mediumMultiple ChoiceObjective-mapped
PT0-002 A SYN scan sends only a TCP SYN packet. Practice Question
A penetration tester is analyzing a Python script that uses the 'scapy' library to craft custom network packets. The relevant code is: ```python from scapy.all import * packet = IP(dst="192.168.1.1")/TCP(dport=80, flags="S") response = sr1(packet, timeout=2) if response.haslayer(TCP): print(response.getlayer(TCP).flags) ``` What is the primary goal of this script?
⚠ Common exam trap
Test-takers frequently confuse a SYN scan with a full connect scan (Option A) because both involve sending a SYN, but the key difference is that a SYN scan never sends the final ACK, making it stealthier and not a full handshake.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To perform a SYN scan and determine if port 80 is open
The script uses Scapy to craft a TCP SYN packet (flags='S') to port 80 and sends it with sr1(), which waits for a single response. If a TCP layer is present in the reply, it prints the flags. This is the classic behavior of a SYN scan (half-open scan): it sends a SYN and analyzes the response to determine if the port is open (SYN-ACK) or closed (RST), without completing the handshake. Option B correctly identifies this as a SYN scan to check if port 80 is open.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To perform a TCP connect scan by completing the three-way handshake
Why it's wrong here
A TCP connect scan (often called a full-open scan) must complete the three-way handshake by sending the final ACK after receiving a SYN-ACK, which also establishes a connection that the OS records. The script in question only transmits a raw SYN packet and inspects the returning flags; it never sends the concluding ACK, so it does not perform a connect scan. Consequently, while both techniques probe port reachability, this script's behavior is specifically that of a half-open SYN scan, not a full TCP connect scan.
- ✓
To perform a SYN scan and determine if port 80 is open
Why this is correct
This script correctly implements a SYN scan: it crafts a TCP packet with the SYN flag set, sends it to port 80, and then reads the response flags to infer the port's state. If the target replies with a SYN-ACK, the port is open, because the target is willing to begin a handshake; if it replies with an RST, the port is closed or filtered. The script does not send the final ACK, so it never completes the handshake—confirming that it is a half-open SYN scan designed solely to detect open ports such as TCP 80.
- ✗
To send an HTTP GET request and capture the web page
Why it's wrong here
An HTTP GET request operates at the application layer and requires a full TCP connection to be established first, followed by formatting a request line and headers (e.g., "GET / HTTP/1.1") and parsing the resulting response body. The script, however, only sends a raw SYN packet at the transport layer and inspects the TCP flags—it carries no application-layer payload and does not even complete the handshake, so it cannot possibly retrieve a web page. Thus, this answer mischaracterizes the script's purpose and capability.
- ✗
To perform a UDP scan on port 80
Why it's wrong here
A UDP scan (e.g., sending a UDP datagram to a port and looking for an ICMP port-unreachable response or a UDP reply) is fundamentally different from a TCP SYN scan, both in the transport protocol used and in the way open ports are detected. This script explicitly uses TCP with the SYN flag set, as evidenced by the packet construction shown, and it analyzes TCP response flags like SYN-ACK or RST. Since UDP scanning requires UDP packets and does not use SYN flags, this answer is factually inconsistent with the script's behavior.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.