GPEN Scanning and Host Discovery Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  UDP scan (-sU)

  Why it's wrong here

  UDP scanning sends UDP packets to target ports and interprets ICMP port unreachable messages or lack thereof. It is unrelated to TCP ACK behavior and cannot be used to assess firewall statefulness. Since the question focuses on TCP ACK handling, this scan type is irrelevant and would not provide the needed information.

• ✗

  TCP FIN scan (-sF)

  Why it's wrong here

  A TCP FIN scan sends packets with only the FIN flag set. It is used to bypass some stateless firewalls and identify open ports on systems that follow RFC 793, but it does not help determine if a firewall is stateful. The responses to FIN packets do not reveal how the firewall handles ACK packets, so it is not suitable here.

• ✓

  TCP ACK scan (-sA)

  Why this is correct

  The TCP ACK scan sends ACK packets to target ports. A stateful firewall will typically drop unsolicited ACKs, resulting in a 'filtered' state, while a stateless firewall may allow them and the host will respond with RST, showing 'unfiltered'. By analyzing whether ports are filtered or unfiltered, you can infer the firewall's nature, making this the correct choice.

• ✗

  TCP connect scan (-sT)

  Why it's wrong here

  A TCP connect scan completes the full three-way handshake, so it does not rely on ACK packets alone. It is used when raw packet privileges are unavailable and is easily logged by the target. It cannot distinguish between stateful and stateless firewalls because it only shows whether a connection succeeds, not how the firewall treats unsolicited ACKs.