CEH Footprinting, Reconnaissance and Scanning Practice Question
Which TWO of the following Nmap flags are used for evasion of IDS/IPS? (Choose two.)
⚠ Common exam trap
EC-Council often tests the misconception that -sV or -O are evasion techniques because they are 'stealthy' in some contexts, but the CEH exam specifically requires knowing that decoys (-D) and fragmentation (-f) are the standard Nmap evasion flags.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
-D
(-D) is correct because the Nmap decoy scan flag allows you to spoof multiple source IP addresses, making it difficult for IDS/IPS to distinguish the real scanning host from decoys. Option D (-f) is correct because fragmenting packets (e.g., using -f to split TCP headers into 8-byte fragments) evades signature-based detection by bypassing pattern-matching rules that expect complete packet headers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
-sV
Why it's wrong here
The -sV flag instructs Nmap to perform version detection, actively probing open ports to determine the specific software and version running on them. This process involves sending various application-layer probes and analyzing responses, which generates distinct network traffic patterns. Far from being an evasion technique, version detection is often quite noisy and easily identifiable by Intrusion Detection Systems (IDS) due to its characteristic probing behavior, making it a detection method rather than a stealthy one.
- ✗
-O
Why it's wrong here
The -O flag is used for Nmap's operating system detection, which attempts to identify the target's OS based on its unique TCP/IP stack fingerprinting. This involves sending a series of specialized TCP, UDP, and ICMP probes and analyzing the subtle differences in how the target responds to these malformed or unusual packets. Such specific probing traffic is readily recognizable by modern IDSs and IPSs, making OS detection a highly detectable reconnaissance activity rather than an evasion strategy designed to conceal the scanner's presence.
- ✓
-D
Why this is correct
The -D flag enables decoy scanning, an effective evasion technique where Nmap sends scan packets from multiple spoofed source IP addresses in addition to the attacker's real IP. By interspersing legitimate scan packets with numerous fake ones, this method aims to confuse Intrusion Detection Systems (IDS) and obscure the true origin of the scan. This makes it significantly harder for security analysts to pinpoint the actual attacker's machine amidst a flood of seemingly disparate scan attempts, thus providing a layer of anonymity.
- ✓
-f
Why this is correct
The -f flag instructs Nmap to fragment scan packets, breaking them down into smaller, non-standard sized pieces before sending them over the network. This technique is designed to bypass older or less sophisticated Intrusion Detection Systems (IDS) that may struggle to correctly reassemble fragmented packets or fail to apply signature-based rules to incomplete data streams. By making the individual packet fragments too small to match typical IDS signatures, fragmentation can effectively obscure the true nature of the scan and evade detection.
- ✗
-sT
Why it's wrong here
The -sT flag initiates a TCP connect scan, which performs a full three-way TCP handshake with the target port, just like a standard application would. This method is considered the 'noisiest' of Nmap's TCP scan types because it completes the entire connection process, leaving full connection logs on the target system. Since it relies on the operating system's native `connect()` system call and establishes complete connections, it is easily detected by firewalls and Intrusion Detection Systems, making it entirely unsuitable for evasion purposes.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.