hardMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: During a security audit, a penetration tester…
During a security audit, a penetration tester captures network traffic and finds that some packets have the IP ID field set to 0 and the DF (Don't Fragment) flag set. What is this technique attempting to do?
⚠ Common exam trap
ISC2 often tests the idle scan by focusing on the combination of IP ID 0 and DF flag, leading candidates to mistakenly think it is about fragmentation evasion or simple spoofing, rather than the stealthy reconnaissance technique using a zombie host.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a stealth scan using a zombie host to hide the attacker's identity
Setting the IP ID field to 0 and the DF flag in packets is characteristic of an idle scan (also known as a stealth scan). This technique uses a zombie host (with an incremental IP ID) to probe a target; by sending packets with DF set and IP ID 0 to the zombie, the attacker can observe changes in the zombie's IP ID to infer open ports on the target, thereby hiding the attacker's true IP address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spoof the source IP address of the attacker's machine
Why it's wrong here
The attacker's IP is not spoofed; the zombie's IP is used.
- ✗
Launch a denial-of-service attack against the target
Why it's wrong here
Idle scan is not a DoS; it's a stealth scan.
- ✓
Perform a stealth scan using a zombie host to hide the attacker's identity
Why this is correct
Idle scan uses IP ID to map a zombie's activity and infer port states.
- ✗
Evade a firewall by fragmenting packets
Why it's wrong here
DF flag prevents fragmentation.
Go deeper
Related to this question
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.