What Follows a Completed TCP Handshake During Scanning?

312-50v12 By islever Editorial Last updated

Scanning Networks Vulnerability Analysis

Short answer

B With the TCP connection established, run a vulnerability scan against the open port to identify weaknesses in the running service.

Question

An ethical hacker is performing a network scan to evaluate the security of a company's IT infrastructure. During the scan, he discovers an active host with multiple open ports running various services. The hacker uses TCP communication flags to establish a connection with the host and starts communicating with it. He sends a SYN packet to a port on the host and receives a SYN/ACK packet back. He then sends an ACK packet for the received SYN/ACK packet, which triggers an open connection. Which of the following actions should the ethical hacker perform next?
  1. Send a PSH packet to inform the receiving application about the buffered data.
  2. Conduct a vulnerability scan on the open port to identify any potential weaknesses. Correct Answer
  3. Scan another port on the same host using the SYN, ACK, and RST flags.
  4. Send a FIN or RST packet to close the connection.

Key Takeaways

The question tests whether you follow the CEH methodology from port discovery to weakness identification; the common trap is treating the scenario as a 'clean-up/hygiene' question and picking FIN/RST termination instead of advancing the assessment.

This CEH 312-50v12 question tests what an ethical hacker does immediately after completing a TCP three-way handshake (SYN → SYN/ACK → ACK) with an open port during a network scan. The page establishes that the correct next action is a vulnerability scan of the discovered open port (B), not closing the connection or sending transport-layer data flags.

Common mistake: Option D (send a FIN or RST packet to close the connection) is the most common wrong pick, taken by roughly 40% of voters, because learners read 'ethical hacker' and 'do no harm' as a mandate to immediately tear the session down — but terminating an authorized connection gathers no security information and does not complete the evaluation the scan was commissioned for.

Expert Analysis

Why the Answer Is Correct

Option B is correct because the SYN → SYN/ACK → ACK exchange completes the TCP three-way handshake, meaning a real service is listening and reachable on that port — the scan has produced a confirmed finding. In the CEH methodology, discovering an open port is only valuable if you then determine whether the service behind it is misconfigured, unpatched, or otherwise weak, which is exactly what a vulnerability scan of that port accomplishes. NIST SP 800-115 frames assessment the same way: discovery and enumeration feed directly into vulnerability analysis, and the reportable risk statement comes from that analysis. A tester who stops at 'port 445 is open' cannot tell the client whether anything is actually exploitable, so the assessment delivers no security value. The question's stated goal — 'evaluate the security of a company's IT infrastructure' — therefore points straight to scanning the open port for weaknesses as the next action.

Why the Other Options Are Wrong

Option A (send a PSH packet) is a transport-layer mechanics detail: PSH merely tells the receiving TCP stack to hand buffered data up to the application, so without an actual payload and a testing purpose it advances nothing in the security evaluation. Option C (scan another port with SYN, ACK, and RST) describes repeating the discovery phase with an unusual flag mix; the hacker is already mid-assessment on a port that answered, and abandoning a confirmed-open service to re-scan the same host is not progress toward identifying weaknesses. Option D (send a FIN or RST to close) is legitimate cleanup, but cleanup is a closing action, not the evaluation step — and closing the connection ends the engagement with no vulnerability data collected. The 'do no harm' reasoning used to defend D confuses termination with ethics: the authorization, not the RST packet, is what makes the activity ethical, and analysis of an authorized session is not harm.

Community Comment Notes

The vote split was 60 for B against 40 for D, so the community itself is genuinely divided. MustafaDDD questioned the D camp directly with "why would the hacker close the session?", noting the question's framing is a security evaluation, and KalingaDev added that choosing D would only make sense "if this operation is being conducted illegally." On the other side, GK2205 argued the scope is a network scan and "as a CEH your job is to do no harm and not to compromise," while kevin403 stressed that the role described "didn't mention anything about scanning for vuln nor having permission to do so." Those objections raise a fair scoping point, but the question explicitly states the purpose is to evaluate the security of the infrastructure, which authorizes and requires identifying weaknesses on the port the hacker just confirmed as live.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Anchor yourself in the CEH phase ladder — footprinting, scanning, enumeration, vulnerability analysis — and read 'what should the hacker do next' as 'which phase comes next,' not 'what is the politest packet to send.' Whenever a choice pits gathering assessment evidence against cleanup or transport trivia, the evidence-gathering option wins in CEH questions.

Frequently Asked Questions

Why isn't sending a FIN or RST packet to close the connection the right next step?

Closing the session is legitimate cleanup, but it ends the engagement without producing any risk data. Since the scan exists to evaluate security, the assessment must first analyze the confirmed-open service.

Why is sending a PSH packet wrong after the three-way handshake completes?

PSH only instructs the receiving TCP stack to deliver buffered data to the application layer. It is a data-transfer mechanism, not a security-testing action, so it does not advance the vulnerability evaluation.

More 312-50v12 FAQ →

Community Votes

B
60%
D
40%

60% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. MustafaDDD 👍 3 Answered B
    I am just thinking, the question says, "An ethical hacker is performing a network scan to evaluate the security of a company's IT infrastructure", why would the hacker close the session?
  2. qwerty100 👍 3 Answered B
    B. Conduct a vulnerability scan on the open port to identify any potential weaknesses.
  3. GK2205 👍 2 Answered D
    Another one that is tricky because of nuance: The Ethical Hacker is performing a network scan and not necessarily a vulnerability scan. Network scans do not travers into vulnerability scans although if required we would do so. The context of the question is key here IMHO. One thing is very clear throughout the program, as a CEH your job is to do no harm and not to compromise. i.e. When you gain access to a sensitive database you are to report on it, not enter and potentially exploit it. Similarly here, your scope is a network scan, not a vulnerability scan. So RST and move on.
  4. insaniunt 👍 2 Answered D
    D, I think The ethical hacker must send a FIN or RST packet to terminate the connection
  5. blehbleh 👍 1 Answered B
    I'm pretty sure this is B as an ethical hacker you need to see if there are any vulnerabilities. You can't just tell them at the end of the pentest that they had open ports but without and validation as to if it is a security concern or not. You would not be doing your job as the pentester. You would just be scanning a network without any knowledge of if anything is vulnerable or not.
Show 6 more comments
  1. kevin403 👍 1 Answered D
    Key sentence “ An ethical hacker is performing a network scan to evaluate the security of a company's IT infrastructure” his role here didn’t mention anything about scanning for vuln nor having permission to do so. Hence he RST and move on. Ethical hacking is all about getting the permission from the owner to do a specific task, in this case. Network scan only
  2. Truth_Seeker 👍 1
    I think the correct answer is D it is a common practice across various network scanning tools to ensure that connections are properly managed and closed. Therefore, the conclusion about closing connections with a FIN or RST packet after a scan is applicable to most network scanners, not just Nmap
  3. KalingaDev 👍 1 Answered B
    Since this is an ethical hacking operation, the hacker should proceed with scanning for vulns. for those who chose 'D', this would be making since if this operation is being conducted illegally.
  4. agelbahri 👍 1 Answered B
    B. Conduct a vulnerability scan on the open port to identify any potential weaknesses
  5. xbsumz 👍 1
    Could someone help me confirm the validity of this ethical hacking technique
  6. azdan 👍 1 Answered D
    Keyword is the ethical hacker perform next.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide