During an internal assessment, a penetration tester sends specially crafted TCP packets to a target...

The correct answer is D. XMAS Scan.

An XMAS scan sends TCP packets with multiple flags set, commonly FIN, URG, and PSH. In RFC 793-style behavior, closed ports respond with RST, while open ports often return no response.

CEH scanning material describes inverse TCP flag scanning as sending TCP probes with flags such as FIN, URG, and PSH. It identifies probes with these flags as XMAS scanning and explains that a closed port responds with an RST packet, while open ports may ignore or drop the abnormal packet combination .

Option A. FIN Scan is incorrect because a FIN scan uses only the FIN flag, while the scenario specifies an uncommon combination of multiple TCP control bits.

Option B. UDP Scan is incorrect because the probes are TCP packets, not UDP packets.

Option C. TCP Connect Scan is incorrect because a TCP connect scan completes the normal three-way handshake.

Option D. XMAS Scan is correct because it uses multiple TCP flags and produces the open/closed behavior described.

Therefore, the best answer is D. XMAS Scan.