GCIH SMB Security — 10 Questions

Question 1

An incident responder discovers that an attacker is relaying SMB authentication traffic from a compromised Windows workstation to a domain controller. Which mitigation technique provides the most robust defense against this specific pass-the-hash and relay attack vector across the entire network domain?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable SMB Signing on all domain controllers and member servers via group policy settings.. Enforcing SMB Signing ensures that all Server Message Block packets are digitally signed, preventing tampering and relay attacks. Implementing this via Group Policy throughout the domain neutralizes NTLM relay attempts. Incident handlers must verify signing policies to secure lateral movement paths.

Answer

Disable NTLMv1 authentication globally and enforce NTLMv2 exclusively across all internal domain controllers.

Answer

Restrict Server Message Block version 1 across legacy file shares and implement strict firewall boundaries.

Answer

Deploy host-based firewall rules to block inbound TCP port 445 traffic on all internal enterprise workstations.

Question 2

A company wants to prevent NTLM relay attacks on their internal network by ensuring that all SMB communication is verified for integrity. Which specific Windows security policy must be set to 'Enabled' on the file servers to force this requirement and drop unverified connections?

Accepted Answer

Microsoft network server: Digitally sign communications (always). SMB signing provides a mechanism to verify the integrity of packets via cryptographic signatures. By setting the policy to require signing, the server refuses to communicate with any client that does not support or has not enabled it. This is a critical defense against Man-in-the-Middle attacks like SMB Relay, where an attacker intercepts a session to execute commands on a target server using a victim's credentials.

Answer

Microsoft network server: Digitally sign communications (if client agrees)

Answer

Microsoft network client: Digitally sign communications (always)

Answer

Network security: LAN Manager authentication level

Question 3

An incident handler is performing reconnaissance on a network segment where an unauthorized device was discovered. Which TWO tools are specifically designed to enumerate SMB shares, user accounts, and password policies from a Linux-based terminal?

Accepted Answer

enum4linux. SMB enumeration is a core step in lateral movement and reconnaissance. Tools like enum4linux and rpcclient allow an analyst to query the SAM database, list shares, and identify user accounts via the SMB and RPC protocols. Understanding these tools helps incident handlers recognize the types of information an attacker can gather during the early stages of a compromise.

Answer

responder

Answer

nikto

Answer

hydra

Question 4

An organization is migrating to SMB 3.1.1 to improve security. They want to ensure that if a Man-in-the-Middle attacker attempts to downgrade the dialect to a less secure version during the handshake, the connection is aborted. Which feature of SMB 3.1.1 provides this specific protection?

Accepted Answer

Pre-Authentication Integrity. SMB 3.1.1 introduced Pre-Authentication Integrity, which uses a cryptographic hash (SHA-512) to protect the negotiation and session setup phases. This prevents 'downgrade attacks' where an interceptor modifies the dialect list to force the client and server into using a weaker, more exploitable version of the protocol. It ensures the integrity of the initial handshake before authentication is even completed.

Answer

SMB Encryption

Answer

Secure Dialect Negotiation

Answer

Opportunistic Locking

Question 5

To fully harden a network against NTLM relay attacks targeting the SMB protocol, which THREE defensive measures should be implemented in conjunction?

Accepted Answer

Enforce SMB Signing on all servers and workstations.. Hardening against SMB Relay requires a multi-layered approach. Enforcing SMB Signing prevents the actual relay from succeeding on the target. Disabling LLMNR and NBT-NS prevents attackers from redirecting victim traffic to their malicious listener. Implementing EPA (Extended Protection for Authentication) binds the authentication to the TLS tunnel, preventing the credential material from being used elsewhere.

Answer

Change the default SMB port from 445 to 4445.

Answer

Enable SMBv1 for legacy compatibility.

Question 6

An incident responder is investigating a Windows file server that has been repeatedly locked out due to failed SMB authentication attempts. The server's security log shows numerous Event ID 4625 entries for a service account, but the account's password was changed two days ago. The responder suspects an attacker is attempting to brute-force the service account. Which of the following is the MOST likely reason the attacker can continue generating failed authentications?

Accepted Answer

The attacker is using a list of common passwords against the service account, and the account lockout policy is not enforced.. The most likely reason for continued failed authentications is that the account lockout policy is not enforced, allowing an attacker to brute-force the service account indefinitely. Even after a password change, the attacker can keep trying common passwords without triggering a lockout, resulting in numerous Event ID 4625 entries. Enforcing lockout thresholds would mitigate this.

Answer

The attacker has compromised a domain controller and is modifying authentication responses to cause failures.

Answer

The service account is configured with a stale password in a scheduled task or service, causing repeated failures.

Answer

The attacker has obtained the service account's password hash and is performing a pass-the-hash attack.

Question 7

A security analyst is investigating an incident where an attacker gained access to a file server via SMB. The server's security log shows a successful logon with logon type 3 from a workstation that belongs to a different department. The workstation's user account is a standard domain user. Which of the following best describes the attacker's technique?

Accepted Answer

Pass-the-Hash using the compromised user's NTLM hash to authenticate to the file server.. The correct answer is pass-the-hash, where the attacker uses the NTLM hash of a standard user to authenticate to the file server via SMB. Logon type 3 indicates a network logon, and the source workstation being the user's own machine suggests the attacker compromised that workstation and extracted the hash. The other techniques either do not match the logon type or would involve different indicators.

Answer

Golden Ticket attack, where the attacker forged a Kerberos ticket granting access to the file server.

Answer

Kerberoasting, where the attacker requested a service ticket for the file server's SPN and cracked it offline.

Answer

SMB relay attack, where the attacker relayed the user's authentication to the file server.

Question 8

During an incident response engagement at a manufacturing firm, a handler runs a packet capture on the internal network and observes a workstation repeatedly sending SMB2 Session Setup requests with NTLMSSP_NEGOTIATE messages containing the flag NTLMSSP_NEGOTIATE_UNICODE but not NTLMSSP_NEGOTIATE_SIGN. The workstation is authenticating to a file server that supports SMB 3.1.1. Which of the following best describes the security implication of this traffic?

Accepted Answer

The session is vulnerable to NTLM relay because signing was not negotiated, allowing an attacker to relay the authentication to another service.. The absence of NTLMSSP_NEGOTIATE_SIGN in the NTLMSSP_NEGOTIATE message means the client is not requesting SMB message signing. Without signing, an attacker on the network can capture the NTLM challenge-response and relay it to another server that accepts NTLM, impersonating the workstation. SMB 3.1.1 support on the server does not prevent this unless signing is required by policy, so the session remains exposed to relay.

Answer

The missing sign flag means the workstation is attempting anonymous authentication to the file server.

Answer

The traffic indicates the workstation is falling back to SMB 1.0, which is why signing flags are absent.

Answer

The workstation is using SMB 3.1.1 pre-authentication integrity, so the missing sign flag is irrelevant.

Question 9

An incident handler is investigating a compromised workstation that is communicating with an external IP address over port 445. The handler suspects the workstation is being used to exfiltrate data via SMB. Which TWO of the following actions should the handler take to confirm and contain the incident? (Choose two.)

Accepted Answer

Run a netstat command on the workstation to identify established connections to the external IP.. To confirm SMB exfiltration, the handler should capture network traffic to inspect SMB commands and file transfers, and run netstat to identify established connections to the external IP. These actions provide evidence without disrupting the environment. Blocking all SMB or disabling the service are containment steps that should follow confirmation.

Answer

Disable the SMB service on the workstation to stop any further exfiltration.

Answer

Immediately block all outbound SMB traffic at the perimeter firewall.

Answer

Check the workstation's SMB client logs for Event ID 5145 to identify accessed files.

Question 10

A security administrator is reviewing Group Policy settings to harden SMB security on a Windows Server 2016 file server. The administrator wants to prevent attackers from downgrading SMB communications to a less secure version. Which of the following settings should the administrator configure?

Accepted Answer

Set the Minimum SMB version to SMB 3.1.1.. Setting the minimum SMB version to SMB 3.1.1 forces the server to reject any attempt to negotiate a lower version, effectively preventing downgrade attacks. This is configured via the 'Set-SmbServerConfiguration -MinSmbVersion' cmdlet or Group Policy. Disabling SMB 1.0 alone is insufficient because older versions like SMB 2.0 could still be used.

Answer

Require SMB encryption for all shares.

Answer

Enable SMB signing on the server.

Answer

Disable SMB 1.0/CIFS File Sharing Support.