N10-009 Network Security Practice Question
A security analyst notices a large number of incoming TCP packets to a server with the FIN, PSH, and URG flags set. This pattern is characteristic of which type of network scan?
⚠ Common exam trap
CompTIA often tests the distinction between Xmas tree, Null, and SYN scans by focusing on the specific flag combinations, so the trap here is confusing the FIN/PSH/URG set (Xmas tree) with a Null scan (no flags) or a SYN scan (only SYN).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Xmas tree scan
An Xmas tree scan sends TCP packets with the FIN, PSH, and URG flags set (the packet 'lights up' like a Christmas tree). This is a stealth scan technique used to probe open or closed ports based on RFC 793 behavior: closed ports should respond with an RST packet, while open ports may ignore the packet (or respond differently depending on the OS). The pattern described—FIN, PSH, and URG all set—is the definitive signature of an Xmas tree scan.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SYN scan
Why it's wrong here
A SYN scan, also known as a half-open scan, primarily involves sending TCP packets with only the SYN (synchronize) flag set to target ports. Its objective is to determine if a port is open by observing a SYN-ACK response, without completing the full TCP three-way handshake. This technique is distinct from the described scenario because it does not involve the FIN, PSH, and URG flags, making it an incorrect identification for the observed traffic.
When this WOULD be correct
A SYN scan would be correct if the question described a scan that sends packets with only the SYN flag set to initiate a TCP handshake and determine open ports based on SYN-ACK responses.
- ✓
Xmas tree scan
Why this is correct
An Xmas tree scan is specifically characterized by setting the FIN (finish), PSH (push), and URG (urgent) flags simultaneously within a TCP packet. When a security analyst observes a high volume of incoming TCP packets with this particular flag combination, it is a definitive indicator of an Xmas tree scan in progress. This method attempts to elicit different responses from open versus closed ports, often bypassing simpler stateful firewalls due to its non-standard flag configuration, making it a stealthy reconnaissance technique.
- ✗
Null scan
Why it's wrong here
A Null scan is characterized by sending TCP packets with absolutely no flags set in the TCP header. This technique aims to exploit the TCP RFC 793 specification, where a closed port should respond with an RST packet, while an open port should send no response. The absence of any flags in a Null scan packet fundamentally differentiates it from the observed traffic, which explicitly contains the FIN, PSH, and URG flags.
When this WOULD be correct
A null scan would be the correct answer for a question describing a scan that sends TCP packets with no flags set (all flags zero), used to probe firewall rules or identify open ports based on RFC 793 behavior.
- ✗
ACK scan
Why it's wrong here
An ACK scan exclusively sends TCP packets with only the ACK (acknowledgment) flag set, typically with a random sequence number. This scanning method is primarily employed to map firewall rules and determine if a firewall is stateful or stateless, rather than directly identifying open ports. Since the observed traffic explicitly includes the FIN, PSH, and URG flags, an ACK scan, which only sets the ACK flag, does not match the described network activity.
When this WOULD be correct
An ACK scan would be correct if the question described a scan that sends packets with only the ACK flag set to map firewall rules, as it can determine whether a port is filtered or unfiltered based on RST responses.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Xmas tree scanCorrect answer▾
Why this is correct
An Xmas tree scan is specifically characterized by setting the FIN (finish), PSH (push), and URG (urgent) flags simultaneously within a TCP packet. When a security analyst observes a high volume of incoming TCP packets with this particular flag combination, it is a definitive indicator of an Xmas tree scan in progress. This method attempts to elicit different responses from open versus closed ports, often bypassing simpler stateful firewalls due to its non-standard flag configuration, making it a stealthy reconnaissance technique.
✗SYN scanWrong answer — click to see why▾
Why this is wrong here
A SYN scan sends packets with only the SYN flag set, not the FIN, PSH, and URG flags. The described pattern of FIN, PSH, and URG flags is characteristic of an Xmas tree scan.
★ When this WOULD be the correct answer
A SYN scan would be correct if the question described a scan that sends packets with only the SYN flag set to initiate a TCP handshake and determine open ports based on SYN-ACK responses.
Why candidates choose this
Candidates often confuse different scan types because SYN scans are very common and well-known, leading them to incorrectly associate any unusual flag pattern with a SYN scan.
✗Null scanWrong answer — click to see why▾
Why this is wrong here
A null scan sends packets with no flags set (all flags off), whereas the question describes packets with FIN, PSH, and URG flags set, which is characteristic of an Xmas tree scan.
★ When this WOULD be the correct answer
A null scan would be the correct answer for a question describing a scan that sends TCP packets with no flags set (all flags zero), used to probe firewall rules or identify open ports based on RFC 793 behavior.
Why candidates choose this
Candidates may confuse null scans with other stealth scans like Xmas tree scans, as both are types of TCP flag scans used to evade detection, but they differ in which flags are set.
✗ACK scanWrong answer — click to see why▾
Why this is wrong here
ACK scan sends packets with only the ACK flag set, not FIN, PSH, and URG. The question describes a scan with multiple flags set, which is characteristic of an Xmas tree scan.
★ When this WOULD be the correct answer
An ACK scan would be correct if the question described a scan that sends packets with only the ACK flag set to map firewall rules, as it can determine whether a port is filtered or unfiltered based on RST responses.
Why candidates choose this
Candidates may confuse ACK scan with other scan types because they know ACK is used in TCP, and the mention of TCP packets might lead them to think of ACK without considering the specific flag combination.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
Key term
TCP
TCP is a connection-oriented transport layer protocol that ensures reliable, ordered, and error-checked delivery of data between applications over IP networks.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.