FirstTry

Exam objective

CEH

Evading IDS, Firewalls, and Honeypots

This objective sits in Network and Perimeter Hacking, which carries 24% of the CEH exam. The questions below are original, written from the official objective title above, and each explanation cites the EC-Council page it rests on.

Objective title verbatim from the official objectives. EC-Council exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

Network and Perimeter Hacking

A tester splits probe packets so that the TCP header is spread across several tiny fragments. Which effect is intended?

The scan completes faster on slow linksFragmentation adds headers and packets, so it costs throughput instead of saving it.
The target reassembles them into a larger scanReassembly happens at the destination and restores the original probe rather than enlarging it.
Packet filters cannot read the header fieldsCorrect · your answerCorrect.
Each fragment carries its own TCP checksumThe transport checksum is computed once over the whole segment, not per fragment.

Correct.

Checked against nmap.org, September 2026

Concept

A filtering device decides on fields it can see. Dividing a transport header across fragments means the fields a rule matches on may not be present in the packet the rule examines.

Why C

Splitting the header across fragments is meant to leave a filter or sensor without the fields it needs to recognize the probe.

Source

The -f option causes the requested scan (including host discovery scans) to use tiny fragmented IP packets. The idea is to split up the TCP header over several packets to make it harder for packet filters, intrusion detection systems, and other annoyances to detect what you are doing.

Nmap Reference Guide, Firewall/IDS Evasion and Spoofing, checked September 2026
#packet-fragmentation#nmap#ids-evasion

Now you: practice questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

Network and Perimeter Hacking

A team turns on full fragment queuing at the perimeter firewall. What happens to fragmented scan probes after that?

Sample question 2 of 3

Network and Perimeter Hacking

An engineer notices that the fragmentation option had no effect during a version detection scan. What explains that?

Sample question 3 of 3

Network and Perimeter Hacking

An analyst reviews sensor alerts from a single scan window.

[**] [1:1000002:1] Portscan detected [**]09/15-14:22:03  src 203.0.113.11 -> 10.4.9.20  ports 21,22,25,8009/15-14:22:03  src 198.51.100.7 -> 10.4.9.20  ports 21,22,25,8009/15-14:22:03  src 192.0.2.44   -> 10.4.9.20  ports 21,22,25,80

Which option produces this pattern?

That’s 3 of the full CEH bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Network and Perimeter Hacking