CEH Footprinting, Reconnaissance and Scanning Practice Question
A penetration tester runs 'nmap -sS -p 80 --script http-title 192.168.1.100' and receives output indicating port 80 is 'filtered'. What does the 'filtered' state imply?
⚠ Common exam trap
Candidates often confuse 'filtered' with 'closed' or assume it means the service is running but unreachable, when in fact 'filtered' specifically indicates the probe was blocked by a filtering device.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A firewall is likely blocking the probe packets
The 'filtered' state in Nmap indicates that the probe packets (SYN packets for a SYN scan) were dropped or did not elicit any response, typically due to a firewall or packet filter. Since no SYN/ACK or RST was received, Nmap cannot determine if the port is open or closed, so it marks it as 'filtered'. This is distinct from an 'open' state (SYN/ACK received) or 'closed' state (RST received).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The port is open and a service is listening
Why it's wrong here
Nmap's 'filtered' state explicitly indicates that the port's status cannot be determined because probe packets are not reaching the target or responses are not returning. If the port were truly 'open' and a service listening, Nmap would receive a SYN/ACK response to its SYN probe (for a SYN scan), leading to an 'open' status report. The absence of such a response, coupled with no RST, signifies filtering, not openness, making this option incorrect.
- ✓
A firewall is likely blocking the probe packets
Why this is correct
The 'filtered' state in Nmap signifies that the port is inaccessible because probe packets are being dropped, or responses are not reaching the scanner. This typically occurs when a firewall, intrusion prevention system (IPS), or other network security device is actively inspecting and blocking traffic destined for that specific port, preventing Nmap from determining if a service is listening. The lack of any definitive response (SYN/ACK for open, RST for closed) points directly to an intermediate device interfering, making this the correct explanation.
- ✗
The service is running but the script failed
Why it's wrong here
Nmap scripts, such as `http-title`, require an established connection to the target service to execute and gather information. Since the port is reported as 'filtered', Nmap could not successfully establish a connection or even determine if a service is present. Therefore, the script would not have been able to run at all, let alone fail, because the fundamental communication channel was blocked, rendering this option incorrect.
- ✗
The port is closed and no service is listening
Why it's wrong here
A 'closed' port, unlike a 'filtered' one, actively responds to Nmap's probes by sending back a TCP RST (reset) packet, indicating that no application is listening on that port. The 'filtered' state, however, implies that no response whatsoever is received, because the probe packets themselves are being silently dropped or blocked by an intermediate device, preventing any RST from being sent by the target host. Thus, this option is incorrect.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.