What Is an "Idle" System in an IP ID Idle Scan?
Short answer
B An idle system is the zombie host in an IP ID idle scan, since that helper host must stay idle to yield reliable IP ID increments.
Question
Key Takeaways
The item tests whether you recognize idle-scan/botnet jargon rather than everyday English, and the trap is picking "PC not being used" because that is what idle literally means.
An "idle" system is the quiet helper host — the zombie — that an IP ID idle scan borrows to probe a target's ports without revealing the attacker's address. This page explains why the exam answer is Zombie (B) and why the literal reading "PC not being used" is the trap.
Common mistake: Most learners choose C ("PC not being used") since that is the plain-English meaning of idle; the exam instead uses "idle system" as the name for the zombie host that the IP ID idle scan depends on.
Expert Analysis
Why the Answer Is Correct
An IP ID idle scan never talks to the target directly: it spoofs the source address of a third host, sends SYNs to the target, and reads how the target's replies bump that third host's IP ID counter. Because the whole measurement depends on the helper host's IP ID increasing predictably and on nothing else, the helper must be genuinely quiet — nmap's documentation tells you to find "an appropriate zombie" that "should be idle (hence the scan name)". That is exactly the terminology the question is probing: the idle system in the scan is the zombie. The same label carries into malware forensics, where zombies are dormant, remotely controlled hosts sitting unnoticed on a network until the botmaster needs them.
Why the Other Options Are Wrong
Option A ("PC not connected to the Internet") confuses idleness with isolation; an idle zombie must be reachable and answering packets, so connectivity is a requirement, not a disqualifier. Option C ("PC not being used") is the everyday meaning of the word and describes the zombie's condition, but it does not name the role the question asks for — the quotation marks around "idle" signal jargon, not plain English. Option D ("Bot") is close but wrong: the bot is the agent program running on the compromised machine, and a bot is by design active (beaconing, listening for commands), whereas the defining property here is that the host is idle.
Community Comment Notes
Toni222 argues the literalist line, saying an idle system is a "PC that is turned on but not currently running any applications or tasks" and explicitly rules out zombie and bot. Dumas reaches the opposite conclusion from the same premise, noting a low-activity machine "is a perfect system to be made a Zombie", while kk64 reminds readers that a zombie is "attacked, compromised and remotely controlled". The most useful contribution is 044f354's, which cites the nmap idle-scan page and its line that the host "should be idle (hence the scan name)" — the strongest evidence that idle system and zombie are the same term here. Elb and Jashan_lefty both back C, but they answer the dictionary question rather than the exam's terminology question.
Official Reference
https://nmap.org/book/idlescan.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a stem puts a common word in quotation marks ("idle", "silent", "blind"), treat it as a named technique and look for the option that gives the role, not the dictionary definition. Eliminate options that describe a state instead of naming a component, and prefer the term that ties back to a documented scanning or botnet mechanism.
Frequently Asked Questions
Why is "PC not being used" (C) wrong if idle literally means unused?
Must an idle-scan zombie be an already compromised machine?
Community Votes
71% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 6 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 6
-
Toni222 👍 4 Answered BAn 'idle' system is commonly referred to a PC that is turned on but not currently running any applications or tasks. It does not imply that the PC is not connected to the Internet, a 'zombie', or a 'bot'.
-
Dumas 👍 2An idle system is one that is not being used or low activity. This is a perfect system to be made a Zombie. B is my answer.
-
kk64 👍 2A Zombie PC is one that is attacked, compromised and remotely controlled by the attacker
-
044f354 👍 1 Answered BToo many clowns posting here. Do research and show citations. (correct) B. Zombie https://nmap.org/book/idlescan.html "The first step in executing an IP ID idle scan is to find an appropriate zombie. It needs to assign IP ID packets incrementally on a global (rather than per-host it communicates with) basis. It should be idle (hence the scan name), as extraneous traffic will bump up its IP ID sequence, confusing the scan logic. The lower the latency between the attacker and the zombie, and between the zombie and the target, the faster the scan will proceed." to paraphrase: zombie should be idle ----- If you agree, please UPVOTE. Each time you upvote someone with contributor access (like me) your vote is added to the Community Vote Distribution, which helps the entire community.
-
Elb 👍 1 Answered CA computer typically goes idle when it's not actively processing user commands or running programs. This can happen when you're not using the computer, or when you're using a program that doesn't require much processing power. The system also goes idle during periods of inactivity to conserve energy.
Show 1 more comment
-
Jashan_lefty 👍 1 Answered CZombie computer are the attacked computers. Not the idle computer
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.