A network security analyst identifies a scan pattern where a single external source IP sends TCP SYN packets to sequential destination ports on a single host without ever completing the three-way handshake. What type of scan is this?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — d is correct because a TCP SYN scan sends SYN packets and analyzes responses — SYN-ACK for open ports, RST for closed — without completing the three-way handshake, making it faster and less likely to be logged by older systems. A is wrong because a TCP connect scan completes the full three-way handshake on each port.
Full explanation below image
Full Explanation
D is correct because a TCP SYN scan sends SYN packets and analyzes responses — SYN-ACK for open ports, RST for closed — without completing the three-way handshake, making it faster and less likely to be logged by older systems. A is wrong because a TCP connect scan completes the full three-way handshake on each port. B is wrong because UDP scans send UDP datagrams, not TCP SYNs. C is wrong because an XMAS scan sets FIN, PSH, and URG flags simultaneously, not just SYN.