Quick Answer
The answer is a TCP connect scan, because when a SYN scan receives no response to port 443, it often indicates that a stateless firewall or packet filter is dropping the initial SYN packets. A TCP connect scan bypasses this by completing the full three-way handshake (SYN, SYN-ACK, ACK), which can fool some firewalls into treating the traffic as an established connection rather than a new one, thereby confirming the service is running. On the CompTIA PenTest+ PT0-002 exam, this scenario tests your understanding of how different scan types interact with firewall rules—a common trap is assuming a lack of SYN response means the port is closed, when in fact a TCP connect scan may still succeed. Remember the memory tip: "SYN gets blocked, connect gets connected."
This PT0-002 practice question tests your understanding of information gathering and vulnerability scanning. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A penetration tester is performing a port scan on a target network and receives no response to SYN packets sent to port 443. However, the service is known to be running. Which scanning technique should the tester use next to confirm the service?
SYN scan
Why wrong: SYN scan was already attempted and did not receive a response.
TCP connect scan
Completes the handshake and can bypass firewall rules that drop SYN packets.
UDP scan
Why wrong: UDP scan is not appropriate for a TCP service.
Idle scan
Why wrong: Idle scan is used for stealth, but may still be blocked by the same firewall rules.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
TCP connect scan
Option B (TCP connect scan) is correct because when a SYN scan receives no response to port 443, it may indicate that a firewall or packet filter is dropping the SYN packets. A TCP connect scan completes the full three-way handshake (SYN, SYN-ACK, ACK), which can bypass some stateless firewall rules that only block initial SYN packets but allow established connections. This technique confirms the service by successfully establishing a connection, even if SYN packets are filtered.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
SYN scan
Why it's wrong here
SYN scan was already attempted and did not receive a response.
TCP connect scan
Why this is correct
Completes the handshake and can bypass firewall rules that drop SYN packets.
Related concept
Read the scenario before looking for a memorised answer.
UDP scan
Idle scan
Why it's wrong here
Idle scan is used for stealth, but may still be blocked by the same firewall rules.
Common exam traps
The trap here is that candidates assume a SYN scan is always the best stealth option, but when SYN packets are filtered, completing the TCP handshake (connect scan) can bypass simple stateless firewall rules that drop initial SYN packets.
Detailed technical explanation
Under the hood, some firewalls implement stateless ACLs that drop inbound SYN packets but permit packets with the ACK flag set (as part of an established connection). A TCP connect scan sends a SYN, receives a SYN-ACK if the port is open, and then completes the handshake with an ACK, which can appear as part of an existing session to such firewalls. In real-world scenarios, this technique is often used when a SYN scan is inconclusive due to stateful inspection or rate limiting, but it is more detectable because the full handshake is logged by the target system.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Information Gathering and Vulnerability Scanning — study guide chapter
Learn the concepts, then practise the questions
Information Gathering and Vulnerability Scanning practice questions
Targeted practice on this topic area only
All PT0-002 questions
509 questions across all exam domains
CompTIA PenTest+ PT0-002 study guide
Full concept coverage aligned to exam objectives
PT0-002 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise PT0-002 questions linked to Planning and Scoping.
Practise PT0-002 questions linked to Information Gathering and Vulnerability Scanning.
Practise PT0-002 questions linked to Attacks and Exploits.
Practise PT0-002 questions linked to Reporting and Communication.
Practise PT0-002 questions linked to Tools and Code Analysis.
Practise PT0-002 questions linked to PT0-002 fundamentals.
Practise PT0-002 questions linked to PT0-002 scenario.
Practise PT0-002 questions linked to PT0-002 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Information Gathering and Vulnerability Scanning — This question tests Information Gathering and Vulnerability Scanning — Read the scenario before looking for a memorised answer..
The correct answer is: TCP connect scan — Option B (TCP connect scan) is correct because when a SYN scan receives no response to port 443, it may indicate that a firewall or packet filter is dropping the SYN packets. A TCP connect scan completes the full three-way handshake (SYN, SYN-ACK, ACK), which can bypass some stateless firewall rules that only block initial SYN packets but allow established connections. This technique confirms the service by successfully establishing a connection, even if SYN packets are filtered.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 25, 2026
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.