Which of the following can be said about the remote server?

An administrator attempts to connect to a remote server by running the following command:

$ nmap 192.168.10.36

Starting Nmap 7.60 ( https://nmap.org ) at 2022-03-29 20:20 UTC

Nmap scan report for www1 (192.168.10.36)

Host is up (0.000091s latency).

Not shown: 979 closed ports

PORT STATE SERVICE

21/tcp open ftp

22/tcp filtered ssh

631/tcp open ipp

Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds

Which of the following can be said about the remote server?
A . A firewall is blocking access to the SSH server.
B . The SSH server is not running on the remote server.
C . The remote SSH server is using SSH protocol version 1.
D . The SSH host key on the remote server has expired.

View Answer

Answer: A

Explanation:

This is because the port 22/tcp is shown as filtered by nmap, which means that nmap cannot determine whether the port is open or closed because a firewall or other device is blocking its probes. If the SSH server was not running on the remote server, the port would be shown as closed, which means that nmap received a TCP RST packet in response to its probe. If the remote SSH server was using SSH protocol version 1, the port would be shown as open, which means that nmap received a TCP SYN/ACK packet in response to its probe. If the SSH host key on the remote server had expired, the port would also be shown as open, but the SSH client would display a warning message about the host key verification failure. Therefore, the best explanation for the filtered state of the port 22/tcp is that a firewall is preventing nmap from reaching the SSH server.

You can find more information about nmap port states and how to interpret them in the following web search results:

Nmap scan what does STATE=filtered mean?

How to find ports marked as filtered by nmap

Technical Tip: NMAP scan shows ports as filtered