CEH Footprinting, Reconnaissance and Scanning Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  FIN scan (-sF)

  Why this is correct

  The FIN scan (-sF) is considered stealthy because it sends only a FIN packet to the target port without initiating a full TCP three-way handshake. If the port is open, it typically ignores the packet, while a closed port will respond with an RST/ACK. This technique often bypasses stateless firewalls and avoids logging on the target system, as no connection is ever established, making it less detectable.

• ✗

  TCP connect scan (-sT)

  Why it's wrong here

  The TCP connect scan (-sT) is explicitly not stealthy because it completes the full TCP three-way handshake (SYN, SYN/ACK, ACK) with every target port. This process establishes a full connection, which is then immediately torn down. This full connection establishment is easily logged by the operating system and network intrusion detection systems, making it highly detectable and far from stealthy.

• ✗

  UDP scan (-sU)

  Why it's wrong here

  The UDP scan (-sU) is not considered stealthy as it operates at the UDP layer, sending UDP datagrams to target ports. Unlike TCP, UDP is connectionless and does not involve handshakes, making it fundamentally different. A closed UDP port typically elicits an ICMP Port Unreachable message, which is easily detectable by network monitoring tools and firewalls, revealing the scan activity.

• ✓

  SYN scan (-sS)

  Why this is correct

  The SYN scan (-sS), often called a 'half-open' scan, is a highly stealthy technique because it initiates a TCP handshake but does not complete it. It sends a SYN packet, and if a SYN/ACK is received, indicating an open port, the scanner immediately sends an RST packet to tear down the connection. This avoids creating a full connection entry in the target's logs, making it less detectable than a full TCP connect scan.

• ✗

  ACK scan (-sA)

  Why it's wrong here

  The ACK scan (-sA) is not a stealth port discovery scan; its primary purpose is to map firewall rules and determine if a port is filtered or unfiltered. It sends an ACK packet, and if an RST is received, the port is unfiltered, while no response or an ICMP error suggests filtering. Since it doesn't differentiate between open and closed ports, it cannot be used for traditional port scanning and thus isn't a stealth method for identifying open services.

Go deeper

Related to this question