ISC2 CC Network Security Practice Question
Which TCP segment is sent to initiate the three-way handshake?
⚠ Common exam trap
The trap is confusing the order of the handshake: candidates may pick SYN-ACK because it contains 'SYN', but the question asks for the segment that initiates the handshake, which is the pure SYN from the client.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SYN
The TCP three-way handshake begins with the client sending a SYN segment to the server to request a connection and synchronize sequence numbers. The server responds with SYN-ACK, and the client completes with ACK. Therefore, the segment that initiates the handshake is SYN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ACK
Why it's wrong here
An ACK segment acknowledges previously received data and cannot open a connection; the handshake begins with a synchronising segment carrying no acknowledgement. ACK is tempting because every later segment in the handshake carries the flag, and it is correct for acknowledging the server's SYN-ACK during the final step.
- ✗
SYN-ACK
Why it's wrong here
A SYN-ACK is the server's reply to the client's initial synchronising segment, so it is the second step, not the initiator. It is tempting because it does carry the SYN flag, and it would be the correct answer if the question asked which segment the server sends in response.
- ✗
FIN
Why it's wrong here
FIN requests graceful closure of an established connection and carries no synchronising flag, so it cannot initiate a handshake. It is tempting because it is a connection-control segment, and it would be correct when describing how an established TCP session is torn down.
- ✓
SYN
Why this is correct
SYN initiates the three-way handshake by carrying the synchronise flag with an initial sequence number, prompting the server to reply with SYN-ACK before the client's ACK completes connection setup. This directly satisfies the stem's requirement for the segment that starts the handshake, distinguishing it from data or teardown segments.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.