Which of the following best describes the observable behavior indicating a port scan?

• A. Multiple SYNs To Multiple Ports
• B. A Single DNS Query
• C. A Flood Of UDP Packets To DNS
• D. Repeated ARP Requests

Answer: (A)

Port scanning shows up in traffic as probes across many ports to a single target. The clearest indicator is sending TCP SYN packets to a range of different ports on the same host, effectively checking which ports respond and which don’t. That pattern—multiple SYNs aimed at multiple ports—directly maps to the act of discovering open or closed ports.

A single DNS query is just one lookup, not a scan across ports. A flood of UDP packets to DNS targets a DNS service and doesn’t imply scanning multiple ports. Repeated ARP requests relate to resolving MAC addresses on the local network, not testing port states on a remote host.