hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is analyzing a Python script…
A penetration tester is analyzing a Python script that imports the 'scapy' library. The script defines a function that sends a series of TCP SYN packets to a target IP and port range, and then waits for SYN-ACK responses. Which attack is the script performing?
⚠ Common exam trap
A common mix-up: candidates confuse a TCP SYN flood (a denial-of-service attack that sends many SYN packets without completing handshakes) with a SYN scan (a reconnaissance technique that sends SYN packets and analyzes responses to identify open ports).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port scanning
The script sends TCP SYN packets to a range of ports and waits for SYN-ACK responses. This is the classic behavior of a SYN scan, a type of port scanning that identifies open ports by observing which ports respond with a SYN-ACK. The use of Scapy to craft and send these packets confirms the script is performing port scanning, not a denial-of-service attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
TCP SYN flood
Why it's wrong here
A TCP SYN flood is a denial-of-service (DoS) attack that attempts to exhaust a target's stateful connection table by sending a high volume of SYN packets without ever completing the handshake with a final ACK. This consumes kernel memory and CPU on the target, eventually preventing legitimate connections, but it does not reveal which ports are open or closed. In contrast, port scanning sends a small number of crafted SYN probes to different ports and analyzes the responses (SYN-ACK vs RST) to enumerate services, making the intent and technique fundamentally distinct.
- ✓
Port scanning
Why this is correct
The script's behavior aligns with a TCP SYN scan (half-open scan), a core port scanning technique that sends a SYN packet to each target port and listens for a SYN-ACK (open) or RST (closed). By never sending the final ACK, the scanner avoids establishing a full connection, reducing its footprint and speed while still identifying listening services. This is a standard reconnaissance method in penetration testing, as it maps the exposed attack surface and reveals which TCP ports warrant further probing or vulnerability analysis.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning (spoofing) is a Layer 2 attack that forges ARP reply packets to associate the attacker's MAC address with a victim's IP address, redirecting local network traffic through the attacker's machine for interception or man-in-the-middle purposes. This technique operates entirely within the local broadcast domain and does not involve TCP SYN packets, port scanning, or any remote enumeration of TCP services. Since the described Python script imports a library to send TCP packets, it is clearly not performing ARP manipulation, which requires raw Ethernet frames and only functions on the same subnet.
- ✗
DNS spoofing
Why it's wrong here
DNS spoofing—also known as DNS cache poisoning—manipulates name resolution by inserting forged DNS records into a resolver's cache, causing clients to connect to wrong IP addresses, typically for phishing or malware distribution. It targets the DNS protocol (UDP/TCP port 53) by corrupting responses, not by sending TCP SYN probes to a range of destination ports to check their state. Thus, it is completely unrelated to port scanning, as DNS spoofing corrupts resolution rather than enumerating which TCP ports are open on a host.
Visual reference
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
Key term
Port scanning
Port scanning is the process of probing a computer or network device to discover which network ports are open, closed, or filtered, revealing potential entry points for services and applications.
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.