CHFI OS and Network Forensics Practice Question
A network forensics analyst captures traffic and sees a series of TCP SYN packets sent to multiple ports on a target, with no corresponding SYN-ACK replies. What type of activity is MOST likely indicated?
⚠ Common exam trap
A common trap is confusing a SYN scan (reconnaissance) with a SYN flood (DoS attack); the key differentiator is the lack of SYN-ACK replies combined with scanning multiple ports, indicating reconnaissance rather than an attempt to overwhelm the target.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A port scan reconnaissance
The observation of TCP SYN packets sent to multiple ports without any SYN-ACK replies indicates a port scan, specifically a SYN scan (half-open scan). In a SYN scan, the attacker sends a SYN packet to each port; if the port is open, the target responds with a SYN-ACK, but the attacker never completes the handshake. The absence of any SYN-ACK replies suggests that either all scanned ports are closed (RST responses would be expected) or the target is filtering traffic, but the pattern of multiple SYN packets to different ports is the hallmark of reconnaissance, not a denial-of-service attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A denial-of-service (DoS) flood
Why it's wrong here
A DoS flood, such as a SYN flood or UDP amplification attack, is designed to overwhelm a target's resources or saturate its bandwidth with a high volume of packets, rendering the service unavailable. In contrast, the observed traffic shows individual SYN packets sent to multiple distinct ports, which is a low-volume reconnaissance technique rather than a resource-exhaustion attack. The intent and packet rate differ fundamentally: DoS aims for disruption, not service discovery.
- ✓
A port scan reconnaissance
Why this is correct
This pattern is the classic signature of a TCP SYN scan, a common port scanning technique. The attacker sends a SYN packet to each port on a target; if the port is open, the target responds with a SYN-ACK, while closed ports trigger an RST or no reply. Observing multiple SYN packets to different ports without complete handshakes indicates systematic probing to enumerate which services are listening, exactly what a port scan reconnaissance does.
- ✗
A man-in-the-middle attack
Why it's wrong here
A man-in-the-middle attack involves the attacker intercepting and potentially modifying communications between two legitimate parties, usually through ARP spoofing, DNS spoofing, or session hijacking. Traffic captures would show the attacker's MAC address or IP interposed in the data stream, or encrypted sessions being terminated and re-encrypted, not a burst of bare SYN packets to many ports. The traffic signature is about redirecting and relaying ongoing sessions, not probing for open TCP ports.
- ✗
Normal web browsing traffic
Why it's wrong here
Normal web browsing requires a complete TCP three-way handshake for each connection: the client sends a SYN, receives a SYN-ACK, and replies with an ACK, followed by HTTP/HTTPS requests and responses containing data payloads. The capture would show established sessions to port 80 or 443 with inbound and outbound data, not a stream of unsolicited SYNs to multiple different ports. The absence of handshake completion and the spread across ports make this inconsistent with benign web traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.