Which scanning technique would be MOST effective in identifying open ports and running services while minimizing detection during recon?

• A. TCP FIN Scan
• B. UDP Ping Scan
• C. XMAS Tree Scan
• D. TCP SYN Scan

Answer: (D)

Understanding stealthy port discovery during recon relies on a method that can reveal open ports with minimal signaling. A TCP SYN scan achieves this by sending just the initial SYN packets and listening for the target’s response. If a port is open, you’ll see a SYN-ACK and then send a reset (RST) to drop the connection before the three-way handshake completes. If a port is closed, you’ll get a reset response; if it’s filtered, there may be no reply. Because the handshake isn’t completed, there’s less traffic and fewer obvious application-layer interactions to log, making it harder for defenses to notice than a full connection attempt. This lets you quickly map which ports are reachable and, once you know those ports, you can perform banner grabbing or version probes to identify what services are running on them.

Other options are less reliable or practical for broad, stealthy discovery. A FIN scan sends a FIN packet to try to provoke a response from open ports, but many systems don’t respond in a consistent way to FIN, and it can be unreliable across different OSes and devices, reducing accuracy for wide port discovery. An XMAS tree scan floods the target with a set of flags (FIN, URG, PSH) and is even more environment-dependent; many devices ignore or misinterpret such packets, so it’s not dependable for identifying open ports across diverse networks. A UDP Ping Scan targets UDP ports, which behave very differently from TCP ports; UDP services often don’t respond predictably to simple probes, and banner/version information is not as readily obtainable, plus UDP scanning can be slow and noisy, making it less efficient for identifying running services during recon.

In short, the TCP SYN scan provides a fast, relatively stealthy way to determine which ports are open and then enables subsequent steps to determine the services running on those ports.