312-50 Question 264
Single answer▪ Evading IDSDuring an authorized internal penetration test, a security team notices that a network-based IDS is generating alerts whenever the tester performs a standard SYN port scan against a Linux server. The tester wants to reduce the likelihood of detection while still identifying open TCP ports in a way that is commonly supported by real-world tooling. Which approach is the BEST choice?
- A
Use a slower scan with increased delay and lower packet rate, such as adding timing controls to spread probes over a longer period
- B
Switch from a SYN scan to a UDP scan because UDP traffic cannot be detected by network IDS sensors
- C
Use an ACK scan to reliably enumerate open TCP ports while avoiding IDS detection
- D
Fragment packets because packet fragmentation guarantees that the IDS will not reconstruct or inspect the scan traffic
Show answer and explanation
Correct answer: A
Explanation
The best answer is to slow the scan and reduce its signature by adjusting timing. In practice, IDS products often detect scans based on frequency, connection patterns, and threshold rules rather than just the presence of individual packets. Nmap documentation describes timing templates and options such as scan delay and packet rate controls that can change how noisy a scan appears. By contrast, UDP scans do not evade IDS and do not enumerate TCP ports, ACK scans are mainly for firewall analysis rather than open-port discovery, and fragmentation is not a dependable evasion method against modern IDS systems that perform reassembly. From a best-practice perspective in authorized testing, the goal is to use the least disruptive technique that still meets the engagement objective, and tuning scan timing is a common, realistic choice.
- A. Correct.
Correct. Slowing the scan rate and introducing delays between probes is a practical IDS evasion technique because many IDS signatures and threshold-based detections are tuned to identify rapid or bursty scanning behavior. Tools such as Nmap support timing controls and options to reduce the scan rate or add delays, which can help a tester stay below alert thresholds. This does not guarantee invisibility, but it is a realistic and commonly used method to reduce detection likelihood.
- B. Incorrect.
Incorrect. UDP traffic can absolutely be detected by network IDS solutions. In fact, unusual UDP probing often stands out because many environments have limited legitimate UDP service exposure. Switching to UDP also does not solve the requirement to identify open TCP ports.
- C. Incorrect.
Incorrect. ACK scans are not designed to enumerate open TCP ports reliably. They are primarily used to map firewall rulesets by distinguishing filtered from unfiltered states. A candidate might choose this option because ACK scans are sometimes discussed in stealth contexts, but they do not meet the stated objective of identifying open TCP ports.
- D. Incorrect.
Incorrect. Packet fragmentation may sometimes affect detection depending on IDS configuration, but it does not guarantee evasion. Modern IDS/IPS platforms commonly perform fragment reassembly or normalization. Fragmentation can also introduce reliability issues and is not the best answer compared with simply slowing the scan rate.