Which of the following descriptions of SYN scanning attacks are correct? (Multiple choice)

Question

Options

• AWhen the scanner sends a SYN message, if the peer replies RST, the peer port is closed.
• BWhen the scanner sends a SYN message, if the peer does not reply, the peer host does not exist,
• CWhen the scanner sends a SYN message, if the peer replies SYN
• DWhen the scanner sends a SYN message, if the peer responds with SYN

• A
  71% (15)
• D
  29% (6)

Explanation

SYN scanning (half-open scanning) probes ports by sending a SYN packet - the first step of TCP's three-way handshake - and interpreting the response without completing the connection.

Why A is correct: A RST (Reset) reply from the peer means the target actively rejected the connection because no service is listening on that port - the port is definitively closed.

Why B is correct: No reply typically means the host is unreachable or doesn't exist (or a firewall is silently dropping packets). Either way, the scanner gets no useful open/closed signal from that address.

Why C is correct: A SYN-ACK reply means the target accepted the half-handshake, indicating the port is open and a service is listening. The scanner then sends RST to tear down the connection without fully establishing it (the "half-open" or "stealth" aspect).

Why D is wrong: D appears to be a near-duplicate of C but draws an incorrect conclusion from the SYN-ACK response - likely claiming the port is closed or filtered when in fact SYN-ACK is the definitive signal of an open port.

Memory tip: Think of the three outcomes as traffic lights - RST = Red (closed), No reply = Grey (host absent/filtered), SYN-ACK = Green (open). SYN scanning reads the light without ever fully entering the intersection.

No community discussion yet for this question.