A security analyst receives an alert with the following packet capture: Which of the following conclusions should the analyst reach about this incident?

The correct answer is C. An Nmap scan is occurring. The capture shows rapid SYNs to two well‑known ports (80 and 443) from the same source, immediately followed by RSTs from the target - classic behavior of a SYN‑based port scan. Nmap’s default scan (SYN scan) operates exactly this way, probing ports and tearing down connections…

Submitted by ahmad_uae· Mar 6, 2026Security operations

Question

A security analyst receives an alert with the following packet capture:

Which of the following conclusions should the analyst reach about this incident?

Exhibit

Options

AEnCase is enumerating a server.
BA Nessus proxy is manipulating traffic.
CAn Nmap scan is occurring.
DMetasploit is installing on a target.

How the community answered

(55 responses)

A
2% (1)
B
11% (6)
C
82% (45)
D
5% (3)

Explanation

The capture shows rapid SYNs to two well‑known ports (80 and 443) from the same source, immediately followed by RSTs from the target - classic behavior of a SYN‑based port scan. Nmap’s default scan (SYN scan) operates exactly this way, probing ports and tearing down connections if no SYN‑ACK is returned.

Topics

#packet capture#Nmap#network scanning#reconnaissance

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice