200-201 Network Intrusion Analysis Practice Question

Which type of attack is indicated by a series of SMB authentication attempts from one host to multiple other hosts in a short time frame?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Lateral movement

Lateral movement often involves propagating across hosts using SMB for remote access and authentication.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Lateral movement
Why this is correct
SMB authentication attempts from one host to many hosts indicate an attacker using harvested credentials to move between systems. This pattern is characteristic of lateral movement, distinguishing it from a single-target brute-force or credential-stuffing attack.
✗
Port scanning
Why it's wrong here
Port scanning probes TCP or UDP ports to enumerate listening services, generating connection attempts rather than authenticated SMB session requests across many hosts. It tempts because it also involves one source touching multiple destinations, but would be the correct indicator when sequential port numbers on few hosts are probed.
✗
C2 beaconing
Why it's wrong here
C2 beaconing is periodic, low-volume callback traffic to an external command-and-control server, not SMB authentication attempts against internal hosts. It tempts because both show recurring connections from one host, but would be correct when regular timed outbound sessions to a single external address appear.
✗
DNS exfiltration
Why it's wrong here
DNS exfiltration encodes stolen data into DNS queries sent to an attacker-controlled nameserver, producing anomalous query patterns rather than SMB authentication traffic. It tempts because both involve outbound network activity from one host, but would be correct when unusually large or encoded DNS requests leave the network.

Go deeper