ECSA v10: EC-Council Certified Security Analyst v10Demo

By ECCouncil · Question Mode

QuestionQ148

Network Penetration Testing Methodology – Internal

Karen performed port scans on every machine in her network to identify suspicious ports on the target systems. During a scan of one particular machine, she observed:

  1. Some ports were not acknowledged; that is, the target machine sent no acknowledgment.
  2. Some ports responded with SYN + ACK packets.
  3. Some ports responded with an RST packet.

How should she interpret the ports that did not return an acknowledgment?

  • A She should that those ports as Closed ports
  • B She should that those ports as Open ports
  • C She should that those ports as Stealth ports
  • D She should that those ports as Half Open ports
Explanation

For a TCP SYN scan, a SYN+ACK response indicates an open port, while an RST response indicates a closed port. No response generally indicates that a firewall or filtering device is silently dropping the probe; this is characterized as a stealth port in the available terminology.

Community Discussion

No comments yet. Be the first to start the discussion!