshake. This technique is known as:
medium
A.SYN flood
B.TCP connect scan
✓ C.Idle scan
D.Half-open scan
Why C: The idle scan (option C) is correct because it uses a spoofed SYN packet with a zombie host's IP address to probe open ports on the target. The target sends a SYN/ACK to the zombie, but the attacker never completes the handshake; instead, the attacker monitors the zombie's IPID (IP Identification) field to infer whether the target's port is open or closed. This technique is defined in RFC 793 and leverages the zombie's predictable IPID sequence to perform a blind, stealthy scan.
Last reviewed: Jun 30, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.