While performing an Nmap scan against a host, Paola determines the existence of a firewall. In an attempt to determine whether the firewall is stateful or stateless, which of the following options wou

Question

Options

• A-sA
• B-sX
• C-sT
• D-sF

• A
  75% (21)
• B
  4% (1)
• C
  14% (4)
• D
  7% (2)

Explanation

Nmap Firewall Detection Explanation

Using -sA (ACK scan) is the best method to determine whether a firewall is stateful or stateless. An ACK scan sends TCP packets with only the ACK flag set - packets that don't belong to any established connection. A stateless firewall will simply block or allow based on port rules and return an RST (reporting the port as "unfiltered"), while a stateful firewall will drop the packet entirely (reporting "filtered") because it tracks connection states and recognizes the ACK has no matching SYN.

The distractors are incorrect because:

• -sX (Xmas scan) sets FIN, PSH, and URG flags and is used to identify open ports or bypass simple firewalls, not to distinguish firewall types
• -sT (TCP Connect scan) performs a full three-way handshake and is a basic connectivity scan, not designed for firewall analysis
• -sF (FIN scan) sends only FIN-flagged packets to detect open ports, not to classify firewall behavior

Memory Tip: Think "A" for "ACK = Analyze the firewall." Since ACK packets have no business arriving without a prior SYN, a smart (stateful) firewall will drop them, while a dumb (stateless) one won't know the difference.

No community discussion yet for this question.