For normal TCP packets, which of the following situations may occur in the flag bit?

Question

Options

• ARST and FIN are 1 at the same time
• BFIN and URG are 1 at the same time
• CSYN and ACK are 1 at the same time
• DSYN and RST are 1 at the same time

• A
  4% (1)
• B
  9% (2)
• C
  83% (19)
• D
  4% (1)

Explanation

SYN+ACK is the hallmark of the TCP three-way handshake: when a server responds to a client's initial SYN, it sends a packet with both SYN and ACK set - acknowledging the client's request while also synchronizing its own sequence number. This is completely standard and occurs in every normal TCP connection setup.

Option A (RST+FIN) is wrong because RST means "abort immediately" - it discards the connection state without any graceful teardown, making FIN's polite "I'm done sending" redundant and contradictory. Option B (FIN+URG) is wrong because URG signals that urgent/priority data is in flight, which contradicts FIN's meaning that you've finished sending data. Option D (SYN+RST) is wrong because these flags are opposites - SYN opens a connection and RST tears one down; simultaneous use is logically incoherent and is actually a signature of malicious port scanning (e.g., some Nmap scan types).

Memory tip: Think of the three-way handshake steps - SYN → SYN-ACK → ACK - and remember that the middle step is the only one where two flags legitimately share a packet in normal operation. If a flag combination "opens and closes" at the same time (SYN+RST) or "ends and rushes" at the same time (FIN+URG), it's abnormal.

No community discussion yet for this question.