If a target port replies with a SYN/ACK to a SYN probe, what does that imply about the port in the context of a SYN scan?

• A. It is open, and the scanner may send RST to avoid completing the handshake.
• B. It is closed and the scanner will ignore it.
• C. It is filtered by a firewall.
• D. It is in a 'no response' state.

Answer: (A)

In a SYN scan, how the target responds to a SYN probe reveals the port’s state. A SYN/ACK reply means the port is open and listening for connections. It shows the service is willing to complete the TCP handshake, though the scanner often stops short of fully opening the connection by sending a RST to tear down the half-formed handshake. If the port were closed, you’d typically see a RST in response rather than SYN/ACK. If the port were filtered, you’d usually get no reply or some sign of filtering rather than a SYN/ACK. So a SYN/ACK indicates the port is open, with the scanner aiming to avoid establishing a full connection by sending a reset instead.