An incident responder is handling a ransomware outbreak that spread via SMB. The malware has been removed from all systems, but the responder needs to prevent reinfection from dormant malware on backup media. Which step is most critical during the eradication and recovery phase?

Scan all backup media with antivirus and then restore the most recent backups.

Disable SMB entirely on all systems and use FTP for file sharing.

Reimage all systems from the vendor's original installation media and apply all security patches.

Restore data from backups that were taken before the outbreak and verify that SMB1 is disabled on all restored systems.

A security analyst is reviewing SMB logs and sees a successful login from a user account that was recently disabled. The login occurred from a workstation that is not in the user's usual location. Which action should the analyst take first?

Investigate the workstation for signs of compromise.

Disable the user account again.

Block the workstation's IP address.

Which of the following is a recommended best practice to secure SMB?

Allow SMB traffic from the internet

Use NTLM authentication instead of Kerberos

Enable SMB1 for legacy compatibility

GIAC Certified Incident Handler

Domain 5Objective 2

SMB Security GCIH Practice Questions (Page 4)

Part of the Network and Infrastructure Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 16–20

16expert · hard
An incident responder is handling a ransomware outbreak that spread via SMB. The malware has been removed from all systems, but the responder needs to prevent reinfection from dormant malware on backup media. Which step is most critical during the eradication and recovery phase?
Select an answer first
17expert · hard
A security analyst is monitoring SMB traffic and notices a client sending SMB2 TREE_CONNECT requests to multiple servers in quick succession. The client is a known workstation. Which activity is most likely occurring?
Select an answer first
18expert · hard
A security analyst is reviewing SMB logs and sees a successful login from a user account that was recently disabled. The login occurred from a workstation that is not in the user's usual location. Which action should the analyst take first?
Select an answer first
19foundation · easy
Which of the following is a recommended best practice to secure SMB?
Select an answer first
20expert · hard
An analyst is investigating a potential SMB relay attack. The analyst sees SMB traffic where a client authenticates to a server, and then the same authentication is used to connect to another server. Which SMB feature should be enabled to prevent this attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

SMB Security GCIH Practice Questions (Page 4)

Questions 16–20

An incident responder is handling a ransomware outbreak that spread via SMB. The malware has been removed from all systems, but the responder needs to prevent reinfection from dormant malware on backup media. Which step is most critical during the eradication and recovery phase?

A security analyst is monitoring SMB traffic and notices a client sending SMB2 TREE_CONNECT requests to multiple servers in quick succession. The client is a known workstation. Which activity is most likely occurring?

A security analyst is reviewing SMB logs and sees a successful login from a user account that was recently disabled. The login occurred from a workstation that is not in the user's usual location. Which action should the analyst take first?

Which of the following is a recommended best practice to secure SMB?

An analyst is investigating a potential SMB relay attack. The analyst sees SMB traffic where a client authenticates to a server, and then the same authentication is used to connect to another server. Which SMB feature should be enabled to prevent this attack?

Keep studying — Network and Infrastructure Security