Which scan type is used to determine whether a host is protected by some kind of filtering system and uses ACK packets?

Which scan type is used to determine whether a host is protected by some kind of filtering system and uses ACK packets?

• A. -sN
• B. -sX
• C. -sU
• D. -sA

Answer: (D)

The main idea is that this scan type checks how a host’s filtering devices handle TCP packets that carry the ACK flag. By sending ACK packets to many ports and watching the responses (or lack of them), you can infer whether a firewall or filter is in place and how it treats unsolicited ACK traffic. If the device is not filtering, you’ll often see a normal TCP reply like a RST when a port is closed; if filtering is in place, the ACK probes may be dropped or elicit different, non-standard responses, revealing the presence and behavior of the filter. This focus on firewall behavior with ACK traffic is what makes this scan type the best choice for determining whether a host is protected by some kind of filtering system. The other options don’t serve this purpose. Scans that send packets with no flags or a set of flags like Christmas (Xmas) explore how the target responds to unusual flag combinations and help infer port states or detect certain OS behaviors, not specifically the filtering policy. A UDP scan probes UDP services, which is different again and doesn’t address TCP filtering mechanisms.

The main idea is that this scan type checks how a host’s filtering devices handle TCP packets that carry the ACK flag. By sending ACK packets to many ports and watching the responses (or lack of them), you can infer whether a firewall or filter is in place and how it treats unsolicited ACK traffic. If the device is not filtering, you’ll often see a normal TCP reply like a RST when a port is closed; if filtering is in place, the ACK probes may be dropped or elicit different, non-standard responses, revealing the presence and behavior of the filter. This focus on firewall behavior with ACK traffic is what makes this scan type the best choice for determining whether a host is protected by some kind of filtering system.

The other options don’t serve this purpose. Scans that send packets with no flags or a set of flags like Christmas (Xmas) explore how the target responds to unusual flag combinations and help infer port states or detect certain OS behaviors, not specifically the filtering policy. A UDP scan probes UDP services, which is different again and doesn’t address TCP filtering mechanisms.