An ethical hacker is performing a network scan to evaluate the security of a company's IT infrastructure. During the scan, he discovers an active host with multiple open ports running various…

A PSH (Push) flag is used to push buffered data to the receiving application during an active data-transfer session, not as a step in port enumeration or connection teardown after confirming a port is open.

Conducting a vulnerability scan is a separate phase of assessment that comes after reconnaissance/port scanning is complete; it is not the immediate next TCP-level action following the three-way handshake in this scanning context.

Scanning another port using SYN, ACK, and RST flags describes a different scanning technique (e.g., ACK scanning) and is a new scan action, not the logical next step for the currently established TCP connection that needs to be closed.

Once the three-way handshake is complete and the connection is established, the ethical hacker's goal was simply to confirm the port is open and responsive - not to interact with the service further. Sending a FIN packet initiates a graceful four-way teardown, while RST immediately resets the connection; either properly closes the TCP session, ensuring the hacker does not leave dangling open connections that could be logged or trigger alerts, and aligns with standard TCP port scanning methodology (e.g., TCP connect scanning).