Certified Ethical Hacker (CEH) Practice Question

In a TCP SYN (half-open) scan, the scanner sends a SYN and looks at the first packet the target returns. If the port is listening, the target responds with SYN/ACK, at which point the scanner normally sends an RST to avoid completing the handshake. If the port is not listening but is reachable, the target answers the SYN with RST/ACK to indicate "connection refused." A filtered port, on the other hand, would return nothing at all or an ICMP unreachable message because the packet was dropped by a firewall or ACL. Because you received an immediate RST containing the ACK flag, you can conclude the host is up, the packet was not filtered, and the service on port 22 is closed. The other options are incorrect: an open SSH service would send SYN/ACK, a filtered port would not send the RST/ACK, and TCP wrappers only deny the connection after it is established, not at the SYN stage.