TCP Maimon Scan Technique Analysis
Short answer
C Sam used the TCP Maimon scan technique by sending FIN/ACK probes and observing RST responses from closed ports.
Question
Key Takeaways
The question tests knowledge of specific TCP flag combinations in port scanning; the trap is confusing FIN/ACK probes with standard ACK scans or Xmas scans.
This page explains the TCP Maimon scan, a stealthy port scanning technique using FIN/ACK probes to detect closed ports via RST responses. It clarifies why this method differs from other TCP flag-based scans like Xmas or NULL scans.
Common mistake: Candidates often select ACK flag probe scan (D) because ACK is present, but fail to recognize that the combination of FIN and ACK specifically defines the Maimon scan behavior where an open port ignores the packet while a closed port sends RST.
Expert Analysis
Why the Answer Is Correct
The correct answer is C, TCP Maimon scan. This technique involves sending a TCP segment with both the FIN and ACK flags set. According to RFC 793, if the target port is closed, it responds with a RST packet. If the port is open, the host typically ignores the FIN flag (since the connection isn't established via SYN), resulting in no response or a timeout. The scenario explicitly states Sam sends FIN/ACK probes and receives RST packets indicating closed ports, which is the defining characteristic of the Maimon scan.
Why the Other Options Are Wrong
Option A, Xmas scan, uses FIN, PSH, and URG flags, not FIN/ACK. Option B, IDLE/IPID header scan, relies on idle zombie hosts and IP identification fields, not direct FIN/ACK probing. Option D, ACK flag probe scan, uses only the ACK flag to map stateful firewall rules, not to determine open/closed status via RST responses in the same manner as the Maimon scan described.
Community Comment Notes
Community consensus strongly supports option C. As user killwitch noted, "FIN/ACK probes followed by RST response follows exactly the Maimon scan definition." Another commenter, marcel9999, highlighted that this technique is similar to NULL and FIN scans but specifically uses the FIN/ACK probe combination. User Dogeo simply confirmed, "In a TCP Maimon scan, the attacker sends a FIN/ACK probe to the target," aligning perfectly with the exam scenario.
Official Reference
https://nmap.org/book/scan-methods-maimon-scan.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
Focus on memorizing the specific flag combinations for each TCP scan type: NULL (none), Xmas (FIN, PSH, URG), Fin (FIN), and Maimon (FIN, ACK). Understanding the expected response (RST vs. No Response) for open vs. closed ports is critical for distinguishing between these stealth scans.
Frequently Asked Questions
What is the difference between Maimon and Xmas scans?
Why does an open port not respond to a Maimon scan?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
Bob00036 👍 3 Answered Chttps://nmap.org/book/scan-methods-maimon-scan.html
-
marcel9999 👍 2 Answered CThis scan technique is very similar to NULL, FIN, and Xmas scan, but the probe used here is FIN/ACK. In most cases, to determine if the port is open or closed, the RST packet should be generated as a response to a probe request.
-
killwitch 👍 2 Answered CC. TCP Maimon scan. Sam sends FIN/ACK probes and gets RST packet in response. FIN/ACK probes followed by RST response follows exactly the Maimon scan definition.
-
Dogeo 👍 2 Answered CIn a TCP Maimon scan, the attacker sends a FIN/ACK probe to the target.
-
pindinga1 👍 2 Answered Cthis response is C , TCP Maimon scan
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.