hardMultiple ChoiceObjective-mapped
200-201 Practice Question: Given a packet capture showing TCP packets with…
Given a packet capture showing TCP packets with flags: first packet SYN, second packet SYN-ACK, third packet ACK, then a fourth packet with RST flag. What should the analyst suspect?
⚠ Common exam trap
Cisco often tests the distinction between a completed three-way handshake followed by a reset (port scan) versus an incomplete handshake (SYN flood) or sustained data transfer (normal traffic).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port scan
The three-way handshake (SYN, SYN-ACK, ACK) completes a TCP connection, but the immediate RST after the ACK indicates the client terminated the connection without sending any application data. This pattern is characteristic of a port scan (e.g., using nmap's connect scan), where the scanner verifies the port is open by completing the handshake and then immediately resets to avoid leaving the connection half-open.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Port scan
Why this is correct
Correct. The completed handshake followed by RST is characteristic of a connect scan.
- ✗
Normal traffic
Why it's wrong here
Incorrect. Normal traffic would continue with data, not an immediate RST.
- ✗
SYN flood
Why it's wrong here
Incorrect. SYN floods send many SYNs without completing the handshake.
- ✗
Denial of service
Why it's wrong here
Incorrect. DoS attacks typically flood with traffic, not this pattern.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.