What Is an "Idle" System in an IP ID Idle Scan?
An "idle" system is also referred to as what?
Community Votes
71% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The item tests whether you recognize idle-scan/botnet jargon rather than everyday English, and the trap is picking "PC not being used" because that is what idle literally means.
An "idle" system is the quiet helper host — the zombie — that an IP ID idle scan borrows to probe a target's ports without revealing the attacker's address. This page explains why the exam answer is Zombie (B) and why the literal reading "PC not being used" is the trap.
Most learners choose C ("PC not being used") since that is the plain-English meaning of idle; the exam instead uses "idle system" as the name for the zombie host that the IP ID idle scan depends on.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
An IP ID idle scan never talks to the target directly: it spoofs the source address of a third host, sends SYNs to the target, and reads how the target's replies bump that third host's IP ID counter. Because the whole measurement depends on the helper host's IP ID increasing predictably and on nothing else, the helper must be genuinely quiet — nmap's documentation tells you to find "an appropriate zombie" that "should be idle (hence the scan name)". That is exactly the terminology the question is probing: the idle system in the scan is the zombie. The same label carries into malware forensics, where zombies are dormant, remotely controlled hosts sitting unnoticed on a network until the botmaster needs them.Why the Other Options Are Wrong
Option A ("PC not connected to the Internet") confuses idleness with isolation; an idle zombie must be reachable and answering packets, so connectivity is a requirement, not a disqualifier. Option C ("PC not being used") is the everyday meaning of the word and describes the zombie's condition, but it does not name the role the question asks for — the quotation marks around "idle" signal jargon, not plain English. Option D ("Bot") is close but wrong: the bot is the agent program running on the compromised machine, and a bot is by design active (beaconing, listening for commands), whereas the defining property here is that the host is idle.Community Comment Notes
Toni222 argues the literalist line, saying an idle system is a "PC that is turned on but not currently running any applications or tasks" and explicitly rules out zombie and bot. Dumas reaches the opposite conclusion from the same premise, noting a low-activity machine "is a perfect system to be made a Zombie", while kk64 reminds readers that a zombie is "attacked, compromised and remotely controlled". The most useful contribution is 044f354's, which cites the nmap idle-scan page and its line that the host "should be idle (hence the scan name)" — the strongest evidence that idle system and zombie are the same term here. Elb and Jashan_lefty both back C, but they answer the dictionary question rather than the exam's terminology question.Official Reference
Exam Strategy
When a stem puts a common word in quotation marks ("idle", "silent", "blind"), treat it as a named technique and look for the option that gives the role, not the dictionary definition. Eliminate options that describe a state instead of naming a component, and prefer the term that ties back to a documented scanning or botnet mechanism.
Frequently Asked Questions
Why is "PC not being used" (C) wrong if idle literally means unused?
The quotes mark jargon: in the IP ID idle scan the quiet helper host is called the zombie, so "idle system" names that role rather than describing an unused PC.
Must an idle-scan zombie be an already compromised machine?
No. It only needs predictable, incremental IP ID behavior and no competing traffic; a botnet zombie, by contrast, is a host already taken over and running a bot.