CEH Footprinting, Reconnaissance and Scanning Practice Question
Which TWO of the following Nmap flags can be used to bypass firewall restrictions? (Select 2)
⚠ Common exam trap
A common mix-up: candidates confuse stealth scanning (-sS) with firewall evasion, not realizing that SYN scans are still detectable by modern firewalls that track connection states, while fragmentation and decoys directly manipulate packet structure or source identity to bypass filters.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
-f (fragment packets)
The -f flag fragments packets into smaller 8-byte chunks, which can evade simple firewall rules that inspect packet headers for known signatures or block oversized packets. Option E is correct because the -D flag performs a decoy scan by spoofing multiple source IP addresses, making it difficult for a firewall to identify the true scanning host and block it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
-P0 (disable ping)
Why it's wrong here
The -P0 (now -Pn) flag instructs Nmap to skip the host discovery phase entirely, meaning it will not attempt to ping or perform ARP requests to determine if a host is online. While this is useful when ICMP is blocked by a firewall, it does not actively bypass packet filtering rules or stateful inspection for the actual port scanning traffic. Instead, it merely forces Nmap to assume all specified targets are up and proceed with scanning, making it a workaround for host discovery, not a firewall evasion technique for the scan itself.
- ✓
-f (fragment packets)
Why this is correct
The -f flag enables packet fragmentation, splitting the TCP header across multiple small IP packets. This technique can bypass older or less sophisticated stateless firewalls and intrusion detection systems (IDS) that are not configured to reassemble fragmented packets before inspection. By breaking the packet into smaller, non-contiguous pieces, the firewall might only see incomplete headers or data, allowing the full packet to pass through undetected and reassemble at the target.
- ✗
-T4 (aggressive timing)
Why it's wrong here
The -T4 (Aggressive) timing template primarily adjusts Nmap's scanning speed and reliability by modifying probe timeouts and retransmission rates. While it can make a scan faster or more robust, it does not alter the fundamental structure or content of the packets themselves, nor does it obfuscate the source IP address. Therefore, timing templates have no direct effect on bypassing firewall rules that inspect packet headers, state, or source/destination information.
- ✗
-sS (SYN scan)
Why it's wrong here
The -sS (SYN scan), also known as a half-open scan, is considered stealthy because it does not complete the full TCP three-way handshake, making it less likely to be logged by target systems. However, it still sends standard SYN packets that are fully visible to firewalls, especially stateful ones that track connection states. This technique aims for stealth against the target host's logs rather than actively bypassing a firewall's packet filtering or stateful inspection capabilities.
- ✓
-D (decoy scan)
Why this is correct
The -D (decoy scan) flag allows Nmap to send scan packets from multiple spoofed IP addresses in addition to the real source IP, making it significantly harder for firewalls and IDS to pinpoint the actual scanner. By interspersing legitimate scan packets with those from decoys, the firewall's logs become cluttered and ambiguous, distributing the attention across several apparent sources. This obfuscation technique is highly effective in evading detection and making forensic analysis challenging for network defenders.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.