PT0-001 · Question #200
After an Nmap NSE scan, a security consultant is seeing inconsistent results while scanning a host. Which of the following is the MOST likely cause?
The correct answer is D. A firewall/IPS blocked the scan. Inconsistent Nmap scan results - where some probes succeed and others fail or return filtered - are a hallmark of stateful firewall or IPS rate-limiting and dynamic blocking behavior.
Question
After an Nmap NSE scan, a security consultant is seeing inconsistent results while scanning a host. Which of the following is the MOST likely cause?
Options
- AServices are not listening
- BThe network administrator shut down services
- CThe host was not reachable
- DA firewall/IPS blocked the scan
How the community answered
(20 responses)- A5% (1)
- B10% (2)
- D85% (17)
Why each option
Inconsistent Nmap scan results - where some probes succeed and others fail or return filtered - are a hallmark of stateful firewall or IPS rate-limiting and dynamic blocking behavior.
Services not listening would produce consistent closed port results across all scans, not varying or inconsistent output.
An administrator shutting down services would result in consistently closed or unreachable ports, not intermittent or differing results.
An unreachable host would produce uniform host-down or no-response results for all probes, not inconsistent per-port variations.
A stateful firewall or IPS can detect scanning patterns and begin dropping or rate-limiting packets mid-scan, causing some ports to appear open on one run and filtered or closed on another. IPS systems may also dynamically block the source IP after a threshold is reached, leading to partial result sets that vary between scans. This non-deterministic behavior is the defining symptom that distinguishes firewall/IPS interference from other causes.
Concept tested: Firewall and IPS interference with Nmap scanning
Source: https://nmap.org/book/firewalls.html
Topics
Community Discussion
No community discussion yet for this question.