Examkin

Question

Difficulty: EasyCommon Network Attack Types and Vectors

A security technician observes traffic logs indicating an external host is conducting a half-open TCP SYN scan against a gateway firewall. Which of the following statements accurately describe the operational characteristics of a TCP SYN stealth scan? (Select TWO.)

  1. The scanning host sends an initial TCP packet with only the SYN flag enabled to probe a target port.Answer
  2. The scanning host responds with a RST packet after receiving a SYN-ACK from an open port.Answer
  3. C
    The scanning host completes the three-way handshake by returning an ACK packet to establish an application session.
  4. D
    The scanning mechanism relies on connectionless UDP datagrams directed to port 53.

Answer

A TCP SYN stealth scan initiates a connection using a SYN packet and immediately resets the connection with a RST packet upon receiving a SYN-ACK from an open port, preventing a full TCP connection from being logged.
During a SYN stealth scan, the attacker sends a TCP SYN packet to a target port. If the port is open, the target replies with a SYN-ACK packet. Rather than completing the three-way handshake with an ACK, the scanner transmits a RST packet to terminate the session immediately, avoiding standard connection logging on target applications.

Step-by-Step Solution

1
Analyze how a SYN scan initiates contact with a target port.
The scanner sends a single TCP packet with the SYN flag set.
This tests whether the port is listening for incoming TCP connections.
2
Determine how the scanner handles the target's response without completing the connection.
When the target sends a SYN-ACK, the scanner responds with a RST packet.
Aborting the handshake before sending the final ACK keeps the connection half-open and avoids application-level connection logging.

Key Concept

TCP SYN Stealth Scanning
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic