GCIH SMB Security — 20 Questions

Question 1

An incident responder discovers that an attacker is relaying SMB authentication traffic from a compromised Windows workstation to a domain controller. Which mitigation technique provides the most robust defense against this specific pass-the-hash and relay attack vector across the entire network domain?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable SMB Signing on all domain controllers and member servers via group policy settings.. Enforcing SMB Signing ensures that all Server Message Block packets are digitally signed, preventing tampering and relay attacks. Implementing this via Group Policy throughout the domain neutralizes NTLM relay attempts. Incident handlers must verify signing policies to secure lateral movement paths.

Answer

Disable NTLMv1 authentication globally and enforce NTLMv2 exclusively across all internal domain controllers.

Answer

Restrict Server Message Block version 1 across legacy file shares and implement strict firewall boundaries.

Answer

Deploy host-based firewall rules to block inbound TCP port 445 traffic on all internal enterprise workstations.

Question 2

A company wants to prevent NTLM relay attacks on their internal network by ensuring that all SMB communication is verified for integrity. Which specific Windows security policy must be set to 'Enabled' on the file servers to force this requirement and drop unverified connections?

Accepted Answer

Microsoft network server: Digitally sign communications (always). SMB signing provides a mechanism to verify the integrity of packets via cryptographic signatures. By setting the policy to require signing, the server refuses to communicate with any client that does not support or has not enabled it. This is a critical defense against Man-in-the-Middle attacks like SMB Relay, where an attacker intercepts a session to execute commands on a target server using a victim's credentials.

Answer

Microsoft network server: Digitally sign communications (if client agrees)

Answer

Microsoft network client: Digitally sign communications (always)

Answer

Network security: LAN Manager authentication level

Question 3

An incident handler is performing reconnaissance on a network segment where an unauthorized device was discovered. Which TWO tools are specifically designed to enumerate SMB shares, user accounts, and password policies from a Linux-based terminal?

Accepted Answer

enum4linux. SMB enumeration is a core step in lateral movement and reconnaissance. Tools like enum4linux and rpcclient allow an analyst to query the SAM database, list shares, and identify user accounts via the SMB and RPC protocols. Understanding these tools helps incident handlers recognize the types of information an attacker can gather during the early stages of a compromise.

Answer

responder

Answer

nikto

Answer

hydra

Question 4

An organization is migrating to SMB 3.1.1 to improve security. They want to ensure that if a Man-in-the-Middle attacker attempts to downgrade the dialect to a less secure version during the handshake, the connection is aborted. Which feature of SMB 3.1.1 provides this specific protection?

Accepted Answer

Pre-Authentication Integrity. SMB 3.1.1 introduced Pre-Authentication Integrity, which uses a cryptographic hash (SHA-512) to protect the negotiation and session setup phases. This prevents 'downgrade attacks' where an interceptor modifies the dialect list to force the client and server into using a weaker, more exploitable version of the protocol. It ensures the integrity of the initial handshake before authentication is even completed.

Answer

SMB Encryption

Answer

Secure Dialect Negotiation

Answer

Opportunistic Locking

Question 5

To fully harden a network against NTLM relay attacks targeting the SMB protocol, which THREE defensive measures should be implemented in conjunction?

Accepted Answer

Enforce SMB Signing on all servers and workstations.. Hardening against SMB Relay requires a multi-layered approach. Enforcing SMB Signing prevents the actual relay from succeeding on the target. Disabling LLMNR and NBT-NS prevents attackers from redirecting victim traffic to their malicious listener. Implementing EPA (Extended Protection for Authentication) binds the authentication to the TLS tunnel, preventing the credential material from being used elsewhere.

Answer

Change the default SMB port from 445 to 4445.

Answer

Enable SMBv1 for legacy compatibility.

Question 6

An incident responder is investigating a Windows file server that has been repeatedly locked out due to failed SMB authentication attempts. The server's security log shows numerous Event ID 4625 entries for a service account, but the account's password was changed two days ago. The responder suspects an attacker is attempting to brute-force the service account. Which of the following is the MOST likely reason the attacker can continue generating failed authentications?

Accepted Answer

The attacker is using a list of common passwords against the service account, and the account lockout policy is not enforced.. The most likely reason for continued failed authentications is that the account lockout policy is not enforced, allowing an attacker to brute-force the service account indefinitely. Even after a password change, the attacker can keep trying common passwords without triggering a lockout, resulting in numerous Event ID 4625 entries. Enforcing lockout thresholds would mitigate this.

Answer

The attacker has compromised a domain controller and is modifying authentication responses to cause failures.

Answer

The service account is configured with a stale password in a scheduled task or service, causing repeated failures.

Answer

The attacker has obtained the service account's password hash and is performing a pass-the-hash attack.

Question 7

A security analyst is investigating an incident where an attacker gained access to a file server via SMB. The server's security log shows a successful logon with logon type 3 from a workstation that belongs to a different department. The workstation's user account is a standard domain user. Which of the following best describes the attacker's technique?

Accepted Answer

Pass-the-Hash using the compromised user's NTLM hash to authenticate to the file server.. The correct answer is pass-the-hash, where the attacker uses the NTLM hash of a standard user to authenticate to the file server via SMB. Logon type 3 indicates a network logon, and the source workstation being the user's own machine suggests the attacker compromised that workstation and extracted the hash. The other techniques either do not match the logon type or would involve different indicators.

Answer

Golden Ticket attack, where the attacker forged a Kerberos ticket granting access to the file server.

Answer

Kerberoasting, where the attacker requested a service ticket for the file server's SPN and cracked it offline.

Answer

SMB relay attack, where the attacker relayed the user's authentication to the file server.

Question 8

During an incident response engagement at a manufacturing firm, a handler runs a packet capture on the internal network and observes a workstation repeatedly sending SMB2 Session Setup requests with NTLMSSP_NEGOTIATE messages containing the flag NTLMSSP_NEGOTIATE_UNICODE but not NTLMSSP_NEGOTIATE_SIGN. The workstation is authenticating to a file server that supports SMB 3.1.1. Which of the following best describes the security implication of this traffic?

Accepted Answer

The session is vulnerable to NTLM relay because signing was not negotiated, allowing an attacker to relay the authentication to another service.. The absence of NTLMSSP_NEGOTIATE_SIGN in the NTLMSSP_NEGOTIATE message means the client is not requesting SMB message signing. Without signing, an attacker on the network can capture the NTLM challenge-response and relay it to another server that accepts NTLM, impersonating the workstation. SMB 3.1.1 support on the server does not prevent this unless signing is required by policy, so the session remains exposed to relay.

Answer

The missing sign flag means the workstation is attempting anonymous authentication to the file server.

Answer

The traffic indicates the workstation is falling back to SMB 1.0, which is why signing flags are absent.

Answer

The workstation is using SMB 3.1.1 pre-authentication integrity, so the missing sign flag is irrelevant.

Question 9

An incident handler is investigating a compromised workstation that is communicating with an external IP address over port 445. The handler suspects the workstation is being used to exfiltrate data via SMB. Which TWO of the following actions should the handler take to confirm and contain the incident? (Choose two.)

Accepted Answer

Run a netstat command on the workstation to identify established connections to the external IP.. To confirm SMB exfiltration, the handler should capture network traffic to inspect SMB commands and file transfers, and run netstat to identify established connections to the external IP. These actions provide evidence without disrupting the environment. Blocking all SMB or disabling the service are containment steps that should follow confirmation.

Answer

Disable the SMB service on the workstation to stop any further exfiltration.

Answer

Immediately block all outbound SMB traffic at the perimeter firewall.

Answer

Check the workstation's SMB client logs for Event ID 5145 to identify accessed files.

Question 10

A security administrator is reviewing Group Policy settings to harden SMB security on a Windows Server 2016 file server. The administrator wants to prevent attackers from downgrading SMB communications to a less secure version. Which of the following settings should the administrator configure?

Accepted Answer

Set the Minimum SMB version to SMB 3.1.1.. Setting the minimum SMB version to SMB 3.1.1 forces the server to reject any attempt to negotiate a lower version, effectively preventing downgrade attacks. This is configured via the 'Set-SmbServerConfiguration -MinSmbVersion' cmdlet or Group Policy. Disabling SMB 1.0 alone is insufficient because older versions like SMB 2.0 could still be used.

Answer

Require SMB encryption for all shares.

Answer

Enable SMB signing on the server.

Answer

Disable SMB 1.0/CIFS File Sharing Support.

Question 11

An incident handler is analyzing SMB traffic and observes a series of SMB2 TREE_CONNECT requests to the IPC$ share, followed by SMB2 IOCTL requests with the control code FSCTL_DFS_GET_REFERRALS. The requests originate from a workstation that is not normally used for administrative tasks. Which activity is most likely being performed?

Accepted Answer

Enumeration of domain trusts and network shares via the IPC$ share.. The correct answer is enumeration of domain trusts and network shares via the IPC$ share. Connecting to IPC$ and issuing FSCTL_DFS_GET_REFERRALS is a common technique for discovering network resources and trust relationships. The other options do not match the observed traffic: PsExec involves different operations, exfiltration uses READ requests, and authentication failures would show error responses.

Answer

Data exfiltration from a file share using SMB2 READ requests.

Answer

Kerberos authentication failure causing fallback to NTLM over SMB.

Answer

Execution of a remote command via SMB using PsExec.

Question 12

An incident handler observes that an internal server is leaking sensitive file system structure via SMB. Which configuration change most effectively prevents SMB null session enumeration?

Accepted Answer

Set RestrictAnonymous to 2. Disabling anonymous access and restricting null sessions is critical for hardening SMB. By configuring the RestrictAnonymous registry key to 2, the operating system denies all anonymous users from enumerating shares, usernames, and groups. This prevents attackers from performing reconnaissance against the server, significantly reducing the attack surface by ensuring that only authenticated users can query sensitive SMB metadata during the initial stages of a lateral movement attempt.

Answer

Set RestrictAnonymous to 0

Answer

Enable SMBv1 protocol support

Answer

Disable the LanmanServer service

Question 13

Which TWO of the following are primary security risks associated with the SMBv1 protocol in a modern Windows environment?

Accepted Answer

Susceptibility to remote code execution via EternalBlue. SMBv1 is an archaic protocol that lacks modern security features, making it a critical target for attackers. Its primary risks include vulnerability to well-known remote code execution exploits like EternalBlue and its susceptibility to man-in-the-middle attacks due to weak or absent integrity checks. Understanding these risks is vital for incident handlers to prioritize the deprecation of legacy protocols, which are often the primary entry points for ransomware and lateral movement.

Answer

Inability to support Kerberos authentication

Answer

Lack of support for SMB message signing

Answer

Incompatibility with NTFS permissions

Question 14

An organization experiences a rapid spread of ransomware across the internal network. Analysts determine that the ransomware is exploiting SMB to move laterally. Which configuration effectively limits this spread by preventing SMB communication between workstations?

Accepted Answer

Implementing Windows Firewall rules to block port 445 between workstations. Disabling SMB traffic between workstations, often referred to as intra-subnet or host-to-host SMB blocking, is a highly effective mitigation strategy against ransomware. By enforcing this via Windows Firewall or Group Policy, you prevent lateral movement, as ransomware frequently uses SMB to copy its own payload to other machines. This strategy adheres to the principle of least privilege, ensuring workstations only talk to servers, not to each other.

Answer

Disabling the Workstation service on all servers

Answer

Increasing the SMB session timeout duration

Answer

Enabling the Print Spooler service on all workstations

Question 15

Which THREE actions are recommended to secure SMB against credential relay and man-in-the-middle attacks?

Accepted Answer

Enforce SMB message signing. Securing SMB requires a layered approach focusing on authentication integrity and protocol restrictions. Enabling SMB signing ensures that packets are not modified in transit, while SMB encryption provides confidentiality. Furthermore, disabling legacy protocols like SMBv1 eliminates the weakest links that are often targeted for relaying. These steps are fundamental for hardening Windows environments against attackers aiming to steal or reuse credentials within the network, significantly hindering lateral movement and privilege escalation attempts.

Answer

Force the use of SMBv1 exclusively

Answer

Use cleartext passwords for SMB shares

Question 16

What is the primary function of SMB (Server Message Block) in a Windows network environment?

Accepted Answer

To enable file, printer, and resource sharing across a network. SMB is the primary network file sharing protocol used in Windows environments, facilitating access to files, printers, and serial ports on remote systems. It acts as a client-server communication protocol, allowing users to interact with shared resources as if they were local. Because it is so widely used for infrastructure services, its security configuration is a primary concern for protecting enterprise data and maintaining system integrity against unauthorized access.

Answer

To provide a secure method for remote desktop management

Answer

To manage directory services and user authentication

Answer

To provide encrypted terminal access to server consoles

Question 17

Which security principle is most directly violated when an organization allows guest access to sensitive SMB file shares?

Accepted Answer

Least privilege. Allowing guest access to SMB shares fundamentally violates the principle of least privilege, which dictates that users should only be granted access to the specific resources required for their role. By enabling guest access, the organization removes authentication requirements, allowing anyone with network access to view or modify sensitive files. This creates a significant security gap, as it bypasses authorization controls and increases the risk of unauthorized data exposure or malicious file modification.

Answer

Defense in depth

Answer

Availability

Answer

Non-repudiation

Question 18

Why is it dangerous to leave port 445 open to the public internet on a Windows server?

Accepted Answer

It increases the attack surface for remote exploitation and credential brute-forcing.. Exposing port 445 to the internet allows any attacker globally to attempt to connect to the server's SMB service. SMB was never designed for internet exposure and contains numerous vulnerabilities that can be exploited remotely. Attackers use this access to perform reconnaissance, brute-force weak credentials, and deploy ransomware by exploiting unpatched vulnerabilities, making it one of the most critical firewall misconfigurations for any organization to avoid.

Answer

It enables legitimate remote file access for all employees.

Answer

It forces the server to use SMBv1, which is faster for internet traffic.

Answer

It prevents the server from using internal authentication protocols.

Question 19

During an incident response, you identify that an attacker is using an SMB relay attack to gain domain-level access. Which mitigation strategy effectively prevents this by forcing authentication through a secure, encrypted channel?

Accepted Answer

Enable SMB message signing. SMB signing is the primary defense against relay attacks. By enforcing SMB signing, the server refuses any connection that does not have a valid cryptographic signature, which prevents attackers from relaying captured authentication tokens. Without this signature, the relay attack fails because the attacker cannot forge the necessary cryptographic proof of identity. This is a fundamental security requirement for all modern domain-joined environments to maintain integrity and thwart lateral movement.

Answer

Enable SMBv1 protocol support

Answer

Disable the Windows Firewall

Answer

Enable guest access on all SMB shares

Question 20

Which of the following describes the purpose of the 'SMB Null Session' vulnerability?

Accepted Answer

To allow unauthenticated users to enumerate system information.. A null session occurs when a client connects to an SMB share without providing valid credentials. In older or misconfigured Windows systems, this allows anonymous users to query the server for sensitive information like user lists, group memberships, and share names. This information is vital for attackers during the reconnaissance phase, as it helps them map the environment and identify potential high-value targets for further exploitation.

Answer

To encrypt traffic between a client and a file server.

Answer

To bypass local firewall restrictions on port 445.

Answer

To prevent unauthorized access to sensitive file shares.