CEH Introduction to Ethical Hacking Practice Question
Exhibit
Refer to the exhibit. ``` $ nmap -sS -T4 -p 22,80,443 192.168.1.10 Starting Nmap 7.80 ( https://nmap.org ) Nmap scan report for 192.168.1.10 Host is up (0.0012s latency). PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp closed https Nmap done: 1 IP address (1 host up) scanned in 2.45 seconds ```
Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?
⚠ Common exam trap
Watch out — candidates often confuse 'closed' with 'filtered' or 'unfiltered', not realizing that a closed port specifically means the host responded with a TCP RST, proving reachability without a listening service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
closed
A 'closed' port in Nmap indicates that the target host responded with a TCP RST (Reset) packet, meaning the port is reachable and the host is alive, but no application is listening on that port. This state confirms the port is accessible (not filtered by a firewall) yet no service is bound to it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
open
Why it's wrong here
An 'open' state signifies that a target port has an application actively listening for incoming connections. Nmap successfully completed a full TCP three-way handshake or received an expected response for UDP, confirming that the port is accessible and a service is ready to accept communication. This indicates a potential entry point for further enumeration and vulnerability assessment, but it is not the state depicted in the exhibit for the relevant port.
- ✓
closed
Why this is correct
A 'closed' port indicates that the target host is reachable and received Nmap's probe, but no application is currently listening on that specific port. For TCP scans, the target typically responds with an RST (reset) packet, confirming the port's accessibility while explicitly stating that no service is active there. This state is crucial as it differentiates between an inactive port and one that is blocked by a firewall, accurately reflecting the scenario where the host is up but the service is not running.
- ✗
filtered
Why it's wrong here
A 'filtered' state occurs when Nmap cannot definitively determine if a port is open or closed because a firewall, router, or other network security device is actively preventing the probe packets from reaching the target or blocking the response. This often results in Nmap receiving no response at all, or an ICMP unreachable error, indicating that the probe was dropped. This state suggests the presence of a protective mechanism, hindering direct port status assessment.
- ✗
unfiltered
Why it's wrong here
An 'unfiltered' state is primarily observed during an Nmap ACK scan, which is specifically designed to map firewall rulesets rather than ascertain if a service is listening. This state indicates that the port is accessible and not being blocked by a firewall, as the ACK probe successfully elicited an RST response. However, it provides no information about whether an application is actually listening on that port, making it distinct from 'open' or 'closed' states in terms of service availability.
Go deeper
Related to this question
Learn chapter
Introduction to Ethical Hacking
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
Key term
Port Scanning Techniques
Port scanning techniques are methods used to probe a computer or network to discover which network ports are open and which services are running on those ports.
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.