CEH Footprinting, Reconnaissance and Scanning Practice Question
An attacker sends a TCP SYN packet to a port and receives a TCP RST packet in response. According to Nmap's port state classification, what is the state of this port?
⚠ Common exam trap
EC-Council often tests the misconception that a RST response means the port is 'filtered' or 'open', but the correct interpretation per Nmap's classification is that a RST directly indicates a 'closed' port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Closed
When Nmap sends a TCP SYN packet to a port and receives a TCP RST packet in response, it indicates that the port is reachable but no service is listening on it. Per RFC 793, a RST is sent when a SYN arrives on a closed port, so Nmap classifies this port as 'closed'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Filtered
Why it's wrong here
When an attacker sends a TCP SYN packet to a port and receives no response, or an ICMP Destination Unreachable message (e.g., 'Host Unreachable' or 'Communication Administratively Filtered'), the port is considered 'Filtered.' This typically indicates that a firewall, intrusion detection system (IDS), or other network security device is actively blocking or dropping the packet, preventing it from reaching the target application. Therefore, receiving a specific response like an RST means the port is not 'Filtered' in this context.
- ✗
Unfiltered
Why it's wrong here
The 'Unfiltered' state is primarily relevant in the context of TCP ACK scans, not SYN scans, and indicates that a port is accessible through any intervening firewalls, but its open or closed status remains undetermined. When an ACK packet is sent to an unfiltered port, a RST packet is typically returned, signifying that the firewall is not blocking the connection. However, for a SYN scan, receiving an RST packet directly from the target host in response to a SYN packet specifically denotes a 'Closed' port, not merely an 'Unfiltered' one.
- ✓
Closed
Why this is correct
When a TCP SYN packet is sent to a port that is not actively listening for connections, the target host's TCP/IP stack responds with a TCP RST (Reset) packet. This RST packet serves to immediately terminate the connection attempt, signaling to the sender that there is no application bound to that specific port. This is the standard and expected behavior for a closed port, making 'Closed' the correct answer when an RST is received after a SYN.
- ✗
Open
Why it's wrong here
An 'Open' port signifies that an application or service is actively listening for incoming connections on that specific port. Upon receiving a TCP SYN packet, an open port would respond with a TCP SYN/ACK packet, initiating the second step of the three-way handshake. This SYN/ACK response indicates that the port is ready to establish a full TCP connection, which is distinct from receiving an RST packet.
Visual reference
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.