200-201 Question 278
Single answerAn intrusion detection analyst is reviewing logs from a suspected malicious activity on the network. The analyst observes the following packet details: Source IP: 192.168.1.10, Destination IP: 203.0.113.5, Protocol: TCP, Source Port: 44567, Destination Port: 443, Flags: SYN. Based on intrusion analysis and knowledge of protocol headers, what is the significance of the 'SYN' flag in this context?
- A
It indicates the start of a TCP three-way handshake.
- B
It signifies the termination of a TCP session.
- C
It denotes that the packet is carrying data payload.
- D
It specifies that the packet is an ICMP request.
Show answer and explanation
Correct answer: A
Explanation
The SYN flag is a critical field in the TCP header used to initiate a communication session between two devices. It is the first step in the TCP three-way handshake process, which is fundamental to establishing reliable connections. Recognizing the significance of protocol header fields like SYN is essential for intrusion analysis and identifying patterns of malicious activity, such as reconnaissance or attempted connections to unauthorized services.
- A. Correct.
Correct. The SYN flag in TCP is used to initiate a connection and represents the first step in the three-way handshake process.
- B. Incorrect.
Incorrect. The termination of a TCP session is indicated by the FIN or RST flags, not the SYN flag.
- C. Incorrect.
Incorrect. The SYN flag does not indicate the presence of a data payload; it is only used to initiate a connection during the handshake.
- D. Incorrect.
Incorrect. The SYN flag is specific to the TCP protocol and does not apply to ICMP, which is a different protocol.