CEH Footprinting, Reconnaissance and Scanning Practice Question
During a security assessment, a tester runs hping3 with the command: hping3 -S -p 80 -c 5 10.0.0.1. The response shows that packets with the SYN flag set receive SYN-ACK replies. Which of the following conclusions is MOST accurate?
⚠ Common exam trap
Candidates often confuse the SYN-ACK response with firewall behavior or closed port responses, but the correct interpretation is that a SYN-ACK directly indicates an open port per TCP specification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port 80 is open on 10.0.0.1
The hping3 command with the -S flag sends TCP SYN packets to port 80 on 10.0.0.1. Receiving SYN-ACK replies indicates that the target responded with the second step of the TCP three-way handshake, which only occurs when the port is open and listening. This confirms that port 80 is open on the target host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Port 80 is open on 10.0.0.1
Why this is correct
When hping3 sends a TCP SYN packet to a target port, the receipt of a SYN-ACK packet in response is the definitive indication that the port is open and an application is actively listening. This response signifies the second step of the TCP three-way handshake, where the target acknowledges the SYN and sends its own synchronization request. Therefore, a SYN-ACK from 10.0.0.1 on port 80 confirms that the port is open and ready to establish a connection.
- ✗
A firewall is blocking the scan
Why it's wrong here
A firewall actively blocking a scan would typically manifest in one of two ways: either by silently dropping the SYN packet, resulting in no response, or by sending an ICMP 'Destination Unreachable - Communication Administratively Filtered' message. The reception of a SYN-ACK packet directly contradicts a blocking scenario, as it confirms that the SYN packet successfully traversed any network defenses and reached a listening service on the target host.
- ✗
Port 80 is closed on 10.0.0.1
Why it's wrong here
If port 80 were closed on 10.0.0.1, the operating system's TCP/IP stack would respond to the incoming SYN packet with a TCP RST (Reset) packet, not a SYN-ACK. An RST packet immediately terminates the connection attempt, signaling that no application is listening on that specific port and that the connection cannot be established. The presence of a SYN-ACK explicitly indicates an open port, not a closed one.
- ✗
The target is using a stateful firewall that allows the connection
Why it's wrong here
While a stateful firewall might indeed permit the initial SYN packet to pass through, the SYN-ACK response originates from the *target host's* TCP stack, not merely the firewall. This response confirms that an application is actively listening on port 80, making the port itself open on the host. The firewall's allowance is a necessary condition for the packet to reach the host, but the SYN-ACK is the direct confirmation of the port's operational status on the destination machine.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.