(ISC)2 Certified in Cybersecurity Practice Exam

What TCP flag indicates that a packet is requesting a new connection?

1. PSH

2. SYN

3. RST

4. URG

The correct answer is: SYN

The TCP flag that indicates a packet is requesting a new connection is the SYN flag. In the TCP/IP protocol suite, a connection is established using a mechanism known as the three-way handshake, which involves three steps: 1. The client sends a packet with the SYN flag set to the server to initiate a connection. This signifies that the client wants to create a new session. 2. The server responds with a packet that has both the SYN and ACK flags set, indicating acceptance of the connection request and acknowledging the client's request. 3. Finally, the client sends an ACK packet back to the server, completing the handshake, and establishing the connection. The significance of the SYN flag within this process is critical; it clearly communicates the intent to open a session, distinguishing it from other types of TCP packets that might carry different control information or data payloads. In contrast, other flags do not serve the purpose of initiating a new connection. For example, the PSH flag is used to push data to the receiving application, the RST flag resets an existing connection when there is an error or when one side wants to terminate the connection abruptly, and the URG flag indicates that some urgent data is present in the packet. Each of these flags serves specific functions