GIAC Certified Incident Handler
Domain 5Objective 2
SMB Security GCIH Practice Questions (Page 10)
Part of the Network and Infrastructure Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)
49questions here
10free pages
7concepts
Questions 46–49
- 46
A SOC analyst is monitoring SMB traffic and observes a sudden spike in SMB2 TREE_CONNECT requests from a single workstation to multiple file servers, followed by large READ requests. The workstation has no prior history of accessing these servers. What is the most likely explanation?
Select an answer first - 47
Which well-known SMB vulnerability was exploited by the WannaCry ransomware to spread across networks?
Select an answer first - 48
A company is still running Windows 7 on some legacy systems. The security team is concerned about SMBv1 vulnerabilities. Which mitigation is most effective for these systems?
Select an answer first - 49
A company is migrating from a legacy Windows Server 2008 environment to a modern Windows Server 2022 environment. The security team wants to ensure that SMB traffic is protected against eavesdropping and tampering. Which SMB version and configuration should they use?
Select an answer first
Finished these 4 questions?
Review the revealed explanations, or continue through the curriculum.
No more pagesBack to GCIH
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.