Certified Ethical Hacker (CEH) Practice Question

A TCP ACK scan (-sA) sends packets with only the ACK flag set, making them appear to belong to an established connection. Because most stateful firewalls create state entries only when they see a SYN flag, an unsolicited ACK often slips through the rule set. If the packet reaches the target, the host replies with RST, showing that the port is unfiltered. If no response arrives, the firewall likely blocked the probe, so the port is marked filtered. Other scans such as SYN half-open (-sS), NULL (-sN), and FIN (-sF) are designed to determine a port's open/closed state on the host, not to map firewall rules, and therefore do not provide the same information about which ports the firewall passes.