if you send a TCP ACK segment to a known closed port on a firewall but it does not respond with an RST. What do you know about the firewall you are scanning?

The correct answer is C. It is a stateful firewall. ACK scan is enabled by specifying the -sA option. Its probe packet has only the ACK flag set (unless you use --scanflags). When scanning unfiltered systems, open and closed ports will both return a RST packet. Nmap then labels them as unfiltered, meaning that they are reachable…

Evading IDS, Firewalls, and Honeypots

Question

Options

AThere is no firewall in place.
BThis event does not tell you encrypting about the firewall.
CIt is a stateful firewall
DIt Is a non-stateful firewall.

How the community answered

(61 responses)

A
5% (3)
B
10% (6)
C
82% (50)
D
3% (2)

Explanation

ACK scan is enabled by specifying the -sA option. Its probe packet has only the ACK flag set (unless you use --scanflags). When scanning unfiltered systems, open and closed ports will both return a RST packet. Nmap then labels them as unfiltered, meaning that they are reachable by the ACK packet, but whether they are open or closed is undetermined. Ports that don't respond, or send certain ICMP error messages back.

Topics

#stateful firewall#ACK scanning#firewall detection#TCP state tracking

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice