Port scanning can be used as part of a technical assessment to determine network vulnerabilities. The TCP
XMAS scan is used to identify listening ports on the targeted system.
If a scanned port is open, what happens?
A.
The port will ignore the packets.
B.
The port will send an RST.
C.
The port will send an ACK.
D.
The port will send a SYN.
Explanation:
An attacker uses a TCP XMAS scan to determine if ports are closed on the target machine. This scan type is
accomplished by sending TCP segments with the all flags sent in the packet header, generating packets that
are illegal based on RFC 793. The RFC 793 expected behavior is that any TCP segment with an out-of-state
Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be
handled with a RST in response. This behavior should allow an attacker to scan for closed ports by sending
certain types of rule-breaking packets (out of sync or disallowed by the TCB) and detect closed ports via RST
packets.
https://capec.mitre.org/data/definitions/303.html