CEH Vulnerability Analysis and System Hacking Practice Question

Exhibit

nmap -sV -p 22,80,443,3306 target.com
Starting Nmap 7.80 ( https://nmap.org ) at 2023-08-15 14:22 EDT
Nmap scan report for target.com (192.168.1.100)
Host is up (0.0012s latency).

PORT     STATE    SERVICE VERSION
22/tcp   open     ssh     OpenSSH 7.4 (protocol 2.0)
80/tcp   filtered http    
443/tcp  open     ssl/http Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips)
3306/tcp open     mysql   MySQL 5.6.50

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.67 seconds

Refer to the exhibit. During a penetration test, the results show port 80 as 'filtered'. Which of the following is the most likely reason?

⚠ Common exam trap

CEH often tests the distinction between 'closed' (RST received, service not listening) and 'filtered' (no response, firewall blocking); candidates confuse the two and select 'web server not running'.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A firewall or ACL is blocking the port.

A 'filtered' port state in Nmap means the probe was sent but no response was received, and the most common cause is a firewall, ACL, or packet-filtering device silently dropping the packets. Unlike 'closed' (RST returned) or 'open' (SYN-ACK returned), 'filtered' indicates active blocking. This is the textbook interpretation of Nmap's filtered state.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The SSH service is interfering with the scan.
Why it's wrong here
Nmap conducts port scans by sending specific probes to individual ports and analyzing the responses received. The operation of a service like SSH on port 22 is isolated to that particular port and its associated protocols, such as TCP. It does not inherently interfere with Nmap's ability to probe or receive responses from other distinct ports, like port 80, which would be handled as a separate communication channel. Therefore, an active SSH service cannot cause a 'filtered' status on an unrelated port.
✗
The target host is offline.
Why it's wrong here
If the target host were truly offline, Nmap would report it as "Host is down" or "No route to host," indicating a complete lack of reachability, rather than providing specific port status information. The presence of a latency measurement, such as 0.0012s, explicitly indicates that Nmap successfully received a response from the target during its host discovery phase. A 'filtered' port status, therefore, confirms the host is reachable and actively processing network traffic, even if it's blocking specific probes.
✗
The web server is not running.
Why it's wrong here
If the web server application were not running on port 80, Nmap would typically report the port as 'closed'. A 'closed' status indicates that the host received the Nmap probe but no application is listening on that specific port, resulting in a RST packet response. The 'filtered' status, however, signifies that Nmap's probes are being actively blocked or dropped by an intermediary device, preventing Nmap from determining the port's true state (open or closed).
✓
A firewall or ACL is blocking the port.
Why this is correct
An Nmap port scan result of 'filtered' specifically indicates that Nmap was unable to determine if the port is open or closed because its probes did not elicit a definitive response, or an ICMP unreachable message was received. This behavior is characteristic of a firewall, Access Control List (ACL), or other packet filtering device actively dropping or rejecting the Nmap probe packets targeting port 80. Such security mechanisms are designed to prevent unauthorized access by blocking traffic to specific ports, making the port appear 'filtered' to the scanner.

Visual reference

Go deeper

CEH Vulnerability Analysis and System Hacking Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question