200-901 Network Fundamentals Practice Question
A network engineer is analyzing a packet capture and observes that a host sends a TCP segment with the SYN flag set, then receives a segment with both SYN and ACK flags set, and finally sends a segment with only the ACK flag set. Which TCP mechanism is being demonstrated?
⚠ Common exam trap
Watch out — candidates often confuse the SYN-ACK segment as part of connection termination or as a separate mechanism, when it is actually the second step of the three-way handshake.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TCP three-way handshake
The three segments with SYN, SYN-ACK, and ACK flags are the definitive signature of the TCP three-way handshake. This process synchronizes sequence numbers and establishes a reliable connection before data transfer begins. Other TCP mechanisms such as termination, window scaling, or selective acknowledgment involve different flags or options and occur at different stages.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
TCP window scaling negotiation
Why it's wrong here
Window scaling is negotiated during the handshake using the Window Scale option in the SYN and SYN-ACK segments. While the handshake is occurring, the question asks which mechanism is being demonstrated by the flag sequence itself. The flags alone indicate connection establishment, not specifically window scaling. The scenario does not mention any TCP options.
- ✗
TCP connection termination
Why it's wrong here
TCP connection termination typically involves FIN or RST flags, not SYN. A normal close uses a four-way handshake with FIN and ACK segments. Seeing SYN and SYN-ACK indicates the beginning of a connection, not the end. Therefore, this option does not match the observed flags.
- ✗
TCP selective acknowledgment
Why it's wrong here
Selective acknowledgment (SACK) is an option used during data transfer to acknowledge non-contiguous blocks of data. It does not involve SYN flags. The observed sequence is purely about connection setup, so SACK is not relevant here.
- ✓
TCP three-way handshake
Why this is correct
The sequence of SYN, SYN-ACK, and ACK is the standard TCP three-way handshake used to establish a connection. The first host sends a SYN to initiate, the second host responds with SYN-ACK to acknowledge and synchronize, and the first host completes with an ACK. This ensures both sides are ready to communicate and agree on initial sequence numbers. The capture clearly shows this exact exchange.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 975 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.