CEH Scanning Networks and Enumeration Practice Question
Which THREE Nmap options are commonly used to evade firewall detection during a scan? (Choose three.)
⚠ Common exam trap
The trap here is that candidates often mistake -sT (TCP connect scan) as a stealthy option because it is the default scan type, but it actually completes the full handshake and is highly detectable, whereas the correct evasion options focus on fragmentation, timing, and decoys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
-f (fragment packets)
The -f flag fragments the IP packets into smaller pieces (typically 8-byte fragments) to bypass simple packet-filtering firewalls and intrusion detection systems that do not reassemble fragmented packets before applying filtering rules. This technique exploits the fact that many stateless firewalls only inspect the first fragment and allow subsequent fragments through unchecked, enabling the scan to reach the target.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
-f (fragment packets)
Why this is correct
The -f option instructs Nmap to fragment the IP packets into smaller, non-standard-sized pieces. This technique can bypass stateless firewalls or Intrusion Detection Systems (IDS) that only inspect the initial fragments, as critical header information (like TCP flags or port numbers) might be split across multiple segments. When the fragmented packets reach the target, the operating system reassembles them before processing, potentially allowing the scan to proceed undetected by intermediate network devices.
- ✓
-T0 (paranoid timing)
Why this is correct
The -T0 option sets the scan timing template to "paranoid," which is the slowest and most stealthy timing profile available in Nmap. This extremely slow pace, sending probes at irregular and infrequent intervals, is designed to evade rate-based detection mechanisms and anomaly-based Intrusion Detection Systems (IDS) that might flag rapid, consecutive scans as malicious. While significantly increasing scan duration, it minimizes the likelihood of triggering alarms by mimicking legitimate, sporadic network traffic.
- ✓
-D (decoy)
Why this is correct
The -D option allows Nmap to send scan packets from multiple decoy source IP addresses in addition to the real scanning machine's IP. By interspersing legitimate scan packets with those originating from spoofed decoy IPs, this technique aims to confuse firewalls, IDS, and network administrators by making it difficult to pinpoint the actual source of the scan. This obfuscation complicates forensic analysis and attribution, distributing the "blame" across several non-existent or innocent hosts.
- ✗
-sT (TCP connect scan)
Why it's wrong here
The -sT option performs a full TCP three-way handshake (SYN, SYN/ACK, ACK) with the target port, which is the most straightforward and "loudest" type of TCP scan. Because it completes the connection, it is highly visible to the target operating system's logging mechanisms, firewalls, and Intrusion Detection Systems (IDS), making it easily detectable and logged. This method is generally avoided when attempting to evade network defenses due to its inherent lack of stealth.
- ✗
-sV (version detection)
Why it's wrong here
The -sV option instructs Nmap to perform service and version detection on open ports, which involves sending a series of additional, specific probes to identified open ports to elicit banner information or application-specific responses. These extra probes generate significantly more network traffic and distinct application-layer signatures compared to simple port scanning, making the scan much more detectable by firewalls, IDS, and network monitoring tools. Its purpose is identification, not evasion.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.