SMB Security GCIH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A network analyst is reviewing packet captures from a Windows file server and notices a large number of SMB2 SESSION_SETUP requests from a single workstation to the server over a short period. Each request uses a different username, and the responses include STATUS_LOGON_FAILURE. What is the most likely explanation for this traffic pattern?

   • AThe workstation is infected with malware that is enumerating SMB shares.
   • BA user is legitimately accessing multiple shares with different credentials.
   • CThe server is experiencing a denial-of-service attack due to SMB negotiation requests.
   • DA password-spraying attack is being conducted against the file server.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What type of vulnerability is SMBGhost (CVE-2020-0796)?

   • AAn information disclosure vulnerability in SMB2
   • BA denial-of-service vulnerability in SMBv1
   • CA privilege escalation vulnerability in SMB signing
   • DA remote code execution vulnerability in SMBv3
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What network traffic indicator might suggest an SMB brute-force attack?

   • ASMB traffic occurring only during business hours
   • BSMB traffic using SMB3 encryption
   • CRepeated SMB session setup failures from the same source IP
   • DA single successful SMB session from a new host
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What should be done with SMB port 445 at the network perimeter firewall?

   • AEncrypt SMB traffic using TLS
   • BAllow inbound SMB traffic to all internal hosts
   • CRedirect SMB traffic to a honeypot
   • DBlock inbound SMB traffic from the internet
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization wants to eliminate the use of NTLM authentication for SMB file shares to reduce the risk of credential relay attacks. All clients are Windows 10 and Windows Server 2019 systems joined to an Active Directory domain. Which configuration should be implemented?

   • AEnable SMB encryption for all file shares.
   • BSet the network security policy to 'Send NTLMv2 response only'.
   • CConfigure Kerberos as the default authentication protocol and deny NTLM for SMB.
   • DEnable SMB signing and require it for all connections.
   Reveal Solution Discussion Select an answer first