During an incident, you discover that an attacker exploited SMBv1 to move laterally and deploy ransomware. The ransomware has been contained, but you need to ensure the same attack vector is closed across the entire environment. Which action is most effective in preventing recurrence?

Upgrade all systems to Windows 10 and rely on the default SMB settings.

Block TCP port 445 at the perimeter firewall only.

Install antivirus on all systems and perform a full scan.

Disable SMB1 on all systems using Group Policy and verify with a script that scans for SMB1-enabled systems.

A company detects that a worm exploiting an SMBv1 vulnerability has infected several file servers. The worm spreads by copying itself to open SMB shares. The incident response team needs to contain the spread while maintaining business operations. Which containment strategy is most effective?

Isolate infected systems and block SMB traffic to and from them, while allowing SMB for uninfected systems.

Disable SMBv1 on all servers and workstations immediately.

Block SMB traffic (TCP 445) at the network perimeter and between internal segments.

Apply the latest security patches to all systems and reboot them.

A security team is reviewing a vulnerability scan that flags SMBv1 as enabled on a server. The server is used for file sharing and all clients are Windows 10. Which action should be taken?

Apply the MS17-010 patch and leave SMBv1 enabled.

Block TCP port 445 on the firewall.

Enable SMBv1 signing and encryption.

Disable SMBv1 and verify that clients can still connect using SMB3.

A security analyst is investigating a potential SMBGhost (CVE-2020-0796) exploitation attempt. The IDS alerts on a suspicious SMBv3 compression negotiation packet. The analyst needs to confirm whether the exploit was successful. Which evidence would most strongly indicate successful exploitation?

Multiple SMBv3 negotiation requests from the same source IP to the target server.

An SMBv3 response with a compression algorithm identifier not listed in the original request.

The target server's SMB service crashing and restarting.

A subsequent outbound connection from the targeted server to an external IP on port 443.

A company is setting up a new file server and wants to ensure that SMB traffic is encrypted to protect sensitive data. The environment consists of Windows 10 and Windows Server 2019 systems. Which configuration should be used?

Use IPsec to encrypt all traffic to the file server.

Use a VPN for all clients accessing the file server.

Enable SMB signing instead of encryption to protect data.

Enable SMB encryption on the file server and require it for all connections.

GIAC Certified Incident Handler

Domain 5Objective 2

SMB Security GCIH Practice Questions (Page 8)

Part of the Network and Infrastructure Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 36–40

36expert · hard
During an incident, you discover that an attacker exploited SMBv1 to move laterally and deploy ransomware. The ransomware has been contained, but you need to ensure the same attack vector is closed across the entire environment. Which action is most effective in preventing recurrence?
Select an answer first
37expert · hard
A company detects that a worm exploiting an SMBv1 vulnerability has infected several file servers. The worm spreads by copying itself to open SMB shares. The incident response team needs to contain the spread while maintaining business operations. Which containment strategy is most effective?
Select an answer first
38application · medium
A security team is reviewing a vulnerability scan that flags SMBv1 as enabled on a server. The server is used for file sharing and all clients are Windows 10. Which action should be taken?
Select an answer first
39expert · hard
A security analyst is investigating a potential SMBGhost (CVE-2020-0796) exploitation attempt. The IDS alerts on a suspicious SMBv3 compression negotiation packet. The analyst needs to confirm whether the exploit was successful. Which evidence would most strongly indicate successful exploitation?
Select an answer first
40application · medium
A company is setting up a new file server and wants to ensure that SMB traffic is encrypted to protect sensitive data. The environment consists of Windows 10 and Windows Server 2019 systems. Which configuration should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.