What Follows a Completed TCP Handshake During Scanning?
An ethical hacker is performing a network scan to evaluate the security of a company's IT infrastructure. During the scan, he discovers an active host with multiple open ports running various services. The hacker uses TCP communication flags to establish a connection with the host and starts communicating with it. He sends a SYN packet to a port on the host and receives a SYN/ACK packet back. He then sends an ACK packet for the received SYN/ACK packet, which triggers an open connection. Which of the following actions should the ethical hacker perform next?
Community Votes
60% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests whether you follow the CEH methodology from port discovery to weakness identification; the common trap is treating the scenario as a 'clean-up/hygiene' question and picking FIN/RST termination instead of advancing the assessment.
This CEH 312-50v12 question tests what an ethical hacker does immediately after completing a TCP three-way handshake (SYN → SYN/ACK → ACK) with an open port during a network scan. The page establishes that the correct next action is a vulnerability scan of the discovered open port (B), not closing the connection or sending transport-layer data flags.
Option D (send a FIN or RST packet to close the connection) is the most common wrong pick, taken by roughly 40% of voters, because learners read 'ethical hacker' and 'do no harm' as a mandate to immediately tear the session down — but terminating an authorized connection gathers no security information and does not complete the evaluation the scan was commissioned for.
Community Discussion (12 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is correct because the SYN → SYN/ACK → ACK exchange completes the TCP three-way handshake, meaning a real service is listening and reachable on that port — the scan has produced a confirmed finding. In the CEH methodology, discovering an open port is only valuable if you then determine whether the service behind it is misconfigured, unpatched, or otherwise weak, which is exactly what a vulnerability scan of that port accomplishes. NIST SP 800-115 frames assessment the same way: discovery and enumeration feed directly into vulnerability analysis, and the reportable risk statement comes from that analysis. A tester who stops at 'port 445 is open' cannot tell the client whether anything is actually exploitable, so the assessment delivers no security value. The question's stated goal — 'evaluate the security of a company's IT infrastructure' — therefore points straight to scanning the open port for weaknesses as the next action.
Why the Other Options Are Wrong
Option A (send a PSH packet) is a transport-layer mechanics detail: PSH merely tells the receiving TCP stack to hand buffered data up to the application, so without an actual payload and a testing purpose it advances nothing in the security evaluation. Option C (scan another port with SYN, ACK, and RST) describes repeating the discovery phase with an unusual flag mix; the hacker is already mid-assessment on a port that answered, and abandoning a confirmed-open service to re-scan the same host is not progress toward identifying weaknesses. Option D (send a FIN or RST to close) is legitimate cleanup, but cleanup is a closing action, not the evaluation step — and closing the connection ends the engagement with no vulnerability data collected. The 'do no harm' reasoning used to defend D confuses termination with ethics: the authorization, not the RST packet, is what makes the activity ethical, and analysis of an authorized session is not harm.
Community Comment Notes
The vote split was 60 for B against 40 for D, so the community itself is genuinely divided. MustafaDDD questioned the D camp directly with "why would the hacker close the session?", noting the question's framing is a security evaluation, and KalingaDev added that choosing D would only make sense "if this operation is being conducted illegally." On the other side, GK2205 argued the scope is a network scan and "as a CEH your job is to do no harm and not to compromise," while kevin403 stressed that the role described "didn't mention anything about scanning for vuln nor having permission to do so." Those objections raise a fair scoping point, but the question explicitly states the purpose is to evaluate the security of the infrastructure, which authorizes and requires identifying weaknesses on the port the hacker just confirmed as live.
Official Reference
Exam Strategy
Anchor yourself in the CEH phase ladder — footprinting, scanning, enumeration, vulnerability analysis — and read 'what should the hacker do next' as 'which phase comes next,' not 'what is the politest packet to send.' Whenever a choice pits gathering assessment evidence against cleanup or transport trivia, the evidence-gathering option wins in CEH questions.
Frequently Asked Questions
Why isn't sending a FIN or RST packet to close the connection the right next step?
Closing the session is legitimate cleanup, but it ends the engagement without producing any risk data. Since the scan exists to evaluate security, the assessment must first analyze the confirmed-open service.
Why is sending a PSH packet wrong after the three-way handshake completes?
PSH only instructs the receiving TCP stack to deliver buffered data to the application layer. It is a data-transfer mechanism, not a security-testing action, so it does not advance the vulnerability evaluation.