A security analyst is examining SMB traffic and sees a client using NTLM authentication instead of Kerberos. The client is domain-joined and the server is in the same domain. Which configuration issue is most likely causing this?

The server is configured to require SMB signing.

The client is using an IP address to connect to the server.

The server is running an older version of Windows.

An incident responder is handling a ransomware outbreak that spread via SMB shares. The malware encrypted files on multiple file servers and workstations. The responder needs to eradicate the malware and recover data. Which sequence of steps is most appropriate?

Disconnect infected systems, patch SMB vulnerabilities, then restore from clean backups.

Restore from backups immediately, then patch SMB vulnerabilities.

Rebuild all systems from scratch, then reconnect to the network.

Run antivirus scans on all systems, then restore from backups.

A security administrator is reviewing a Windows Server 2019 file server that still has SMB1 enabled. The server hosts legacy applications that some users claim require SMB1. The administrator needs to reduce the risk of SMB-related exploits while maintaining maximum compatibility with modern clients. Which action should the administrator take?

Upgrade the server to Windows Server 2022 and leave SMB1 enabled for legacy applications.

Disable SMB1 and enable SMB3 with encryption required for all connections.

Enable SMB1 signing and set the minimum security level to 128-bit encryption.

Keep SMB1 enabled but restrict access to the file server using firewall rules.

During an SMB incident, the response team needs to preserve evidence while minimizing business disruption. The team suspects a worm is spreading via SMB. Which action best balances evidence preservation and containment?

Immediately shut down all affected servers.

Disconnect the entire network from the internet.

Run antivirus scans on all systems.

Capture network traffic and isolate affected systems.

GIAC Certified Incident Handler

Domain 5Objective 2

SMB Security GCIH Practice Questions (Page 2)

Part of the Network and Infrastructure Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 6–10

6application · medium
A security analyst is examining SMB traffic and sees a client using NTLM authentication instead of Kerberos. The client is domain-joined and the server is in the same domain. Which configuration issue is most likely causing this?
Select an answer first
7expert · hard
During an incident, a forensic analyst observes SMB traffic where a client connects to a server, and the server responds with a STATUS_LOGON_FAILURE for a valid domain user. The analyst also sees the client sending an NTLM challenge response that is identical to a previous authentication session. Which attack is most likely occurring?
Select an answer first
8expert · hard
An incident responder is handling a ransomware outbreak that spread via SMB shares. The malware encrypted files on multiple file servers and workstations. The responder needs to eradicate the malware and recover data. Which sequence of steps is most appropriate?
Select an answer first
9application · medium
A security administrator is reviewing a Windows Server 2019 file server that still has SMB1 enabled. The server hosts legacy applications that some users claim require SMB1. The administrator needs to reduce the risk of SMB-related exploits while maintaining maximum compatibility with modern clients. Which action should the administrator take?
Select an answer first
10expert · hard
During an SMB incident, the response team needs to preserve evidence while minimizing business disruption. The team suspects a worm is spreading via SMB. Which action best balances evidence preservation and containment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

SMB Security GCIH Practice Questions (Page 2)

Questions 6–10

A security analyst is examining SMB traffic and sees a client using NTLM authentication instead of Kerberos. The client is domain-joined and the server is in the same domain. Which configuration issue is most likely causing this?

An incident responder is handling a ransomware outbreak that spread via SMB shares. The malware encrypted files on multiple file servers and workstations. The responder needs to eradicate the malware and recover data. Which sequence of steps is most appropriate?

During an SMB incident, the response team needs to preserve evidence while minimizing business disruption. The team suspects a worm is spreading via SMB. Which action best balances evidence preservation and containment?

Keep studying — Network and Infrastructure Security