GCIH SMB Security Practice Test 2 — 15 Questions

Question 1

What is the primary function of SMB (Server Message Block) in a Windows network environment?

Accepted Answer

To enable file, printer, and resource sharing across a network. SMB is the primary network file sharing protocol used in Windows environments, facilitating access to files, printers, and serial ports on remote systems. It acts as a client-server communication protocol, allowing users to interact with shared resources as if they were local. Because it is so widely used for infrastructure services, its security configuration is a primary concern for protecting enterprise data and maintaining system integrity against unauthorized access.

Answer

To provide a secure method for remote desktop management

Answer

To manage directory services and user authentication

Answer

To provide encrypted terminal access to server consoles

Question 2

Which security principle is most directly violated when an organization allows guest access to sensitive SMB file shares?

Accepted Answer

Least privilege. Allowing guest access to SMB shares fundamentally violates the principle of least privilege, which dictates that users should only be granted access to the specific resources required for their role. By enabling guest access, the organization removes authentication requirements, allowing anyone with network access to view or modify sensitive files. This creates a significant security gap, as it bypasses authorization controls and increases the risk of unauthorized data exposure or malicious file modification.

Answer

Defense in depth

Answer

Availability

Answer

Non-repudiation

Question 3

Why is it dangerous to leave port 445 open to the public internet on a Windows server?

Accepted Answer

It increases the attack surface for remote exploitation and credential brute-forcing.. Exposing port 445 to the internet allows any attacker globally to attempt to connect to the server's SMB service. SMB was never designed for internet exposure and contains numerous vulnerabilities that can be exploited remotely. Attackers use this access to perform reconnaissance, brute-force weak credentials, and deploy ransomware by exploiting unpatched vulnerabilities, making it one of the most critical firewall misconfigurations for any organization to avoid.

Answer

It enables legitimate remote file access for all employees.

Answer

It forces the server to use SMBv1, which is faster for internet traffic.

Answer

It prevents the server from using internal authentication protocols.

Question 4

During an incident response, you identify that an attacker is using an SMB relay attack to gain domain-level access. Which mitigation strategy effectively prevents this by forcing authentication through a secure, encrypted channel?

Accepted Answer

Enable SMB message signing. SMB signing is the primary defense against relay attacks. By enforcing SMB signing, the server refuses any connection that does not have a valid cryptographic signature, which prevents attackers from relaying captured authentication tokens. Without this signature, the relay attack fails because the attacker cannot forge the necessary cryptographic proof of identity. This is a fundamental security requirement for all modern domain-joined environments to maintain integrity and thwart lateral movement.

Answer

Enable SMBv1 protocol support

Answer

Disable the Windows Firewall

Answer

Enable guest access on all SMB shares

Question 5

Which of the following describes the purpose of the 'SMB Null Session' vulnerability?

Accepted Answer

To allow unauthenticated users to enumerate system information.. A null session occurs when a client connects to an SMB share without providing valid credentials. In older or misconfigured Windows systems, this allows anonymous users to query the server for sensitive information like user lists, group memberships, and share names. This information is vital for attackers during the reconnaissance phase, as it helps them map the environment and identify potential high-value targets for further exploitation.

Answer

To encrypt traffic between a client and a file server.

Answer

To bypass local firewall restrictions on port 445.

Answer

To prevent unauthorized access to sensitive file shares.

Question 6

An analyst notices an increase in SMB authentication failures from a workstation. What is the most likely cause if the workstation has a stored credential that is being used for SMB connections?

Accepted Answer

The stored credential is out of sync with the current domain password.. Stored credentials in Windows Credential Manager can cause authentication failures if the password for the account has been changed in Active Directory but not updated in the local cache. When the system attempts to connect to an SMB share, it automatically uses the stale stored credential, leading to repeated failed attempts. This can lock out the user's account, making it a critical issue to address for operational continuity and security.

Answer

The SMB server is blocking all incoming traffic.

Answer

The SMBv1 protocol is disabled on the workstation.

Answer

The firewall is blocking port 445 on the workstation.

Question 7

Which TWO of the following steps are considered effective for hardening the SMB service against modern threats?

Accepted Answer

Require SMB signing for all connections. Hardening SMB involves a combination of removing legacy protocols and enforcing strong authentication and integrity controls. Disabling SMBv1 is the most critical step to prevent known exploits, while enforcing SMB signing provides the necessary protection against man-in-the-middle and relay attacks. Together, these measures significantly reduce the risk of lateral movement and unauthorized access, creating a much more resilient file-sharing environment that aligns with current security standards for enterprise networks.

Answer

Enable Guest Auth for compatibility

Answer

Use the LanmanServer for internet access

Answer

Disable all firewall logging on port 445

Question 8

An incident handler is reviewing SMB traffic and notices multiple 'Tree Connect' requests to the IPC$ share. What does this activity typically signify in an attack scenario?

Accepted Answer

An attacker is likely performing reconnaissance or lateral movement.. The IPC$ (Inter-Process Communication) share is a special share used by Windows for communication between network devices, often for administrative functions. Attackers frequently connect to IPC$ to perform null sessions or to interact with the service control manager to remotely execute code. Identifying frequent, unauthorized connections to IPC$ is a strong indicator of reconnaissance or lateral movement, as it is a common starting point for an attacker to enumerate the system.

Answer

A standard user is accessing their home directory.

Answer

The workstation is simply performing routine backups.

Answer

The SMB server is correctly enforcing message signing.

Question 9

An incident responder is analyzing a packet capture and observes a Windows workstation sending an SMB2 NEGOTIATE request listing only the SMB 2.0.2 dialect, followed by a SESSION_SETUP request containing an NTLMSSP Type 3 message. The server responds with STATUS_SUCCESS. The workstation normally communicates with this file server using SMB 3.1.1. What is the most likely explanation for this behavior?

Accepted Answer

An attacker performed an SMB downgrade attack by intercepting the negotiation and stripping higher dialect offers.. The correct answer is the scenario where an attacker intercepts SMB negotiation and strips higher dialect offers, forcing the client to use SMB 2.0.2 and NTLMSSP authentication. This is a classic SMB downgrade attack aimed at capturing or relaying credentials. The other options describe misconfigurations or benign fallbacks that do not match the sudden change from SMB 3.1.1 with Kerberos to SMB 2.0.2 with NTLMSSP.

Answer

The workstation's SMB client is misconfigured to use only SMB 2.0.2 due to a missing registry key.

Answer

The file server is configured to only accept SMB 2.0.2 connections, forcing the client to downgrade.

Answer

The capture shows normal fallback behavior because the client and server could not agree on SMB 3.1.1 encryption.

Question 10

A security analyst is examining SMB traffic captured during an incident. The analyst observes a series of SMB2 Session Setup requests followed by Tree Connect requests to the IPC$ share, then attempts to access the srvsvc named pipe. The source IP is an internal workstation, and the destination is a domain controller. The workstation's user account is a standard domain user. Which of the following activities is the analyst MOST likely observing?

Accepted Answer

An attacker using the workstation to enumerate domain controller shares and services via SMB.. The observed traffic pattern—Session Setup, Tree Connect to IPC$, and srvsvc named pipe access—is characteristic of SMB enumeration. Attackers commonly use this technique to gather information about shares, users, and services on a target. A standard domain user can perform such enumeration if not restricted, making it a likely step in reconnaissance before lateral movement.

Answer

A user running a legitimate administrative script that queries the domain controller for share information.

Answer

A misconfigured application on the workstation attempting to access a remote file share.

Answer

An attacker performing SMB relay to escalate privileges on the domain controller.

Question 11

An incident handler is reviewing SMB traffic and notices a large number of SMB2 CREATE requests for files with extensions like .docx, .xlsx, and .pdf, followed by SMB2 WRITE requests that overwrite the same files with encrypted content. The traffic originates from a single workstation and targets a file server. Which type of attack is most likely occurring?

Accepted Answer

Ransomware encrypting files on the file server via SMB.. The correct answer is ransomware encrypting files via SMB. The sequence of opening document files and overwriting them with encrypted data is a hallmark of ransomware. The other options do not match the observed traffic: exfiltration would read files, brute-force would show failed logons, and worm propagation would target multiple hosts.

Answer

SMB worm propagation, where the attacker is scanning for vulnerable hosts.

Answer

Data exfiltration through SMB, where files are being copied to an external location.

Answer

SMB brute-force attack, where the attacker is attempting to guess passwords.

Question 12

A healthcare organization's incident response team is investigating unusual SMB activity on a Windows file server. NetFlow data shows a single internal workstation opened SMB connections to more than 200 distinct hosts on TCP 445 within five minutes, and each connection lasted under two seconds. The workstation's user reports no unusual behavior. Which of the following is the most likely explanation for this traffic pattern?

Accepted Answer

The workstation is infected with malware performing SMB worm-style lateral movement or network discovery.. A single workstation opening TCP 445 connections to over 200 distinct hosts in five minutes, with each session lasting under two seconds, matches automated SMB scanning or worm-style lateral movement. Legitimate backup or load-balancing traffic would be documented, targeted, and longer-lived. The silent nature of the activity and the user's unawareness reinforce malware as the likely cause, so the host should be isolated and examined.

Answer

The file server is load-balancing SMB sessions across the network, causing the workstation to reconnect frequently.

Answer

The workstation is experiencing a DNS misconfiguration causing it to resolve many hostnames to the same server.

Answer

A legitimate backup application is enumerating shares across the environment.

Question 13

An incident responder is investigating a suspected SMB relay attack on a corporate network. The attacker has compromised a workstation and is attempting to relay authentication to a domain controller. Which TWO of the following conditions are necessary for a successful SMB relay attack? (Choose two.)

Accepted Answer

SMB signing must be disabled or not required on the target server.. The correct answers are that SMB signing must be disabled or not required on the target server, and the victim's NTLM authentication must be relayed to a server that accepts NTLM. These conditions allow the attacker to forward authentication without detection. The other options are not necessary: valid credentials are not needed, physical access is not required, and SMB 1.0 is not a prerequisite.

Answer

The target server must be running SMB 1.0.

Answer

The attacker must have valid domain credentials for the target server.

Answer

The attacker must have physical access to the victim's workstation.

Question 14

An incident handler is investigating a suspected SMB relay attack at a financial services company. The team has captured traffic showing NTLM authentication being forwarded from a compromised workstation to a domain controller. Which two of the following controls would most directly mitigate this specific relay technique? (Choose two.)

Accepted Answer

Disable NTLM authentication for all domain accounts and require Kerberos where possible.. NTLM relay succeeds because an attacker can forward a captured NTLM exchange to another service that accepts NTLM. Requiring SMB signing binds messages to the session and invalidates relayed authentication, while disabling NTLM and requiring Kerberos removes the reusable credential exchange entirely. Together these controls directly break the relay path, whereas password complexity, SMB1 enablement, and detection-only measures do not prevent the forwarded authentication from being accepted.

Answer

Enable SMB1 on all servers to improve compatibility with legacy clients.

Answer

Require long, complex passwords for all domain users.

Answer

Deploy an intrusion detection system signature that alerts on SMB Tree Connect requests.

Question 15

An incident handler is reviewing SMB traffic logs from a small business network and notices that a client successfully authenticated to the IPC$ share on a file server using a null session. The handler wants to explain to management why this is a security concern. Which of the following best describes the risk of a successful null session to IPC$?

Accepted Answer

It permits unauthenticated enumeration of users, groups, shares, and other system information.. A null session to IPC$ is an unauthenticated connection that allows limited queries through named pipes and RPC. Attackers use it to enumerate users, groups, shares, and domain information without credentials. This reconnaissance does not grant file access or code execution, but it exposes details that make later attacks easier. Restricting anonymous access and disabling null sessions reduces this information disclosure.

Answer

It causes the server to disable SMB signing for all subsequent authenticated sessions.

Answer

It enables the client to execute arbitrary code on the server with SYSTEM privileges.

Answer

It allows the client to read and write files in all shared folders on the server.