In a SYN scan, which statement is true regarding the handshake?

• A. The handshake is always completed.
• B. The handshake is never completed.
• C. The handshake uses FIN packets.
• D. The handshake requires UDP.

Answer: (B)

In a SYN scan, the goal is to probe port state without establishing a full TCP connection. You send a SYN to the target port. If the port is open, the host replies with a SYN-ACK, but you don’t complete the handshake; you immediately send a RST to tear down the half-open connection. If the port is closed, the host usually replies with a RST. If the path is filtered, there may be no reply at all. Because the handshake is never completed, the connection isn’t fully established, which is what makes SYN scans stealthier. The TCP handshake uses SYN, SYN-ACK, and ACK; FIN packets relate to terminating connections or other scan types, not to the normal handshake. UDP has no role here, since this technique targets TCP.