Why does the scanner send RST after SYN/ACK?

• A. To complete the handshake quickly
• B. To test for firewall rules
• C. To close the connection immediately and reset
• D. To avoid completing the connection and remain stealthy

Answer: (D)

When a TCP scan uses a SYN probe, a response of SYN-ACK indicates the port is open. Rather than completing the three-way handshake by sending the final ACK, the scanner sends a TCP RST to abort the connection. This closes the tentative connection immediately without establishing a full session. The goal is to learn the port state (open or filtered) while keeping the scan stealthy and using fewer resources, since no normal connection is created or logged as an active session.