Which Zenmap Scan Hides the Scanner's IP While Finding Open Ports?

312-50v12 By islever Editorial Last updated

Scanning Networks

Short answer

D Use Zenmap's IDLE/IPID header scan (-sI) with a zombie host to find open ports and services without exposing the scanner's IP.

Question

During a red team assessment, a CEH is given a task to perform network scanning on the target network without revealing its IP address. They are also required to find an open port and the services available on the target machine. What scanning technique should they employ, and which command in Zenmap should they use?
  1. Use SCTP INIT Scan with the command "-sY"
  2. Use UDP Raw ICMP Port Unreachable Scanning with the command "-sU"
  3. Use the ACK flag probe scanning technique with the command "-sA"
  4. Use the IDLE/IPID header scan technique with the command "-sI" Correct Answer

Key Takeaways

The question tests whether you can match an anonymous port-scanning requirement to Nmap's IDLE scan and recognize that -sA, -sU, and -sY still originate from the tester's IP.

The IDLE/IPID header scan (-sI) lets a CEH use a zombie host to scan a target's TCP ports without exposing the scanner's own IP address. This page explains why D is the answer, how Zenmap's -sI option works, and why ACK, UDP, and SCTP scans fail the anonymity requirement.

Common mistake: The common wrong answer is C (-sA ACK scan), because it sounds stealthy and can evade some stateful firewalls, but ACK scanning only classifies filtered versus unfiltered ports and still sends packets from the scanner's IP.

Expert Analysis

Why the Answer Is Correct

IDLE/IPID header scanning (-sI) is the only listed technique designed for blind, source-IP-hiding port discovery. In Zenmap/Nmap the tester specifies a zombie host whose IPID sequence is predictable; probes to the target are spoofed as the zombie, and changes in the zombie's IPID value reveal whether the target port is open. Because the target never receives a packet sourced from the tester's real address, the scan satisfies the "without revealing its IP address" constraint while still identifying open TCP ports and associated services. The -sI command therefore matches both requirements in the scenario.

Why the Other Options Are Wrong

A's -sY SCTP INIT scan is an SCTP-oriented scan variant, but it sends probes from the tester's own IP and does not provide zombie-based anonymity. B's -sU UDP scan also originates from the scanner's address, is slow, and ICMP port-unreachable responses can reveal the source. C's -sA ACK scan is a firewall-mapping technique that distinguishes filtered from unfiltered ports; it cannot reliably identify open TCP ports, and its packets still carry the tester's source IP. None of these combines source-IP hiding with open-port discovery as -sI does.

Community Comment Notes

As insaniunt and qtygbapjpesdayazko noted, the IDLE scan impersonates another computer through spoofing and uses a "zombie" host to scan the remote target. brrbrr summarized it as "blind port scanning (without sending any packet with own IP)," while vibhorsharma1998.vs tied the answer to spoofing. The unanimous D votes reflect that reasoning, but the technical differentiator remains that only -sI both hides the source and enumerates open ports.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When the stem says "without revealing its IP address," look for a scan that uses a zombie or spoofed source, not merely a stealthy TCP flag combination. In Zenmap, bind that concept to -sI; -sA, -sU, and -sY are source-IP-bearing scans.

Frequently Asked Questions

Why does the IDLE/IPID scan (-sI) hide the scanner's IP?

It spoofs packets from a zombie host and infers open ports by watching the zombie's IPID changes, so the target never sees the tester's real address.

Can ACK scan (-sA) find open ports while staying anonymous?

No. -sA maps firewall behavior rather than open TCP ports and still sends probes from the scanner's IP address.

More 312-50v12 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. insaniunt 👍 2 Answered D
    IDLE/IPID header scan - The attacker performs this scan by impersonating another computer via spoofing. The attacker does not send a packet from their IP address; instead, they use another host, often called a “zombie,” to scan the remote host and identify open ports. In this attack, the attacker expects the sequence numbers of the zombie host, and if the remote host checks the IP of the scanning party, the IP of the zombie machine is displayed - Module 03 Page 315
  2. brrbrr 👍 1 Answered D
    D. • Allows for blind port scanning (without sending any packet with own IP) • Utilizes IP address of a zombie machine through spoofed packets
  3. qtygbapjpesdayazko 👍 1 Answered D
    IDLE/IPID header scan - The attacker performs this scan by impersonating another computer via spoofing.
  4. JR22craft 👍 1 Answered D
    D. Use the IDLE/IPID header scan technique with the command "-sI"
  5. JustAName 👍 1 Answered D
    D. IDLE/IPID scan spoof its ip while perform scanning
Show 1 more comment
  1. vibhorsharma1998.vs 👍 1
    D, IDLE SCAN is Correct because of spoofing

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide