A security analyst receives an alert with the following packet capture attached: Which of the following has occurred?

The correct answer is C. An Nmap scan. The packet capture shows a TCP three-way handshake (SYN, SYN-ACK, ACK) followed immediately by a RST, ACK, which is characteristic of Nmap’s TCP connect scan. This scan type completes the handshake to identify open ports, then quickly resets the connection. The absence of data…

Submitted by layla.eg· Mar 6, 2026Security Operations

Question

A security analyst receives an alert with the following packet capture attached:

Which of the following has occurred?

Exhibit

Options

Areconnaissance
BA password stuffing attack
CAn Nmap scan
DAn nc reverse shell

How the community answered

(50 responses)

A
10% (5)
B
4% (2)
C
84% (42)
D
2% (1)

Explanation

The packet capture shows a TCP three-way handshake (SYN, SYN-ACK, ACK) followed immediately by a RST, ACK, which is characteristic of Nmap’s TCP connect scan. This scan type completes the handshake to identify open ports, then quickly resets the connection. The absence of data transfer after the handshake indicates reconnaissance rather than a shell or credential attack.

Topics

#Nmap#network scan#packet analysis#reconnaissance

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice