With which of the following flag sets does the Xmas tree scan send a TCP frame to a remote
device? Each correct answer represents a part of the solution. Choose all that apply.

A.
PUSH

B.
RST

C.
FIN

D.
URG

Explanation:

With the URG, PUSH, and FIN flag sets, the Xmas tree scan sends a TCP frame to a remote
device. The Xmas tree scan is called an Xmas tree scan because the alternating bits are turned
on and off in the flags byte (00101001), much like the lights of a Christmas tree. Answer option B
is incorrect. The RST flag is not set when the Xmas tree scan sends a TCP frame to a remote
device.