A security analyst reviews a packet capture and identifies the following output as anomalous: Which of the following activities explains the output?

The correct answer is A. Nmap Xmas scan. The flags shown in the packet capture are [FPU] (FIN, PSH, URG), which is characteristic of a Nmap Xmas scan. This type of scan is used for stealth reconnaissance by sending packets with unusual flag combinations to identify open ports based on target responses or lack thereof.

Submitted by emma.c· Mar 6, 2026Security operations

Question

A security analyst reviews a packet capture and identifies the following output as anomalous:

Which of the following activities explains the output?

Exhibit

Options

ANmap Xmas scan
BNikto's web scan
CSocat's proxying traffic using the urgent flag
DAngry IP Scanner output

How the community answered

(29 responses)

A
97% (28)
D
3% (1)

Explanation

The flags shown in the packet capture are [FPU] (FIN, PSH, URG), which is characteristic of a Nmap Xmas scan. This type of scan is used for stealth reconnaissance by sending packets with unusual flag combinations to identify open ports based on target responses or lack thereof.

Topics

#Nmap#Port scanning#Reconnaissance#Packet analysis

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice