200-201 Network Intrusion Analysis Practice Question
An analyst is examining network alerts for lateral movement. Which TWO of the following are typical indicators of lateral movement using SMB?
⚠ Common exam trap
200-201 often tests the confusion between normal SMB traffic and malicious lateral movement, and the misconception that any NTLM authentication is suspicious when only hash-based authentication is a red flag.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Multiple SMB connection attempts from a single host to many different hosts
Option B is correct because lateral movement via SMB typically manifests as one compromised host rapidly initiating SMB (TCP 445) connections to numerous distinct internal hosts, reflecting an attempt to fan out and find accessible targets or admin shares such as C$ or ADMIN$. Option C is correct because pass-the-hash attacks, a hallmark of SMB-based lateral movement, authenticate with an NTLM hash via NTLM challenge-response rather than a cleartext password, which is anomalous and strongly indicative of credential theft and reuse. Option A is not an indicator because a single SMB connection to a file server is normal, benign business activity. Option D is not specific to SMB lateral movement, since DNS queries for internal hostnames occur routinely during normal name resolution. Option E is unrelated, as HTTP requests to a web server involve the HTTP protocol on ports 80/443, not SMB.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A single SMB connection to a file server
Why it's wrong here
A single SMB connection to a file server is routine user activity, lacking the breadth, volume or credential anomalies that characterise lateral movement. It is tempting because SMB file access is the protocol abused during lateral movement, but the indicator requires multiple hosts or administrative shares, not one session.
- ✓
Multiple SMB connection attempts from a single host to many different hosts
Why this is correct
Lateral movement tools such as PsExec and Cobalt Strike's SMB beacon rapidly authenticate to many hosts from one source. A single host initiating SMB sessions to numerous distinct hosts deviates from normal peer-to-peer patterns and indicates propagation.
- ✓
NTLM authentication using a hash instead of a password
Why this is correct
Pass-the-hash attacks authenticate over SMB using a captured NTLM hash, bypassing password knowledge entirely. This satisfies the stem's lateral movement indicator: an attacker reusing stolen credentials to pivot between hosts. NTLM authentication with hash-only credentials is anomalous, since legitimate interactive logons supply a password or Kerberos ticket, making it a reliable detection signal.
- ✗
DNS queries for internal hostnames
Why it's wrong here
DNS lookups for internal hostnames occur constantly during normal name resolution and carry no SMB session data, so they do not indicate lateral movement over SMB. It is tempting because reconnaissance does generate such queries, but that is discovery activity, not SMB-based movement.
- ✗
HTTP requests to a web server
Why it's wrong here
HTTP requests to a web server use port 80 or 443 and are unrelated to SMB, which operates on ports 445 and 139, so they cannot evidence SMB lateral movement. It is tempting because web traffic can indicate command-and-control, but that is a different protocol and behaviour.
Visual reference
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.