What is the proper response for a NULL scan if the port is open?

A SYN response is part of the three-way handshake initiation and is sent by a server only in reply to a SYN packet, not in response to a NULL scan probe.

An ACK response is used to acknowledge received data within an established TCP connection and is not triggered by a NULL scan probe against an open port.

A FIN packet is used to gracefully terminate an existing TCP connection and is not a response generated by an open port receiving an unsolicited NULL scan packet.

PSH is a TCP flag that instructs the receiver to push buffered data to the application layer; it is not a standalone response type generated by port scanning probes.

An RST response is sent by a closed port (not an open one) upon receiving a NULL scan packet, indicating the port is not listening and rejecting the connection attempt.

RFC 793 specifies that when a TCP port is open and receives a packet with no SYN, RST, or ACK flags set - as in a NULL scan - the packet is silently discarded with no reply sent. This lack of response is what an attacker interprets as the port being open or filtered, distinguishing it from a closed port which would reply with a RST/ACK packet.