An attacker scans a host with the below command. Which three flags are set? #nmap -sX host.domain.com

An ACK scan is performed with nmap -sA, which sets only the ACK flag; -sX is not an ACK scan.

The Xmas scan correctly identified but the flags are wrong - it sets URG, PUSH, and FIN, not SYN and ACK, which would instead form part of a normal TCP handshake.

The nmap -sX flag performs a TCP Xmas scan, named because the URG, PUSH (PSH), and FIN flags are all set simultaneously, making the packet appear 'lit up' like a Christmas tree. Per RFC 793, a closed port should respond with RST, while an open port drops the packet with no response, allowing port state inference without completing a full TCP handshake.

A SYN scan is performed with nmap -sS, which sets only the SYN flag to initiate a half-open connection; -sX is a completely different scan type.