Both A and D could work in certain circumstances, but I am sure they mean D.  The theory of the ping flood is you can confuse the IDS by over loading it wth packet data, that way you dont stand out. Not very stealth in one sense. but it can work for a quick in and out attack.  On the other hand depending on what you define as a "network tunnel" you could  make a tunnel and make sure your data flow is encrypted, while you wont hide that you are  there, you might hide what you are doing.

  I think the problem with the question is the wording. What do they mean by “attack” because some Admins would even consider an active sniffing and port probing the beginning of an attack.  If he doesnt want to attack it, then what are they talking about? Send happy little emails to it?  Perhaps its a typo and they meant he doesnt want his attack to be seen as an attack? Also,I think they should have written “Send a flood of fragments” instead of Ping flood, which limits it to ICMP packets.
   
  Flooding an IDS with fragments is a well known method of attempting to evade the IDS. The idea is to try and tie up all the memory capacity of the IDS by sending in so many fragments that the system becomes saturated. Once saturated the IDs might not detect your next move because it can’t gather the packets with its packet queue filled.
 
  Any way, I would not attempt to do it that way; I have better success with FragRoute. Its better to try and craft your packets in such a way that the IDS doesn’t understand them.

   All in all, this seems like another example of a poorly written test question for the CEH examine by some vender selling prep tests.

Thanks for the prompt reply everybody. And I am certainly glad that I wasn't the only one confused by this question!

I guess when I read the question I did make a few presumptions. Namely, that the 'ping flood' would be considered an attack, and secondly that the 'network tunnel' would be somehow encrypted and therefore avoid detection by the N-IDS.

That seems to be the general consensus. So most people here would go for 'D' then?

its on the cheat exam...

why not B?  if you can slip your attack in with a bunch of false positives dont you have a chance of the attack being overlooked?

i dont believe creating false positives would be considered attacking the box...but as you can tell by the thread its open to debate ;-)

  Wow, you are studying all of those exam preps?  I admire your effort. I will say I am not a big fan of preps like those.  I think they might have some value if you use it as a guide to test your general knowledge, but from what I hear and what I have actually seen, they are a waist of time if you hope you will see the exact same questions on the CEH examine.  I remember reading a number of posts on the old Boson forum that there were only 2 questions on the entire CEH examine that mirrored the questions in the Boson prep.  There were so many complaints that Boson closed down the forum! That’s not good if you were hoping to just memorize a bunch of answers and ace the test, lol! My feeling is its better to focus on real world hacking skill than just trying to pass a test by reading questions and answers. 

  So say you pass the test and you still cant do a pentest? What value is that and how long will you last in the industry? Of course reading is good and my advice is to read “Counter Hack” by Ed Skoudis to get an over view. Then read “ Certified Ethical Hacker” by Michael Gregg to get a better idea of the CEH material. After that, work with something like Learn Security Online which has a lot of practical work. Make sure you set up some kind of hack lab and then get busy.  The key is to get your fingers dirty so to speak. Don’t be an armchair hacker

Well LegioX

If you are targetting the exams try the testking. Did the exam about 2 weeks ago. About 95% of the questions matched word to word with testking. But dont rely on the answers. I havent tried the others though.

My advice/comments on the exam is on thread http://www.ethicalhacker.net/component/option,com_smf/Itemid,49/topic,665.0/

regards

agreed.

Once you start running the tools and realise the power behind them, you will never be able to get out if u are serious about security/hacking