312-50 Question 77
Single answer▪ Scanning Beyond IDS and FirewallYou are conducting an authorized external assessment of a company that uses a stateful firewall and a network-based IDS at the perimeter. A standard TCP SYN scan from your testing host is immediately flagged, and subsequent probes are rate-limited. The rules of engagement allow only safe reconnaissance and prohibit denial-of-service conditions. You still need to identify likely services exposed by a target host while reducing the chance of triggering the IDS. Which approach is the MOST appropriate?
- A
Use a slow TCP SYN scan with increased delays between probes and randomize the target port order
- B
Launch a fragmented UDP flood to exhaust the IDS and then run a full connect scan
- C
Send repeated ACK floods to map all open ports because ACK scans directly identify listening services
- D
Use an aggressive XMAS scan against all ports because modern firewalls do not inspect unusual TCP flag combinations
Show answer and explanation
Correct answer: A
Explanation
In CEH-style scanning scenarios, the best answer is often the method that balances information gathering with operational safety and realistic evasion. When a SYN scan is being detected, slowing the scan, adjusting timing, and randomizing probe order are classic low-impact techniques for reducing detectability without violating rules of engagement. Tools such as Nmap support timing controls and randomized scan behavior, but no method guarantees stealth against a well-tuned IDS/IPS. By contrast, floods and intentionally disruptive traffic are inappropriate in authorized assessments unless explicitly approved. ACK scans are useful for firewall mapping, not service enumeration, and exotic flag scans such as XMAS or FIN are less dependable against modern stacks and perimeter defenses. This aligns with common guidance in professional penetration testing practice and Nmap documentation regarding scan timing, host behavior, and the limited reliability of some evasion techniques in modern environments.
- A. Correct.
Correct. A slower TCP SYN scan with timing delays and randomized port order is a realistic stealthier approach when operating under rules that prohibit disruptive testing. Reducing the probe rate can help avoid simple threshold-based IDS signatures and rate-based firewall responses. Randomizing ports also makes the scan pattern less obvious than sequential probing. This does not guarantee evasion, especially against modern IDS/IPS platforms, but it is the most appropriate low-impact technique among the options.
- B. Incorrect.
Incorrect. A fragmented UDP flood is both unsafe and likely outside the scope of a professional assessment because it can create denial-of-service conditions. It is not an acceptable reconnaissance method under restrictive rules of engagement. In addition, fragment-based evasions are less effective against modern security devices that perform packet reassembly or normalization.
- C. Incorrect.
Incorrect. ACK scans do not identify open listening services in the same way SYN or connect scans do. They are primarily used to determine whether ports are filtered or unfiltered and can help infer firewall rule behavior. Flooding with ACK packets would also be noisy and more likely to trigger detection, making this a poor choice.
- D. Incorrect.
Incorrect. XMAS scans rely on RFC behavior differences and can sometimes reveal open or filtered states on certain systems, but they are not reliable across modern operating systems and are often blocked or detected by firewalls and IDS/IPS devices. The statement that modern firewalls do not inspect unusual TCP flag combinations is false; such traffic is commonly scrutinized.