CPENT Network And Perimeter Exploitation Practice Question
You are attempting to evade a stateful packet inspection (SPI) firewall that drops TCP packets with invalid TCP flag combinations. You decide to use Nmap to perform a stealth scan against a target web server behind this perimeter. Which Nmap scan type explicitly sends a packet with the FIN, PSH, and URG flags set, relying on RFC 793 behavior where closed ports reply with an RST and open ports ignore the packet?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Nmap Xmas Tree Scan (-sX)
An Xmas tree scan (-sX) sets the FIN, PSH, and URG flags, lighting up the packet like a Christmas tree. According to RFC 793, closed ports must respond with a reset, whereas open ports drop the packet silently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Nmap Null Scan (-sN)
Why it's wrong here
A Null scan turns off all TCP flags, setting the header flags field to zero.
- ✗
Nmap Window Scan (-sW)
Why it's wrong here
A window scan exploits implementation details of TCP window sizes on certain operating systems to differentiate open and closed ports, rather than manipulating FIN, PSH, and URG flags.
- ✗
Nmap FIN Scan (-sF)
Why it's wrong here
A FIN scan only sets the TCP FIN flag, whereas the Xmas tree scan sets FIN, PSH, and URG simultaneously.
- ✓
Nmap Xmas Tree Scan (-sX)
Why this is correct
The Xmas tree scan explicitly sets the FIN, PSH, and URG flags to probe firewall and port states based on RFC 793 specifications.
About these practice questions
Courseiva writes every CPENT question from scratch — 274 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CPENT practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CPENT exam.