Which Nmap scan works when firewall drops SYN and URG flags?

A local firewall is configured to drop all incoming packets with the TCP SYN or URG flags set. Which of the following Nmap commands should a penetration tester use to scan the ports 22, 53, 80, and 443 on the target machine and get the most reliable results?

nmap -sY 10.4.7.18 -Pn -p 22,53,80,443
nmap -sS 10.4.7.18 -Pn -p 22,53,80,443
nmap -sA 10.4.7.18 -Pn -p 22,53,80,443 Source Reference Answer
nmap -sT 10.4.7.18 -Pn -p 22,53,80,443

Community Votes

62%

38%

62% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam tests your knowledge of TCP flag states and Nmap scan types; the trap is assuming a full connect scan can work when the initial SYN handshake is dropped.

When a firewall drops TCP SYN and URG packets, Nmap's ACK scan (-sA) bypasses the filtering and reveals ports as unfiltered; CompTIA PT0-002 candidates favor -sA over -sT because connect scans still require a blocked SYN.

Selecting -sT (TCP connect scan) is the most common mistake, since -sT performs a full three-way handshake and is blocked by a firewall that drops SYN packets, so it cannot establish a connection.

Community Discussion (5 comments)

Snagggggin 👍 3 Selected: C

I'm going C here. Here's why: A: -sY will use the SCTP protocol and will not give reliable results on the list of TCP ports you are scanning for. B: -sS will obviously not work because it replies on the SYN for its scan. C: -sA while this will not return if the ports are open or not, you will be able to gather information on if the ports are filtered or unfiltered. The question does not explicitly state that you are trying to find if the ports are "open" rather it is asking you which scan will give you the most reliable results. D: -sT is wrong because it still replies on the SYN TCP scan to initiate the full handshake. The firewall will drop all of these packets and you will not get results for these ports.

e21089f 👍 1 Selected: C

A TCP three-way handshake starts with a SYN packet from a client to a server requesting a connection. It would be blocked by the firewall and the three-way handshake would never take place, so option D would not work. An ACK scan is the only one that makes sense given the options.

Alex818119 👍 1 Selected: C

Why -sA (Option C) is Still the Better Choice: Firewall Dropping SYN Packets: The problem statement specifies that the firewall drops all incoming packets with the SYN flag. Even a TCP Connect scan (-sT) relies on SYN to start the handshake, making it likely to fail. Purpose of ACK Scan (-sA): Mapping Filtered vs. Unfiltered Ports: The -sA scan checks if a port is "filtered" (i.e., blocked by the firewall) or "unfiltered" (i.e., no filtering occurs). This scan does not rely on SYN packets, making it reliable in this scenario. The -sA scan is designed for environments with firewalls that block SYN packets, providing insight into how the firewall treats traffic without attempting full connections. TCP Connect Scan Drawbacks: If the firewall is aggressively blocking SYN packets or enforcing strict stateful filtering, the initial SYN packet of -sT will be dropped, rendering the scan ineffective. Even if -sT works, it is noisier and more likely to trigger intrusion detection systems (IDS), as it establishes full TCP connections.

Alex818119 👍 1 Selected: D

According to bing AI it's D: Given that the firewall drops packets with the TCP SYN or URG flags set, using an Nmap command that avoids these flags is essential. The TCP SYN scan (-sS) won't be effective because it relies on SYN packets. The TCP ACK scan (-sA) won't help either since it's mainly used to map out firewall rules. The TCP Stealth scan (-sY) is also not suitable for this scenario. The most appropriate choice would be: D. nmap -sT 10.4.7.18 -Pn -p 22,53,80,443 The -sT option performs a TCP connect scan, which completes the three-way handshake. This method doesn’t use SYN or URG flags directly and is most likely to bypass the firewall's restrictions.

zemijan 👍 2 Selected: D

The correct command in this scenario is: D. nmap -sT 10.4.7.18 -Pn -p 22,53,80,443 Here's the reasoning: The local firewall is configured to drop all incoming packets with the TCP SYN or URG flags set. The -sS option in Nmap performs a TCP SYN scan, which will be blocked by the firewall. The -sY option is for SCTP INIT scans, which is not relevant here. The -sA option performs a TCP ACK scan, which is used to map out firewall rulesets but does not provide information about open ports. The -sT option performs a TCP connect scan, which completes the three-way handshake and is not blocked by the firewall's SYN flag rule. Therefore, option D (nmap -sT 10.4.7.18 -Pn -p 22,53,80,443) will provide the most reliable results for scanning the specified ports on the target machine.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option C, nmap -sA, sends TCP ACK packets with neither SYN nor URG set, so it passes the firewall rule. The target responds with RST for unfiltered ports, allowing Nmap to at least distinguish filtered from unfiltered ports. The top-voted comment correctly notes that -sS is blocked because it uses SYN, while -sY targets SCTP and is irrelevant to TCP port discovery.

Why the Other Options Are Wrong

A (-sY) uses SCTP INIT, not TCP, so it cannot scan TCP ports 22, 53, 80, or 443. B (-sS) sends a SYN packet and will be dropped by the firewall. D (-sT) performs a full TCP connect handshake, which begins with SYN and therefore also fails. Some commenters argue D is reliable because it gives open/closed state, but the firewall rule makes the handshake impossible.

Community Comment Notes

The leading C comment correctly explains that ACK scans are the only option that does not rely on SYN, and that -sA reports filtered/unfiltered rather than open/closed. A smaller group supporting D overlooks that -sT still starts with a SYN packet, so it will time out. The exam likely expects you to prioritize a scan that can get a response through the firewall, even if the result is only unfiltered.

Official Reference

Exam Strategy

When a firewall blocks specific TCP flags, look for a scan type that avoids those flags entirely. For PT0-002, remember that -sA is designed to map firewall rules and can return useful 'unfiltered' state even when SYN scans are dropped.

Related Analysis

← Back to PT0-002 Study Guide