CEH Vulnerability Analysis and System Hacking Practice Question

Exhibit

nmap -sV -p 22,80,443,3306 target.com
Starting Nmap 7.80 ( https://nmap.org ) at 2023-08-15 14:22 EDT
Nmap scan report for target.com (192.168.1.100)
Host is up (0.0012s latency).

PORT     STATE    SERVICE VERSION
22/tcp   open     ssh     OpenSSH 7.4 (protocol 2.0)
80/tcp   filtered http    
443/tcp  open     ssl/http Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips)
3306/tcp open     mysql   MySQL 5.6.50

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.67 seconds

Refer to the exhibit. During a penetration test, the results show port 80 as 'filtered'. Which of the following is the most likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A firewall or ACL is blocking the port.

Nmap's 'filtered' port state is a critical indicator in network reconnaissance, signifying that a firewall, Access Control List (ACL), or other packet filtering device is actively interfering with the scan. Unlike 'open' (where a SYN/ACK is received) or 'closed' (where a RST packet is received), a 'filtered' state means Nmap's probes either received no response at all, or an ICMP error message like "Host Unreachable" or "Communication Administratively Filtered" was returned. This prevents Nmap from definitively determining if a service is listening on the port. For attackers, 'filtered' ports highlight the presence of security mechanisms, prompting them to explore advanced evasion techniques, such as using different scan types (e.g., ACK scans to map firewall rules or idle scans) or fragmented packets to bypass stateful firewalls. For defenders, 'filtered' ports confirm that perimeter defenses are operational and effectively blocking unauthorized probes, providing valuable feedback on security posture.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The SSH service is interfering with the scan.
Why it's wrong here
Nmap conducts port scans by sending specific probes to individual ports and analyzing the responses received. The operation of a service like SSH on port 22 is isolated to that particular port and its associated protocols, such as TCP. It does not inherently interfere with Nmap's ability to probe or receive responses from other distinct ports, like port 80, which would be handled as a separate communication channel. Therefore, an active SSH service cannot cause a 'filtered' status on an unrelated port.
✗
The target host is offline.
Why it's wrong here
If the target host were truly offline, Nmap would report it as "Host is down" or "No route to host," indicating a complete lack of reachability, rather than providing specific port status information. The presence of a latency measurement, such as 0.0012s, explicitly indicates that Nmap successfully received a response from the target during its host discovery phase. A 'filtered' port status, therefore, confirms the host is reachable and actively processing network traffic, even if it's blocking specific probes.
✗
The web server is not running.
Why it's wrong here
If the web server application were not running on port 80, Nmap would typically report the port as 'closed'. A 'closed' status indicates that the host received the Nmap probe but no application is listening on that specific port, resulting in a RST packet response. The 'filtered' status, however, signifies that Nmap's probes are being actively blocked or dropped by an intermediary device, preventing Nmap from determining the port's true state (open or closed).
✓
A firewall or ACL is blocking the port.
Why this is correct
An Nmap port scan result of 'filtered' specifically indicates that Nmap was unable to determine if the port is open or closed because its probes did not elicit a definitive response, or an ICMP unreachable message was received. This behavior is characteristic of a firewall, Access Control List (ACL), or other packet filtering device actively dropping or rejecting the Nmap probe packets targeting port 80. Such security mechanisms are designed to prevent unauthorized access by blocking traffic to specific ports, making the port appear 'filtered' to the scanner.

Go deeper

CEH Vulnerability Analysis and System Hacking Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question