A company is migrating from a workgroup environment to an Active Directory domain. The security team wants to ensure that SMB authentication is as secure as possible and resistant to relay attacks. Which configuration should be prioritized?

Keep using NTLM but enforce SMB signing on all clients.

Disable NTLM authentication entirely and require all clients to use SMB3 encryption.

Use IPsec to encrypt all SMB traffic between clients and servers.

Enable SMB signing and use Kerberos authentication for all domain-joined clients.

During the eradication phase of an SMB incident, what action is typically taken?

Remove malware and patch the SMB vulnerability

Monitor network traffic for further attacks

What is the first step in responding to an SMB-related security incident?

Contain the incident to prevent further spread

A security administrator is configuring a new Windows Server 2022 file server. The administrator wants to ensure that SMB traffic is protected against both eavesdropping and tampering. Which configuration should be applied?

Disable SMB1 and enable SMB2.0.

Enable SMB encryption and set it to required.

Enable SMB signing and set it to required.

Use NTLM authentication and require SMB signing.

What is the primary purpose of the Server Message Block (SMB) protocol?

To enable file and printer sharing between networked computers

To provide secure remote shell access to Windows servers

To route IP packets between different subnets

To synchronize clocks between network devices

GIAC Certified Incident Handler

Domain 5Objective 2

SMB Security GCIH Practice Questions (Page 6)

Part of the Network and Infrastructure Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 26–30

26application · medium
A company is migrating from a workgroup environment to an Active Directory domain. The security team wants to ensure that SMB authentication is as secure as possible and resistant to relay attacks. Which configuration should be prioritized?
Select an answer first
27foundation · easy
During the eradication phase of an SMB incident, what action is typically taken?
Select an answer first
28foundation · easy
What is the first step in responding to an SMB-related security incident?
Select an answer first
29application · medium
A security administrator is configuring a new Windows Server 2022 file server. The administrator wants to ensure that SMB traffic is protected against both eavesdropping and tampering. Which configuration should be applied?
Select an answer first
30foundation · easy
What is the primary purpose of the Server Message Block (SMB) protocol?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.