Next Step After TCP Three-Way Handshake
An ethical hacker is performing a network scan to evaluate the security of a company's IT infrastructure. During the scan, he discovers an active host with multiple open ports running various services. The hacker uses TCP communication flags to establish a connection with the host and starts communicating with it. He sends a SYN packet to a port on the host and receives a SYN/ACK packet back. He then sends an ACK packet for the received SYN/ACK packet, which triggers an open connection. Which of the following actions should the ethical hacker perform next?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The scenario describes the completion of the TCP three-way handshake (SYN, SYN/ACK, ACK); the trap is choosing low-level packet manipulation over the strategic phase of vulnerability analysis.
This question tests the proper sequence of ethical hacking phases, specifically what follows the successful establishment of a TCP connection. The correct next step is to conduct a vulnerability scan on the open port.
Candidates often choose D (Send a FIN or RST packet) because they focus on closing the connection immediately after establishing it, missing the broader context of security assessment.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The scenario explicitly states that an ethical hacker is performing a network scan to evaluate security. After successfully completing the TCP three-way handshake to establish a connection, the logical and standard next step in the methodology is to interact with the service running on that port to identify weaknesses. This corresponds to conducting a vulnerability scan (Option B). The community consensus supports this, noting that "At this point, vulnerability scan is the one" as the primary objective.Why the Other Options Are Wrong
Option A (Send a PSH packet) is incorrect because Push (PSH) is used to force data transmission during an active session, not as a general next step for evaluation. Option C is invalid because scanning another port typically happens before or independently of maintaining a specific connection, and using SYN/ACK/RST flags is not a standard scanning method for new ports. Option D (Send a FIN or RST) would terminate the connection immediately, preventing any further assessment or exploitation, which contradicts the goal of evaluating the infrastructure's security.Community Comment Notes
The community overwhelmingly agrees with Option B. Users like Dogeo noted that since the connection is established, the "next best step is to conduct a vulnerability scan... to identify weaknesses." Another user, MHafizC, simply stated, "At this point, vulnerability scan is the one," reinforcing that the tactical phase has moved from connectivity to analysis.Exam Strategy
Always map the current technical action back to the overall phase of the engagement. If you have just gained access or established connectivity, ask yourself: 'What do I want to learn about this system?' rather than just 'How do I manipulate this packet?'.
Frequently Asked Questions
Why not send a FIN packet to close the connection?
Closing the connection terminates the session, preventing the hacker from assessing vulnerabilities or exploiting services on that port.
Is scanning another port the next step?
No, the scenario focuses on the currently established connection. Standard practice is to analyze the active service before moving to other targets.