Which is the normal response from live hosts to the discovery packets sent during a default Nmap sweep?

Nmap's default host discovery sends TCP SYN packets to well-known ports as one of its probe types to determine host availability. A live host receiving a TCP SYN responds with a SYN-ACK as the second step of the standard TCP three-way handshake, signaling that the port is open and the host is online. Nmap interprets this SYN-ACK response as confirmation that the host is active.

A FIN packet initiates graceful TCP connection teardown and is not a standard response to host discovery probe packets.

The SYN packet is the probe that Nmap sends to target hosts - it is the initiating side of the TCP handshake, not the response from discovered hosts.

An ICMP Timestamp request is one of the probes Nmap transmits during host discovery - it is not the response returned by target hosts.