During a penetration test, the tester conducts an ACK scan using NMAP against the external interface of the DMZ firewall. NMAP reports that port 80 is unfiltered. Based on this response, which type of packet inspection is the firewall conducting?

Question

Quizplus · Accepted Answer

An ACK scan determines if ports are filtered or unfiltered by sending ACK packets. If a port is unfiltered, it means the firewall is not performing stateful inspection, which would track the state of connections. Instead, it is conducting stateless packet inspection, which does not track connection states and simply allows or blocks packets based on rules.

During a Penetration Test, the Tester Conducts an ACK Scan