CEH Footprinting, Reconnaissance and Scanning Practice Question
Which Nmap flag is used to perform a TCP SYN scan without completing the three-way handshake?
⚠ Common exam trap
Many candidates confuse -sS (SYN scan) with -sT (TCP connect scan), mistakenly thinking that -sT also avoids completing the handshake, when in fact -sT completes the full three-way handshake and is logged by the target system.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
-sS
The -sS flag instructs Nmap to perform a TCP SYN scan, which sends a SYN packet to the target port and, upon receiving a SYN/ACK response, sends an RST packet instead of completing the three-way handshake with an ACK. This allows the scanner to determine port states without establishing a full TCP connection, making it faster and less detectable than a full connect scan.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
-sS
Why this is correct
The -sS flag initiates a TCP SYN scan, often referred to as a "stealth scan" because it does not complete the full TCP three-way handshake. Nmap sends a SYN packet and, if a SYN/ACK is received, it immediately sends an RST packet instead of the final ACK. This technique helps avoid logging on the target system as a full connection is never established, making it less intrusive and harder to detect by some firewalls and intrusion detection systems.
- ✗
-sT
Why it's wrong here
The -sT flag instructs Nmap to perform a TCP Connect scan, which relies on the operating system's `connect()` system call to establish a full TCP three-way handshake with each target port. Unlike stealthier scans, this method completes the connection if the port is open, which is easily logged by the target system and can be detected by network monitoring tools. It's a reliable but noisy scan, often used when raw packet privileges are unavailable.
- ✗
-sU
Why it's wrong here
The -sU flag is used to perform a UDP scan, which targets UDP ports rather than TCP ports. Nmap sends UDP packets to each specified port; if no response is received, the port is often considered open|filtered. If an ICMP Port Unreachable error is returned, the port is considered closed. This scan type is significantly slower and less reliable than TCP scans due to the connectionless nature of UDP and the potential for packet loss or rate limiting.
- ✗
-sA
Why it's wrong here
The -sA flag performs an ACK scan, which sends only an ACK packet to the target ports. This scan type does not determine if a port is open or closed, but rather helps in mapping firewall rules and determining if a stateful firewall is present. If an RST packet is received, the port is considered unfiltered, indicating that a firewall is likely not blocking the ACK. If no response or an ICMP Destination Unreachable is received, the port is considered filtered.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.