What is the proper response for a NULL scan if the port is closed?

A NULL scan is a type of TCP stealth scan where no flags are set in the TCP header. It is used to identify open or closed ports based on how the target responds to this unexpected packet.

Behavior:

If the port is closed → Target responds with RST (Reset)

If the port is open → No response (on compliant systems like Unix-based OSes)

From CEH v13 Courseware:

Module 03: Scanning Networks

Topic: TCP Flag Scanning

Subsection: NULL Scan

CEH v13 Study Guide states:

“In a NULL scan, if a target port is closed, the system responds with an RST packet as per RFC 793. If the port is open, it typically does not respond, which allows stealthy enumeration of services.”

Incorrect Options:

A. SYN: Initiated by a SYN scan.

B. ACK: Used in ACK scans.

C/D: Not applicable for NULL scans.

F. No response occurs for open ports, not closed ones.