In which of the following scanning methods does an attacker send SYN packets and then a RST packet?

In a TCP SYN scan, the attacker sends a SYN packet to probe a port; if the port is open, the target replies with SYN-ACK, and the attacker immediately sends a RST to tear down the session before it fully establishes. This SYN-then-RST sequence is the defining behavior of the half-open scan and avoids logging that a full connection would trigger. The technique allows rapid, stealthy port enumeration while staying below the threshold of a complete TCP connection.

XMAS scan sends packets with the FIN, URG, and PSH flags all simultaneously set, not SYN packets, relying on RFC 793 behavior to infer port state from the absence of a RST.

IDLE scan exploits the predictable IP ID counter of a third-party zombie host to infer open ports by spoofing packets from that host, not by directly sending SYN then RST from the attacker.

TCP FIN scan sends only a FIN packet to target ports - it never sends a SYN - and relies on closed ports responding with a RST while open ports silently drop the packet.