Which statement best describes the final packet in a standard TCP three-way handshake?

• A. SYN
• B. SYN/ACK
• C. ACK
• D. FIN

Answer: (C)

In TCP, a three-way handshake uses three packets to establish a connection and synchronize both sides’ sequence numbers. The first is a SYN from the initiator to start the connection. The second is a SYN-ACK from the receiver to acknowledge the request and offer its own sequence number. The final step is an ACK from the initiator, confirming the server’s sequence number and completing the handshake so data transfer can begin. This final ACK carries no new data and simply marks the connection as established.

A plain SYN is the initial probe to start the connection, not the last step. A SYN-ACK is the server’s response in the middle of the handshake, not the final confirmation. A FIN is used later to gracefully terminate a connection, not to establish it. In Wireshark, you’d typically see three packets with flags in this order: SYN, SYN-ACK, and ACK.