CEH Idle Scan Practice Question
Which of the following Nmap scan types is MOST effective for evading a stateful firewall that only allows established connections? (Select one)
⚠ Common exam trap
Candidates often mistakenly think that a SYN scan is stealthy, but against a stateful firewall that only allows established connections, unsolicited SYN packets are blocked. The idle scan is the key technique that exploits existing sessions to evade such firewalls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Idle scan (-sI)
An idle scan (-sI) is effective against a stateful firewall that only allows established connections because it spoofs the source IP of a zombie host that already has an established session with the target. The firewall sees the packets as belonging to that existing session and allows them. A TCP SYN scan (-sS) sends unsolicited SYN packets that are not part of any existing session, so the stateful firewall would block them because it only permits traffic for established connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
TCP SYN scan (-sS)
Why it's wrong here
A TCP SYN scan (-sS), also known as a half-open scan, sends initial SYN packets to target ports to elicit a SYN/ACK or RST response. These SYN packets are the beginning of a new connection attempt and are unsolicited by the target. A stateful firewall, meticulously tracking TCP session states, will readily identify these as new, unapproved connection initiations from an external source and will drop them if its policy dictates only allowing established connections or specific inbound services, thus blocking the scan.
- ✗
TCP connect scan (-sT)
Why it's wrong here
A TCP connect scan (-sT) attempts to establish a full TCP connection by completing the three-way handshake (SYN, SYN/ACK, ACK). Like a SYN scan, it begins with an unsolicited SYN packet. However, because it fully opens and then closes connections, it generates more log entries and is less stealthy. A stateful firewall, designed to monitor and control connection establishment, will easily detect these full connection attempts from an unauthorized source and block them based on its security policies, making it highly detectable.
- ✓
Idle scan (-sI)
Why this is correct
An idle scan (-sI) is highly effective for evading stateful firewalls because the attacker never directly sends packets to the target. Instead, it leverages a "zombie" host's IP ID sequence to infer open ports on the target. The target's firewall sees packets originating from the trusted zombie, which may already have legitimate traffic flowing, or simply doesn't see unsolicited probes from an unknown source. This indirect method allows the attacker to map the target's ports without revealing their own IP address, making detection and blocking by stateful firewalls significantly more challenging.
- ✗
Ping sweep (-sn)
Why it's wrong here
A ping sweep (-sn) primarily uses ICMP Echo Request packets or ARP requests to discover active hosts on a network. While effective for host discovery, these packets are unsolicited and do not belong to any existing TCP or UDP session. A stateful firewall, designed to track and permit only established connections or explicitly allowed traffic, would easily detect and block these non-session-related probes, rendering the sweep ineffective for evasion.
- ✗
UDP scan (-sU)
Why it's wrong here
A UDP scan (-sU) attempts to identify open UDP ports by sending connectionless UDP packets to target ports. Since UDP is inherently stateless and these packets are not part of an established TCP connection, a stateful firewall configured to strictly permit only established TCP sessions or explicitly allowed UDP services would drop these probes. The firewall would not recognize them as legitimate traffic within an existing, tracked communication flow, thus blocking the scan.
Visual reference
Go deeper
Related to this question
Learn chapter
Session Hijacking
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
Key term
Port Scanning Techniques
Port scanning techniques are methods used to probe a computer or network to discover which network ports are open and which services are running on those ports.
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.