CEH Scanning Networks and Enumeration Practice Question
Exhibit
Refer to the exhibit. ``` $ sudo nmap -sS -sV -O -p 1-1000 192.168.1.10 Starting Nmap 7.93 ( https://nmap.org ) Nmap scan report for 192.168.1.10 Host is up (0.0012s latency). Not shown: 995 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.52 443/tcp open ssl/http Apache httpd 2.4.52 3389/tcp filtered ms-wbt-server 8080/tcp open http-proxy Apache httpd 2.4.52 Device type: general purpose Running: Linux 5.X OS CPE: cpe:/o:linux:linux_kernel:5 OS details: Linux 5.0 - 5.14 Network Distance: 1 hop ```
Refer to the exhibit. A penetration tester runs the above Nmap scan. Which of the following statements is most accurate regarding the state of port 3389?
⚠ Common exam trap
It's easy for candidates to confuse 'filtered' with 'closed' or 'open', failing to recognize that Nmap's port states (open, closed, filtered) have distinct meanings based on the type of response received, and that a firewall can cause a filtered state without revealing whether the service is actually running.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A firewall is likely blocking the scan probes to port 3389, preventing Nmap from determining whether the port is open.
The Nmap scan output shows port 3389 in a 'filtered' state, which means Nmap received no response or an ICMP unreachable error from the target. This typically indicates a firewall is blocking the probes, preventing Nmap from determining whether the port is actually open or closed. A filtered state does not confirm the port is open or closed, only that access is being obstructed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Port 3389 is open and running a Remote Desktop service, but the service version could not be identified.
Why it's wrong here
A 'filtered' state in Nmap output explicitly indicates that Nmap was unable to determine if the port is open or closed because packet filters, such as a firewall, are preventing its probes from reaching the target port. Therefore, inferring that the port is open and running a specific service, even without version identification, is an incorrect conclusion. Nmap cannot confirm any service activity on a filtered port, only that its probes were obstructed.
- ✗
Port 3389 is closed and the target is ignoring the probe.
Why it's wrong here
If port 3389 were truly closed, Nmap would typically receive an RST (reset) packet in response to its probes, leading to a 'closed' status in the scan results. The 'filtered' state, however, signifies that Nmap's probes were likely dropped by an intermediary device, such as a firewall, without receiving any response. This prevents Nmap from confirming the port's actual state and does not imply the target is merely ignoring the probe on a closed port.
- ✗
The target is likely a honeypot designed to simulate a Windows machine.
Why it's wrong here
While honeypots can exhibit various behaviors, a 'filtered' port status alone provides no specific indication of a honeypot. This state primarily suggests the presence of a network filtering device, like a firewall, actively dropping or rejecting scan packets. Identifying a honeypot would typically require more advanced analysis, such as inconsistent service banners, unusual responses to specific probes, or a high number of open, vulnerable-looking ports that don't correspond to a typical production system.
- ✓
A firewall is likely blocking the scan probes to port 3389, preventing Nmap from determining whether the port is open.
Why this is correct
The 'filtered' state in Nmap output precisely indicates that Nmap was unable to ascertain whether a port is open or closed because its probes did not elicit a response. This condition commonly arises when a firewall or other packet filtering device is actively dropping or rejecting the scan packets directed at port 3389, thereby preventing Nmap from completing its state determination process. This is the most accurate interpretation of a 'filtered' port, signifying an unknown state due to network obstruction.
Go deeper
Related to this question
Learn chapter
Penetration Testing and Reporting
Key term
Port Scanning Techniques
Port scanning techniques are methods used to probe a computer or network to discover which network ports are open and which services are running on those ports.
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.