PT0-002 Reconnaissance and Enumeration Practice Question
Which Nmap scan type sends SYN packets to determine open ports without completing the TCP three-way handshake?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
-sS
The SYN scan (-sS) sends a SYN packet and if a SYN/ACK is received, the port is considered open; it does not complete the handshake, making it stealthier than a full connect scan.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
-sU
Why it's wrong here
The -sU option instructs Nmap to perform a UDP scan, sending datagrams to target ports and inferring status from ICMP port-unreachable responses or silence; it never sends TCP SYN packets, so it cannot directly identify open TCP ports in a SYN scan. UDP scanning is also inherently slower and less reliable than TCP SYN scanning because UDP is connectionless and responses depend on application behavior.
- ✓
-sS
Why this is correct
The -sS option, Nmap's default SYN scan, transmits a raw TCP packet with only the SYN flag set to each port; an open port replies with a SYN/ACK, a closed port with an RST, and a filtered port drops the packet or returns an ICMP unreachable. Because Nmap aborts the handshake immediately upon receiving SYN/ACK, it determines TCP port state without ever completing a full connection, making it fast and relatively unobtrusive.
- ✗
-sT
Why it's wrong here
The -sT option performs a TCP connect scan, invoking the operating system's connect() system call to initiate a normal three-way handshake; if the handshake completes, the port is considered open and Nmap then sends a RST to close the connection. This full handshake is logged by applications and can trigger IDS/IPS alerts, so unlike -sS it is not a half-open SYN scan and is more detectable.
- ✗
-sN
Why it's wrong here
The -sN option sends a TCP packet with no header flags set, creating a NULL scan that exploits RFC 793 behavior: many systems will drop the packet silently for open ports and send an RST for closed ports, making open ports appear as 'open|filtered' in ambiguous cases. This scan type relies on system-specific TCP stack behavior and does not use SYN packets at all, so it cannot perform a half-open SYN handshake to definitively mark a port as open.
Visual reference
Go deeper
Related to this question
Learn chapter
Advanced Nmap: Scripting Engine (NSE)
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
Key term
Nmap
Nmap is a network scanning tool used to discover hosts, services, and operating systems on a computer network.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 777 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.