Which SMB traffic pattern is commonly associated with an enumeration attack?

A large number of SMB session setup requests to multiple hosts

A single large file transfer between two known hosts

Periodic SMB keep-alive messages

SMB traffic encrypted with SMB3 encryption

A penetration tester is assessing a Windows network that still has SMB1 enabled on several legacy systems. The tester wants to exploit a known SMB1 vulnerability to gain access. Which vulnerability is most likely to be successfully exploited in this environment?

Badlock (CVE-2016-2115), which is a man-in-the-middle vulnerability in SMB2.

SMBGhost (CVE-2020-0796), which exploits a compression bug in SMBv3.

EternalBlue (MS17-010), which exploits a buffer overflow in SMBv1.

MS08-067, which exploits a vulnerability in the Server service.

A network administrator is comparing SMB protocol versions to decide which to enable on a new file server. The server will host sensitive data and must support clients running Windows 8.1 and later. Which SMB version should be enabled to provide the best security and performance?

SMB2.1, because it provides a good balance of compatibility and security.

SMB3.1.1, because it includes encryption and secure dialect negotiation.

SMB2.0, because it is the default for Windows 8.1.

SMB1, because it is the most compatible with older applications.

A security team is hardening SMB authentication in a mixed environment with some legacy applications that require NTLM. The team wants to reduce the risk of pass-the-hash attacks while maintaining compatibility. Which approach is most appropriate?

Disable NTLM entirely and require Kerberos for all SMB connections.

Keep NTLM enabled everywhere but use SMB encryption to protect credentials.

Switch all legacy applications to use FTP instead of SMB.

Use a tiered model where NTLM is allowed only for specific legacy servers, and enforce SMB signing on all connections.

GIAC Certified Incident Handler

Domain 5Objective 2

SMB Security GCIH Practice Questions (Page 1)

Part of the Network and Infrastructure Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 1–5

1foundation · easy
Which SMB version introduced the most significant security improvements, including end-to-end encryption and secure dialect negotiation?
Select an answer first
2foundation · easy
Which SMB traffic pattern is commonly associated with an enumeration attack?
Select an answer first
3expert · hard
A penetration tester is assessing a Windows network that still has SMB1 enabled on several legacy systems. The tester wants to exploit a known SMB1 vulnerability to gain access. Which vulnerability is most likely to be successfully exploited in this environment?
Select an answer first
4application · medium
A network administrator is comparing SMB protocol versions to decide which to enable on a new file server. The server will host sensitive data and must support clients running Windows 8.1 and later. Which SMB version should be enabled to provide the best security and performance?
Select an answer first
5application · medium
A security team is hardening SMB authentication in a mixed environment with some legacy applications that require NTLM. The team wants to reduce the risk of pass-the-hash attacks while maintaining compatibility. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.