easyMultiple Choice
PT0-002 Practice Question: A penetration tester is using a vulnerability…
A penetration tester is using a vulnerability scanner that reports a 'Critical' severity for an 'SMBv1 vulnerability' on a Windows server. Which of the following is the correct remediation recommendation?
⚠ Common exam trap
A common mix-up: candidates assume patching (Option A) is sufficient for all vulnerabilities, but for SMBv1, the protocol itself is deprecated and must be disabled rather than just patched.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable SMBv1 on the server
The correct remediation for an SMBv1 vulnerability is to disable SMBv1 on the server. SMBv1 is a legacy protocol that lacks modern security features and is known to be exploited by malware like EternalBlue (used in WannaCry). Disabling SMBv1 eliminates the attack surface without affecting SMBv2 or SMBv3, which are secure and still functional.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply the latest Windows security patches
Why it's wrong here
Applying the latest Windows security patches will address known SMBv1 exploits such as CVE-2017-0144 (EternalBlue), but it does not remove or disable the protocol from the system. A vulnerability scanner that identifies SMBv1 as enabled will still report the finding because the insecure protocol remains available for both legacy clients and potential future vulnerabilities. The definitive remediation is to disable SMBv1 entirely, not merely patch it.
- ✓
Disable SMBv1 on the server
Why this is correct
Disabling SMBv1 on the server completely eliminates the protocol's attack surface, stopping all SMBv1-specific transmission methods including EternalBlue-style remote code execution and pass-the-hash attacks. This aligns with Microsoft's guidance to remove SMBv1 unless there is an explicit legacy compatibility need, making it the most effective and durable remediation for a scanner finding that marks SMBv1 as enabled.
- ✗
Enable SMB signing
Why it's wrong here
Enabling SMB signing strengthens authentication integrity by cryptographically signing SMB packets, which mitigates SMB relay and man-in-the-middle attacks that attempt to modify or replay traffic. However, signing is a separate security feature from the protocol version; it does not disable SMBv1 or patch vulnerabilities in Microsoft's SMBv1 implementation, so the scanner's positive finding for SMBv1 remains valid and the protocol can still be targeted.
- ✗
Enable SMB encryption
Why it's wrong here
SMB encryption, available in SMB 3.0 and later, protects the confidentiality of data as it traverses the network, but it is completely independent of SMBv1, which lacks native encryption support. Enabling encryption does not alter the SMBv1 protocol's exposed code paths, so a scanner will still identify the vulnerable service. Moreover, SMB encryption only works on modern SMB versions and does not reduce the risk from SMBv1 exposure.
Go deeper
Related to this question
Learn chapter
Remediation Recommendations
Key term
Remediation
Remediation is the process of fixing or eliminating vulnerabilities, misconfigurations, or security weaknesses in an IT environment.
Key term
Remediation recommendation
A remediation recommendation is a prioritized, actionable suggestion for fixing a security vulnerability, misconfiguration, or compliance gap identified during an assessment or scan.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 777 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.