nerdexam
GIAC

GCIH · Question #160

connection. Which of the following scanning techniques will he use to accomplish this task?

The correct answer is C. TCP SYN. TCP SYN scanning sends a SYN packet to initiate a half-open connection probe without completing the three-way handshake, enabling stealthy port discovery.

Reconnaissance, Scanning, and Enumeration

Question

connection. Which of the following scanning techniques will he use to accomplish this task?

Options

  • ATCP FIN
  • BTCP SYN/ACK
  • CTCP SYN
  • DXmas tree

How the community answered

(31 responses)
  • B
    3% (1)
  • C
    94% (29)
  • D
    3% (1)

Why each option

TCP SYN scanning sends a SYN packet to initiate a half-open connection probe without completing the three-way handshake, enabling stealthy port discovery.

ATCP FIN

TCP FIN scanning sends a FIN packet to closed ports expecting a RST response and is used for firewall evasion and OS fingerprinting, not for standard half-open connection probing.

BTCP SYN/ACK

TCP SYN/ACK is a response packet sent by a listening service during the handshake - it is not a technique used to initiate a scan.

CTCP SYNCorrect

TCP SYN scanning works by sending a SYN packet to the target port - an open port responds with SYN/ACK, and the scanner immediately sends a RST to abort the connection before it is fully established. This half-open technique avoids creating a full TCP session, reducing log entries on many systems and making it the most common and effective port scanning method.

DXmas tree

Xmas tree scanning sets the FIN, URG, and PSH flags simultaneously to elicit RFC-defined RST responses from closed ports and is a stealth technique distinct from half-open SYN scanning.

Concept tested: TCP SYN half-open port scanning technique

Source: https://nmap.org/book/synscan.html

Topics

#TCP SYN scan#port scanning#stealth scan#half-open scan

Community Discussion

No community discussion yet for this question.

Full GCIH Practice