FirstTry

Exam objective

CEH

Scanning Networks

This objective sits in Reconnaissance Techniques, which carries 17% of the CEH exam. The questions below are original, written from the official objective title above, and each explanation cites the EC-Council page it rests on.

Objective title verbatim from the official objectives. EC-Council exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

Reconnaissance Techniques

A tester scans a host through a corporate firewall and gets this result.

PORT      STATE     SERVICE22/tcp    open      ssh113/tcp   closed    auth139/tcp   filtered  netbios-ssn

What does the state on 139 report?

Packet filtering stopped probes reaching the portCorrect · your answerCorrect.
The port is reachable with nothing listeningA closed port is reachable and answers, which is what the result on 113 shows.
An application is listening and accepting connectionsThat describes the open state, where the scanner received a positive response from a listening service.
The port answered with a TCP reset packetA reset is the response that produces closed. Here nothing came back at all.

Correct.

Checked against nmap.org, September 2026

Concept

A scanner reports what it observed, not what exists. Silence has two explanations at once, a blocked probe and a blocked answer, and the label for that ambiguity differs from the label used when something replied.

Why A

The filtered state means the probe or its reply never arrived, so the scanner could not decide between open and closed. It usually comes from a firewall, a router rule or host firewall software dropping packets without a response.

Source

…filtered: Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering could be from a dedicated firewall device, router rules, or host-based firewall software.

Nmap, Port Scanning Basics, checked September 2026
#scanning#port-scanning#host-discovery

Now you: practice questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

Reconnaissance Techniques

A security team argues that closed ports in a scan report are harmless and need no follow-up. Which fact weakens that position?

Sample question 2 of 3

Reconnaissance Techniques

A tester must map which ports a client firewall blocks and does not care which services listen behind them. Which scan is built for that?

Sample question 3 of 3

Reconnaissance Techniques

A tester needs a TCP scan that separates open, closed and filtered reliably without completing connections to the target. Which scan fits?

That’s 3 of the full CEH bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Reconnaissance Techniques