nerdexam
EC-Council

312-50V12 · Question #217

An ethical hacker is scanning a target network. They initiate a TCP connection by sending an SYN packet to a target machine and receiving a SYN/ACK packet in response. But instead of completing the…

The correct answer is A. They are performing an SYN scan to stealthily identify open ports without fully establishing a. The ethical hacker is performing an SYN scan, a stealthy technique to identify open ports without completing the full TCP three-way handshake.

Submitted by olafpl· Mar 4, 2026Reconnaissance Techniques

Question

An ethical hacker is scanning a target network. They initiate a TCP connection by sending an SYN packet to a target machine and receiving a SYN/ACK packet in response. But instead of completing the three-way handshake with an ACK packet, they send an RST packet. What kind of scan is the ethical hacker likely performing and what is their goal?

Options

  • AThey are performing an SYN scan to stealthily identify open ports without fully establishing a
  • BThey are performing a network scan to identify live hosts and their IP addresses.
  • CThey are performing a TCP connect scan to identify open ports on the target machine.
  • DThey are performing a vulnerability scan to identify any weaknesses in the target system.

How the community answered

(25 responses)
  • A
    80% (20)
  • B
    4% (1)
  • C
    12% (3)
  • D
    4% (1)

Why each option

The ethical hacker is performing an SYN scan, a stealthy technique to identify open ports without completing the full TCP three-way handshake.

AThey are performing an SYN scan to stealthily identify open ports without fully establishing aCorrect

The described sequence of sending an SYN packet, receiving an SYN/ACK packet, and then sending an RST packet is characteristic of an SYN scan, also known as a half-open scan. This method is used to stealthily identify open ports on a target system without fully establishing a connection, thereby minimizing the chance of being logged by application-layer firewalls on the target.

BThey are performing a network scan to identify live hosts and their IP addresses.

While an SYN scan can identify live hosts, the specific technique of sending an RST after SYN/ACK is primarily focused on determining the state of individual ports rather than just host liveness.

CThey are performing a TCP connect scan to identify open ports on the target machine.

A TCP connect scan completes the full three-way handshake (SYN, SYN/ACK, ACK), which is contrary to the hacker sending an RST packet instead of an ACK.

DThey are performing a vulnerability scan to identify any weaknesses in the target system.

A vulnerability scan is a broader term encompassing many techniques; this specific method is an SYN scan, which is a type of port scan, not a vulnerability scan itself, though port scanning contributes to vulnerability assessment.

Concept tested: SYN (half-open) port scanning technique.

Source: https://nmap.org/book/man-port-scanning-basics.html

Topics

#SYN scan#port scanning#stealth scanning#network reconnaissance

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice