CEH Footprinting, Reconnaissance and Scanning Practice Question
A security analyst notices that their Nmap scan results show all ports as 'filtered' despite the target host being alive and responsive to ping. Which of the following is the MOST likely cause?
⚠ Common exam trap
A common mix-up: candidates confuse 'filtered' with 'closed' or 'open', or assume a host that responds to ping must have open ports, but a firewall can silently drop all inbound TCP/UDP probes while still allowing ICMP echo requests.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The target has a host-based firewall that drops all incoming traffic silently
When an Nmap scan shows all ports as 'filtered', it indicates that the target is reachable (since ping succeeds) but the probe packets (e.g., SYN, ACK) are being dropped without any response. A host-based firewall configured to silently drop all incoming traffic is the most likely cause, as it prevents Nmap from receiving RST or SYN/ACK replies, leading to the 'filtered' state for every port.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The analyst's machine has a misconfigured routing table
Why it's wrong here
If the analyst's machine had a misconfigured routing table, Nmap would typically report the target host as unreachable or display "No route to host" errors, indicating a fundamental network path failure. A "filtered" status, however, specifically indicates that the Nmap probe successfully reached the target's network segment, but a device is actively preventing the probe from eliciting a response, rather than a failure to route to the host at all.
- ✓
The target has a host-based firewall that drops all incoming traffic silently
Why this is correct
When Nmap reports a port as "filtered," it means that the Nmap probe packets (e.g., SYN for TCP, ICMP for UDP) reached the target, but no response was received from the target host. This behavior is characteristic of a firewall, either host-based or network-based, configured to silently drop incoming traffic without sending an RST packet (for TCP) or an ICMP Port Unreachable message (for UDP). Such silent drops prevent Nmap from determining the port's true state (open or closed), leading to the "filtered" classification.
- ✗
The target is running a honeypot that mimics multiple services
Why it's wrong here
A honeypot's primary function is to attract and deceive attackers by mimicking legitimate services and appearing vulnerable to gather intelligence. Therefore, if a honeypot were running, Nmap would likely detect numerous "open" ports, as the honeypot would actively respond to connection attempts to simulate active services. A "filtered" status indicates a lack of response, which contradicts the active deception strategy of a honeypot designed to engage with probes and appear accessible.
- ✗
The target is an idle host that does not respond to any traffic
Why it's wrong here
An idle host that is online and reachable would still respond to Nmap probes, even if no applications are listening on specific ports. For TCP ports, if a port is closed, the host's operating system would send a TCP RST (Reset) packet in response to a SYN probe. For UDP ports, an ICMP Port Unreachable message would typically be returned; the "filtered" status specifically indicates that the probe was sent but no response was received, implying an active filtering mechanism rather than mere idleness.
Visual reference
Go deeper
Related to this question
Learn chapter
Hacking Wireless Networks
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
Key term
Port Scanning Techniques
Port scanning techniques are methods used to probe a computer or network to discover which network ports are open and which services are running on those ports.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.