SMB Security GCIH Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   An organization has experienced an SMB-based ransomware attack. The incident response team has contained the spread and is now in the eradication phase. Which action is most important to prevent re-infection?

   • ARestore all files from backups.
   • BPatch all systems against SMB vulnerabilities.
   • CChange all user passwords.
   • DReimage all affected systems.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following best describes how SMB operates?

   • AIt uses a peer-to-peer model where every node has equal authority
   • BIt uses a client-server model where clients request files and services from servers
   • CIt relies on ICMP to transfer file contents
   • DIt broadcasts all file data to every host on the network
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is a key difference between SMB1 and SMB2?

   • ASMB2 is only used on Linux systems
   • BSMB1 supports encryption, while SMB2 does not
   • CSMB2 is more secure and efficient, with reduced command complexity and better scalability
   • DSMB1 uses TCP port 445, while SMB2 uses UDP port 139
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is a common weakness of NTLM authentication used in SMB?

   • AIt only works with IPv6 networks
   • BIt is susceptible to relay attacks and pass-the-hash attacks
   • CIt requires a public key infrastructure (PKI) to function
   • DIt encrypts all SMB traffic by default
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security analyst is examining a network capture and sees a series of SMB2 WRITE requests to a file share named 'Public' from a workstation that normally does not access that share. The writes are creating files with random names and .exe extensions. What is the most likely activity?

   • AAn attacker is staging malware on the share for distribution.
   • BA user is uploading personal files to the public share.
   • CThe workstation is running a defragmentation tool that writes to the share.
   • DA backup agent is storing temporary files on the share.
   Reveal Solution Discussion Select an answer first