In which of the following scanning techniques does a scanner connect to an FTP server and request that server to start data transfer to the third system?

In a bounce attack scan, the attacker sends a PORT command to a vulnerable FTP server specifying the target host and a port to probe; the server then attempts the data connection on the attacker's behalf. The attacker infers whether the target port is open or closed based on the response from the FTP server. This technique was historically used to bypass firewall rules and obscure the true source of the scan, and is described in RFC 2577 as a known FTP security issue.

Xmas Tree scanning sets the FIN, URG, and PSH TCP flags simultaneously in a probe packet and does not involve FTP servers.

TCP FIN scanning sends packets with only the FIN flag set directly to target ports to elicit RST responses from closed ports, with no FTP involvement.

TCP SYN (half-open) scanning sends SYN packets and analyzes SYN-ACK or RST responses without completing the handshake, and does not use FTP as an intermediary.