Nmap Port States Explained: The Ultimate Security+ and CySA+ Exam Prep Guide

Nmap Port States Explained: 

CompTIA Security+ and CySA+ Exam Prep

If you're studying for CompTIA Security+ (SY0-701) or CompTIA CySA+ (CS0-003), understanding Nmap port states is critical. Nmap is one of the most widely used network scanning tools in cybersecurity, and exam questions frequently require you to interpret scan results, identify attack surfaces, and understand how defenders and attackers use port scanning during reconnaissance, vulnerability assessment, and incident response.

This guide covers every Nmap port state, how Nmap determines them, common exam scenarios, and practical examples that map directly to Security+ and CySA+ objectives.

What Is Nmap?

Nmap (Network Mapper) is an open-source network discovery and security auditing tool used to:

• Discover hosts on a network
• Identify open ports
• Detect services and applications
• Determine operating systems
• Perform vulnerability reconnaissance

Example command:

• nmap 192.168.1.100

Output:

1 PORT STATE SERVICE

2 22/tcp open      ssh

3 80/tcp open      http

4 443/tcp      open      https

The most important field for exam purposes is the STATE column.

Why Port States Matter

A port state tells you how a target system responded to scan attempts.

Understanding port states helps security professionals:

• Identify exposed services
• Verify firewall configurations
• Detect unauthorized listening services
• Investigate suspicious hosts
• Prioritize remediation efforts

For exam questions, port states often help determine:

• Whether a service is reachable
• Whether filtering is occurring
• Whether a host is alive
• Whether firewall rules are functioning properly

The Six Nmap Port States

Nmap defines six major port states:

1. Open

2. Closed

3. Filtered

4. Unfiltered

5. Open|Filtered

6. Closed|Filtered

Let's explore each one.

1. Open

An open port means an application is actively listening and accepting connections.

Example:

PORT STATE SERVICE

80/tcp open       http

What It Means

The host:

• Is online
• Is accepting TCP/UDP traffic
• Has a service bound to the port

Security Implications

Open ports increase attack surface.

For example:

• 21/tcp open ftp

Could indicate:

• Anonymous access
• Weak credentials
• Misconfigured FTP service

2. Closed

A closed port is reachable but no application is listening.

Example:

PORT STATE SERVICE

23/tcp closed telnet

What It Means

The host replied:

• Connection refused

or sent:

• RST packet (Reset)

Security Implications

Closed ports generally indicate:

• Host exists
• Port is accessible
• Service is not running

Exam Scenario

Question:

A scan shows:

1 22 open

2 80 open

3 3389 closed

Interpretation:

• SSH and HTTP are available.
• Remote Desktop is disabled/not listening.

3. Filtered

The scanner cannot determine whether a port is open because packet filtering blocks responses.

Example:

PORT STATE SERVICE

3389/tcp      filtered ms-wbt-server

What Causes This?

Usually:

• Firewalls
• ACLs
• IDS/IPS devices
• Security groups
• Network filtering

Example

Firewall Rule:

• Deny inbound TCP 3389

Nmap Result:

• 3389/tcp filtered

Security Implications

This often indicates:

• Defensive controls exist
• Access restrictions are functioning

Security+ Exam Tip

One of the most common test questions:

Closed vs Filtered

Closed:

• Host responded.

Filtered:

• Host did not respond due to filtering.

4. Unfiltered

An unfiltered port is accessible, but Nmap cannot determine if it is open or closed.

Example:

• 80/tcp unfiltered

When Does This Occur?

Most commonly with:

• nmap -sA

ACK scans.

What It Means

The port is reachable through any firewall.

However:

• Service status remains unknown

Exam Relevance

CySA+ may present ACK scan output and ask what it indicates.

Answer:

1. Firewall is allowing traffic, but

2. service state is undetermined.

5. Open|Filtered

Nmap cannot determine whether the port is open or filtered.

Example:

• 53/udp open|filtered

Common With UDP Scanning

UDP is connectionless:

nmap -sU

If Nmap doesn't receive:

• A response indicating the port is open

• An ICMP error indicating the port is closed

it reports:

• open|filtered

Why This Happens

Many UDP services simply don't respond.

Examples:

• DNS
• SNMP
• NTP

6. Closed|Filtered

Nmap cannot determine whether the port is closed or filtered.

Example:

• 123/udp closed|filtered

Why It Happens

Insufficient information exists to determine:

• Whether a firewall blocked the traffic
• Whether the service is actually closed

Quick Comparison Table

Common Exam Scenarios

Scenario 1

Output:

PORT STATE

443/tcp      open

Question:

What does this indicate?

Answer:

• HTTPS service is accepting connections.

Scenario 2

Output:

• 3389/tcp filtered

Question:

Most likely cause?

Answer:

• Firewall or ACL blocking access.

Scenario 3

Output:

• 53/udp open|filtered

Question:

Why is the result inconclusive?

Answer:

• UDP scans often receive no response.

Scenario 4

Output:

• 25/tcp closed

Question:

What can be determined?

Answer:

• Host is reachable but SMTP is not listening.

CySA+ Incident Response Perspective

As a security analyst, Nmap results can support investigations.

Examples:

Unexpected Open Ports

• 4444/tcp open

Possible indicators:

• Backdoor
• Malware listener
• Unauthorized service

Expected Port Suddenly Closed

• 443/tcp closed

Possible indicators:

• Service outage
• Misconfiguration
• Incident in progress

Unexpected Filtering

• 80/tcp filtered

Possible indicators:

• Firewall change
• IPS action
• Network access issue

Nmap Commands Worth Memorizing

Basic Scan

• nmap 10.0.0.10

SYN Scan

• nmap -sS 10.0.0.10

UDP Scan

• nmap -sU 10.0.0.10

ACK Scan

• nmap -sA 10.0.0.10

Service Detection

• nmap -sV 10.0.0.10

OS Detection

• nmap -O 10.0.0.10

Security+ and CySA+ Exam Memory Trick

Think of port states in terms of doors:

Final Takeaways

For the exam, focus on these key facts:

• Open = Service running and accepting connections
• Closed = Host reachable but service not listening
• Filtered = Firewall or filtering device blocks determination
• Unfiltered = Reachable but state unknown, commonly seen with ACK scans
• Open|Filtered = Most commonly seen in UDP scans
• Closed|Filtered = Nmap lacks enough information to determine state