Which statement describes why a UDP scan can show open|filtered results?

• A. It is extremely fast and always precise.
• B. It may show as open|filtered because many UDP services do not reply and firewalls may drop probes.
• C. Open|filtered means the port is definitely open.
• D. Open|filtered means the port is definitely filtered.

Answer: (B)

UDP scanning relies on whether targets reply to probes, but with UDP there is no connection handshake. Many UDP services simply don’t respond to probes, and many firewalls drop UDP packets rather than replying. When there is no response, the scanner can’t tell if the port is actually open (a service listening) or filtered (blocked by a firewall), so it reports open|filtered. This ambiguity is why the result appears this way. It's not about speed or precision, and open|filtered does not mean the port is definitely open or definitely filtered. If there is a clear ICMP port-unreachable response, the port would be considered closed instead.