Next Step After TCP Three-Way Handshake

312-50v13 By islever Editorial Last updated

Scanning Networks

Short answer

B Conduct a vulnerability scan on the open port to identify potential weaknesses.

Question

An ethical hacker is performing a network scan to evaluate the security of a company's IT infrastructure. During the scan, he discovers an active host with multiple open ports running various services. The hacker uses TCP communication flags to establish a connection with the host and starts communicating with it. He sends a SYN packet to a port on the host and receives a SYN/ACK packet back. He then sends an ACK packet for the received SYN/ACK packet, which triggers an open connection. Which of the following actions should the ethical hacker perform next?
  1. Send a PSH packet to inform the receiving application about the buffered data.
  2. Conduct a vulnerability scan on the open port to identify any potential weaknesses. Correct Answer
  3. Scan another port on the same host using the SYN, ACK, and RST flags.
  4. Send a FIN or RST packet to close the connection.

Key Takeaways

The scenario describes the completion of the TCP three-way handshake (SYN, SYN/ACK, ACK); the trap is choosing low-level packet manipulation over the strategic phase of vulnerability analysis.

This question tests the proper sequence of ethical hacking phases, specifically what follows the successful establishment of a TCP connection. The correct next step is to conduct a vulnerability scan on the open port.

Common mistake: Candidates often choose D (Send a FIN or RST packet) because they focus on closing the connection immediately after establishing it, missing the broader context of security assessment.

Expert Analysis

Why the Answer Is Correct

The scenario explicitly states that an ethical hacker is performing a network scan to evaluate security. After successfully completing the TCP three-way handshake to establish a connection, the logical and standard next step in the methodology is to interact with the service running on that port to identify weaknesses. This corresponds to conducting a vulnerability scan (Option B). The community consensus supports this, noting that "At this point, vulnerability scan is the one" as the primary objective.

Why the Other Options Are Wrong

Option A (Send a PSH packet) is incorrect because Push (PSH) is used to force data transmission during an active session, not as a general next step for evaluation. Option C is invalid because scanning another port typically happens before or independently of maintaining a specific connection, and using SYN/ACK/RST flags is not a standard scanning method for new ports. Option D (Send a FIN or RST) would terminate the connection immediately, preventing any further assessment or exploitation, which contradicts the goal of evaluating the infrastructure's security.

Community Comment Notes

The community overwhelmingly agrees with Option B. Users like Dogeo noted that since the connection is established, the "next best step is to conduct a vulnerability scan... to identify weaknesses." Another user, MHafizC, simply stated, "At this point, vulnerability scan is the one," reinforcing that the tactical phase has moved from connectivity to analysis.

Exam Strategy

Always map the current technical action back to the overall phase of the engagement. If you have just gained access or established connectivity, ask yourself: 'What do I want to learn about this system?' rather than just 'How do I manipulate this packet?'.

Frequently Asked Questions

Why not send a FIN packet to close the connection?

Closing the connection terminates the session, preventing the hacker from assessing vulnerabilities or exploiting services on that port.

Is scanning another port the next step?

No, the scenario focuses on the currently established connection. Standard practice is to analyze the active service before moving to other targets.

More 312-50v13 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Dogeo 👍 4 Answered B
    Since the hacker has successfully established a connection with the target host, the next best step is to conduct a vulnerability scan on the open port to identify weaknesses in the system.
  2. MHafizC 👍 3 Answered B
    At this point, vulnerability scan is the one.
  3. marcel9999 👍 3 Answered B
    see previous answers

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Agent-Based vs Network-Based Vulnerability Scanners

S-grade

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

SQL Injection Bypass in Login Forms

S-grade

← Back to 312-50v13 Study Guide