What is the proper response for a NULL scan if the port is closed?

• A. RST
• B. SYN
• C. FIN
• D. No response

Answer: (A)

When a NULL scan is sent, the probe has TCP flags turned off (no flags). In TCP, a closed port responds to unexpected traffic with a reset to abort the connection. So for a closed port, the proper response is a RST. Open ports typically don’t reply to a NULL scan, and filtered ports often drop the packet, resulting in no response. Since the scenario specifies a closed port, the RST response best matches what the TCP state machine would do, making it the correct behavior.