nerdexam
EC-Council

312-50V12 · Question #248

Consider a scenario where a Certified Ethical Hacker is attempting to infiltrate a company's network without being detected. The hacker intends to use a stealth scan on a BSD-derived TCP/IP stack, but

The correct answer is B. Xmas Scan, because it can pass through filters undetected, depending on the security. This question tests knowledge of stealth scanning techniques and their ability to evade network security devices, specifically when SYN packet detection is a concern.

Submitted by eva_at· Mar 4, 2026Reconnaissance Techniques

Question

Consider a scenario where a Certified Ethical Hacker is attempting to infiltrate a company's network without being detected. The hacker intends to use a stealth scan on a BSD-derived TCP/IP stack, but he suspects that the network security devices may be able to detect SYN packets. Based on this information, which of the following methods should he use to bypass the detection mechanisms and why?

Options

  • AMaimon Scan, because it is very similar to NULL, FIN, and Xmas scans, but the probe used here
  • BXmas Scan, because it can pass through filters undetected, depending on the security
  • CTCP Connect/Full-Open Scan, because it completes a three-way handshake with the target
  • DACK Flag Probe Scan, because it exploits the vulnerabilities within the BSD-derived TCP/IP stack

How the community answered

(24 responses)
  • A
    17% (4)
  • B
    67% (16)
  • C
    4% (1)
  • D
    13% (3)

Why each option

This question tests knowledge of stealth scanning techniques and their ability to evade network security devices, specifically when SYN packet detection is a concern.

AMaimon Scan, because it is very similar to NULL, FIN, and Xmas scans, but the probe used here

While the Maimon Scan is similar to NULL, FIN, and Xmas scans and can evade some filters, it specifically sends FIN/ACK probes and is less associated with bypassing SYN detection on BSD stacks compared to the Xmas Scan.

BXmas Scan, because it can pass through filters undetected, depending on the securityCorrect

The Xmas Scan sets the FIN, PSH, and URG flags simultaneously in the TCP packet, which does not include a SYN flag and therefore can bypass security devices configured to detect SYN-based scans. On BSD-derived TCP/IP stacks, this scan is particularly effective because these systems follow RFC 793 behavior, responding with RST packets to closed ports and dropping packets for open ports, making port state inference possible. Because the probe does not initiate a standard connection handshake, it is considered a stealth scan capable of slipping through certain firewall and IDS rule sets.

CTCP Connect/Full-Open Scan, because it completes a three-way handshake with the target

TCP Connect/Full-Open Scan completes the full three-way handshake including a SYN packet, making it the most detectable scan type and directly triggering the SYN-based detection mechanisms the hacker is trying to avoid.

DACK Flag Probe Scan, because it exploits the vulnerabilities within the BSD-derived TCP/IP stack

The ACK Flag Probe Scan is used primarily to map firewall rule sets and determine whether ports are filtered or unfiltered, not to perform stealth port scanning or bypass SYN detection mechanisms on BSD-derived stacks.

Concept tested: Stealth scanning techniques to evade SYN detection

Source: https://nmap.org/book/scan-methods-null-fin-xmas-scan.html

Topics

#Stealth scanning#TCP flags#Firewall evasion#Network scanning

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice