The answer is a TCP FIN scan, as it is the most effective scan type for evading intrusion detection systems during a stealth reconnaissance phase. This technique sends a packet with only the FIN flag set, which exploits a quirk in the TCP specification: closed ports reply with an RST packet, while open ports silently ignore the FIN, allowing the tester to infer port states without completing a three-way handshake. On the CompTIA PenTest+ PT0-002 exam, this question tests your understanding of how different scan types interact with IDS signatures, which are often tuned to flag common SYN-based scans. A common trap is to confuse FIN scans with Xmas or NULL scans—remember that FIN scans use only one flag, while Xmas scans set multiple flags. For a memory tip, think “FINish the handshake before it starts” to recall that a FIN scan avoids the initial SYN that IDS systems watch for.
PT0-002 Practice Question: Information Gathering and Vulnerability Scanning
This PT0-002 practice question tests your understanding of information gathering and vulnerability scanning. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: a FIN scan sends a TCP packet with only the FIN flag set.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A penetration tester is conducting an internal network scan and wants to minimize the chance of being detected by an intrusion detection system (IDS). Which TCP scan type is most likely to evade detection?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Clue: "minimum / minimize"
Why it matters: Asks for the least resource use — fewest addresses, smallest subnet, lowest overhead. Eliminate over-provisioned options even if they would technically work.
Why wrong: A TCP connect scan completes the full three-way handshake, which is easily logged by IDS and applications. It is the most detectable type of scan.
B
SYN scan
Why wrong: A SYN scan sends SYN packets and analyzes responses. It is semi-stealthy but still commonly detected by IDS because it's the most common scan type.
C
FIN scan
A FIN scan sends only FIN packets. Many systems and IDS do not log these as intrusively, though some modern firewalls may detect them. It is generally considered more stealthy than SYN or connect scans.
D
UDP scan
Why wrong: UDP scans are slower and less reliable, and they use a different protocol. They are not a TCP scan type and are often detected by IDS due to the nature of UDP responses.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FIN scan
A FIN scan sends a TCP packet with only the FIN flag set, which is less likely to trigger IDS signatures that are tuned to detect common SYN-based scans. Many IDS systems monitor for SYN packets as they initiate connections, but a FIN scan exploits the fact that closed ports respond with an RST packet, while open ports ignore the FIN (per RFC 793), allowing the tester to infer port state without completing a full handshake.
Key principle: A FIN scan sends a TCP packet with only the FIN flag set.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
TCP connect scan
Why it's wrong here
A TCP connect scan completes the full three-way handshake, which is easily logged by IDS and applications. It is the most detectable type of scan.
✗
SYN scan
Why it's wrong here
A SYN scan sends SYN packets and analyzes responses. It is semi-stealthy but still commonly detected by IDS because it's the most common scan type.
✓
FIN scan
Why this is correct
A FIN scan sends only FIN packets. Many systems and IDS do not log these as intrusively, though some modern firewalls may detect them. It is generally considered more stealthy than SYN or connect scans.
Clue confirmation
The clue words "most likely", "minimum / minimize" in the question point toward this answer.
Related concept
A FIN scan sends a TCP packet with only the FIN flag set.
✗
UDP scan
Why it's wrong here
UDP scans are slower and less reliable, and they use a different protocol. They are not a TCP scan type and are often detected by IDS due to the nature of UDP responses.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume SYN scans are stealthier because they are 'half-open,' but CompTIA often tests that FIN scans evade IDS better because they avoid the SYN packet that triggers common detection signatures.
Detailed technical explanation
How to think about this question
Under the hood, a FIN scan sends a packet with only the FIN flag; per RFC 793, an open port should silently drop the packet, while a closed port must respond with an RST. This behavior allows the tester to map open ports without completing a connection, but it may fail against systems that implement RFC 1122 (which allows hosts to respond with RST for open ports as well) or modern IDS that detect anomalous flag combinations. In real-world scenarios, FIN scans are often blocked by stateless firewalls that drop packets with invalid flag combinations.
KKey Concepts to Remember
A FIN scan sends a TCP packet with only the FIN flag set.
Open ports typically do not respond to FIN packets, while closed ports send an RST.
FIN scans are often more stealthy than SYN or connect scans against traditional IDS.
RFC 793 defines the expected behavior of TCP flags like FIN.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
A FIN scan sends a TCP packet with only the FIN flag set.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this PT0-002 question in full detail.
Information Gathering and Vulnerability Scanning — This question tests Information Gathering and Vulnerability Scanning — A FIN scan sends a TCP packet with only the FIN flag set..
What is the correct answer to this question?
The correct answer is: FIN scan — A FIN scan sends a TCP packet with only the FIN flag set, which is less likely to trigger IDS signatures that are tuned to detect common SYN-based scans. Many IDS systems monitor for SYN packets as they initiate connections, but a FIN scan exploits the fact that closed ports respond with an RST packet, while open ports ignore the FIN (per RFC 793), allowing the tester to infer port state without completing a full handshake.
What should I do if I get this PT0-002 question wrong?
Review a FIN scan sends a TCP packet with only the FIN flag set., then practise related PT0-002 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "most likely", "minimum / minimize". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
A FIN scan sends a TCP packet with only the FIN flag set.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.