A Windows administrator is troubleshooting a performance issue on a file server. The server is running SMB1 because of a legacy application. The administrator wants to improve performance and security. Which action is the best first step?

Increase the server's memory and network bandwidth to compensate for SMB1 overhead.

Enable SMB encryption on the SMB1 connection to improve security.

Disable SMB1 and enable SMB2/3, then test the legacy application for compatibility.

Move the legacy application to a different server that uses SMB1 only.

A SOC analyst is reviewing a packet capture and sees an SMB2 NEGOTIATE request with a dialect list that includes SMB 2.0.2, 2.1, 3.0, and 3.1.1. The server responds with SMB 3.1.1. What does this indicate about the client and server?

The client is trying to downgrade the connection to SMB1.

The client is vulnerable to SMBGhost because it supports SMB3.1.1.

The server is forcing the client to use SMB3.1.1 for security reasons.

The client supports multiple SMB versions, and the server selected the highest common version.

A security analyst is investigating a series of failed SMB logon attempts from a single IP address. The attempts use usernames that match the company's employee directory and a small set of common passwords. The analyst suspects a password-spraying attack. Which additional evidence would most strongly confirm this hypothesis?

The logon attempts are spread over several hours with delays between each attempt.

The attempts include both NTLM and Kerberos authentication requests.

The source IP address is a known Tor exit node.

The source IP address is within the company's internal network range.

GIAC Certified Incident Handler

Domain 5Objective 2

SMB Security GCIH Practice Questions (Page 7)

Part of the Network and Infrastructure Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 31–35

31application · medium
A security analyst is reviewing network traffic and sees a large number of SMB2 CREATE requests with malformed headers sent to a Windows server. The server is running an unpatched version of Windows 10. Which vulnerability is the attacker most likely attempting to exploit?
Select an answer first
32application · medium
A company is planning to upgrade its file servers to support the latest SMB features. The security team wants to ensure that the servers support encryption and secure dialect negotiation. Which SMB version should they target?
Select an answer first
33application · medium
A Windows administrator is troubleshooting a performance issue on a file server. The server is running SMB1 because of a legacy application. The administrator wants to improve performance and security. Which action is the best first step?
Select an answer first
34application · medium
A SOC analyst is reviewing a packet capture and sees an SMB2 NEGOTIATE request with a dialect list that includes SMB 2.0.2, 2.1, 3.0, and 3.1.1. The server responds with SMB 3.1.1. What does this indicate about the client and server?
Select an answer first
35application · medium
A security analyst is investigating a series of failed SMB logon attempts from a single IP address. The attempts use usernames that match the company's employee directory and a small set of common passwords. The analyst suspects a password-spraying attack. Which additional evidence would most strongly confirm this hypothesis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

SMB Security GCIH Practice Questions (Page 7)

Questions 31–35

A security analyst is reviewing network traffic and sees a large number of SMB2 CREATE requests with malformed headers sent to a Windows server. The server is running an unpatched version of Windows 10. Which vulnerability is the attacker most likely attempting to exploit?

A company is planning to upgrade its file servers to support the latest SMB features. The security team wants to ensure that the servers support encryption and secure dialect negotiation. Which SMB version should they target?

A Windows administrator is troubleshooting a performance issue on a file server. The server is running SMB1 because of a legacy application. The administrator wants to improve performance and security. Which action is the best first step?

A SOC analyst is reviewing a packet capture and sees an SMB2 NEGOTIATE request with a dialect list that includes SMB 2.0.2, 2.1, 3.0, and 3.1.1. The server responds with SMB 3.1.1. What does this indicate about the client and server?

Keep studying — Network and Infrastructure Security