200-201 Question 285
Single answerA cybersecurity analyst notices that a specific application is failing to establish a connection with a remote server. Upon inspecting a packet capture, the analyst observes the following sequence: the client sends a SYN packet, the server responds with a SYN-ACK, but the client does not send the final ACK. Which of the following is the most likely reason for this behavior?
- A
The client is experiencing a network outage.
- B
The server's TCP port is closed.
- C
A firewall is blocking the outgoing ACK from the client.
- D
The server did not respond to the SYN packet.
- E
The application is using UDP instead of TCP.
Show answer and explanation
Correct answer: C
Explanation
The observed behavior indicates that the TCP three-way handshake is not completing because the client does not send the final ACK after receiving the SYN-ACK from the server. One possible reason for this is that a firewall is blocking the outgoing ACK from the client, preventing the handshake from being completed. This aligns with the scenario described and the packet capture evidence.
- A. Incorrect.
If the client were experiencing a network outage, it would not have been able to send the initial SYN packet in the first place. This makes this option unlikely.
- B. Incorrect.
If the server's TCP port were closed, it would not have responded to the client's SYN packet with a SYN-ACK. Instead, it would likely have sent a RST packet or not responded at all.
- C. Correct.
A firewall blocking the outgoing ACK from the client could explain why the final step of the TCP three-way handshake is not completed, resulting in the observed behavior.
- D. Incorrect.
If the server did not respond to the SYN packet, the analyst would not have observed the SYN-ACK response in the packet capture. This option does not align with the evidence.
- E. Incorrect.
The application is using TCP, not UDP, as evidenced by the SYN and SYN-ACK packets, which are part of the TCP three-way handshake. This option is incorrect.