CEH Practice Question: Malware, Social Engineering and Network Attacks
An analyst observes the following output from Wireshark: a TCP packet with the SYN flag set, followed by a SYN-ACK, then an ACK, and then a RST. The sequence numbers show a pattern: initial seq=100, ack=300, then seq=300, ack=101. What is the MOST likely interpretation?
⚠ Common exam trap
In the EC-CEH exam, candidates often mistake the SYN, SYN-ACK, ACK, RST pattern for a normal connection termination (FIN sequence) or a simple reset, failing to recognize that the sequence number mismatch in the ACK reveals the attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An attacker is performing TCP sequence prediction to hijack the session.
The observed sequence numbers (initial seq=100, ack=300, then seq=300, ack=101) indicate that the ACK packet acknowledges a sequence number that was never sent by the original sender, which is a classic sign of TCP sequence number prediction. An attacker who predicts the next expected sequence number can inject a spoofed packet to hijack the session, and the subsequent RST is often used by the attacker to tear down the legitimate connection or cover their tracks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An attacker is performing TCP sequence prediction to hijack the session.
Why this is correct
Correct. The sequence numbers show successful prediction, and the RST may be used to reset the connection after hijacking.
- ✗
A normal TCP connection establishment followed by an immediate termination.
Why it's wrong here
While a RST after handshake can occur, the sequence number pattern is suspicious.
- ✗
A man-in-the-middle attack using ARP spoofing.
Why it's wrong here
ARP spoofing would not be directly observed as TCP sequence numbers in Wireshark.
- ✗
A TCP SYN flood attack is in progress.
Why it's wrong here
SYN flood involves many SYN packets without completing the handshake.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.