CEH Scanning Networks and Enumeration Practice Question

Exhibit

Refer to the exhibit.
```
Starting Nmap 7.92 ( https://nmap.org ) at 2025-03-25 14:22 EDT
Nmap scan report for 10.10.1.45
Host is up (0.045s latency).
Not shown: 997 closed tcp ports (reset)
PORT     STATE    SERVICE
22/tcp   open     ssh
80/tcp   filtered http
443/tcp  open     https
```

Refer to the exhibit. An Nmap scan shows that port 80 is 'filtered' while ports 22 and 443 are 'open'. What does the 'filtered' state indicate?

⚠ Common exam trap

Watch out — candidates often confuse 'filtered' with 'closed' or 'open', not realizing that 'filtered' specifically indicates a firewall or ACL is interfering with the probe, not the state of the service itself.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A firewall, router rule, or host-based firewall is blocking the probes.

When Nmap reports a port as 'filtered', it means that the scan probes (e.g., SYN packets) were dropped or blocked before reaching the target service, typically by a firewall, router ACL, or host-based firewall. Unlike 'open' (which receives a SYN/ACK) or 'closed' (which receives a RST), 'filtered' indicates no response or an ICMP unreachable message, so Nmap cannot confirm whether the port is actually open or closed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The port is closed and the target sent a RST packet.
Why it's wrong here
If a port is truly closed, the target host's TCP/IP stack would respond to an incoming SYN probe with a TCP RST (Reset) packet, indicating that no service is listening on that port. Nmap interprets this RST response as the port being definitively 'closed'. The 'filtered' state, however, implies that no such RST packet was received, meaning the probe was likely intercepted and dropped before reaching the host's TCP stack.
✗
The port is open but the service is not responding to the scan.
Why it's wrong here
For Nmap to classify a port as 'open', the target service must successfully complete the initial TCP three-way handshake by responding to a SYN probe with a SYN/ACK packet. Even if the service subsequently fails to respond to application-layer requests or is misconfigured, the initial SYN/ACK would still confirm the port's 'open' status. A 'filtered' state indicates that Nmap did not receive any SYN/ACK response, suggesting the probe never reached the service to begin with.
✗
The port is open but Nmap cannot determine the service.
Why it's wrong here
Nmap's ability to determine the service version (e.g., Apache HTTPD 2.4) is a separate function from determining the port state (open, closed, filtered). If a port is open, Nmap will report it as 'open', even if it cannot identify the specific service or its version due to an unknown banner or custom application. The 'filtered' state specifically signifies that Nmap's probes are being blocked, preventing any determination of whether the port is open or closed, let alone the service running on it.
✓
A firewall, router rule, or host-based firewall is blocking the probes.
Why this is correct
When Nmap reports a port as 'filtered', it signifies that the TCP or UDP probes sent to that port did not elicit any response from the target host. This behavior is characteristic of network security devices, such as firewalls (both network-based and host-based) or routers configured with Access Control Lists (ACLs), which are designed to silently drop incoming packets that do not match allowed rules. The probes are effectively absorbed into a "black hole," preventing Nmap from determining the true state of the port.

Visual reference

Go deeper

CEH Scanning Networks and Enumeration Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question