Michael works for Kimball Construction Company as senior security analyst. As part of yearly security audit, Michael scans his network for vulnerabilities. Using Nmap, Michael conducts XMAS scan and…

The correct answer is C. Open. An Nmap XMAS scan sends packets with the FIN, URG, and PSH flags set simultaneously. Per RFC 793, a host should respond with an RST packet only if the port is CLOSED. If the port is OPEN, the target silently drops the malformed packet and sends no response. Therefore, no…

Submitted by andres_qro· Apr 18, 2026Network Forensics

Question

Michael works for Kimball Construction Company as senior security analyst. As part of yearly security audit, Michael scans his network for vulnerabilities. Using Nmap, Michael conducts XMAS scan and most of the ports scanned do not give a response. In what state are these ports?

Options

AFiltered
BClosed
COpen
DStealth

How the community answered

(49 responses)

A
2% (1)
B
2% (1)
C
92% (45)
D
4% (2)

Explanation

An Nmap XMAS scan sends packets with the FIN, URG, and PSH flags set simultaneously. Per RFC 793, a host should respond with an RST packet only if the port is CLOSED. If the port is OPEN, the target silently drops the malformed packet and sends no response. Therefore, no response in an XMAS scan is the signature of an open port. A filtered port may also produce no response (due to a firewall dropping packets), but the primary and expected interpretation - and the one tested here - is that silence equals open.

Topics

#Nmap#XMAS scan#Port scanning#TCP port states

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice