SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
NetFlow shows one workstation opening SMB connections to a dozen internal servers and then attempting many WinRM connections. What is the most likely explanation?
⚠ Common exam trap
The trap here is that candidates may mistake the SMB traffic for normal file sharing or printing, overlooking that WinRM is a remote execution protocol, not a file or print service, and thus the combination signals active reconnaissance or lateral movement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The host is likely being used for lateral movement or internal reconnaissance.
SMB connections to many internal servers followed by WinRM attempts is a classic pattern of lateral movement or internal reconnaissance. An attacker or compromised host uses SMB to probe for accessible shares and then leverages WinRM for remote command execution, which is a common technique in post-exploitation frameworks like PsExec or CrackMapExec.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The host is likely being used for lateral movement or internal reconnaissance.
Why this is correct
Sequential SMB connections from a single workstation to many internal hosts are a classic lateral movement indicator. Protocols like SMB and WinRM are commonly abused by tools such as PsExec, WMI, or PowerShell remoting to execute commands on remote systems and move throughout the network. This pattern reflects an attacker enumerating accessible shares and testing credentials rather than normal user behavior.
- ✗
The workstation is probably downloading a routine operating system update.
Why it's wrong here
Routine operating system updates are retrieved over HTTPS from Microsoft's own update endpoints, such as Windows Update or a WSUS server, not by opening SMB sessions to a broad range of internal servers. The update process uses HTTP-based delivery and does not require repeated SMB or WinRM authentication to arbitrary hosts. Consequently, this traffic pattern is incompatible with standard update behavior.
- ✗
The network is likely suffering from a wireless interference problem.
Why it's wrong here
Wireless interference degrades the physical layer, causing packet loss, reduced throughput, and retransmissions, but it cannot generate new SMB or WinRM connection attempts from a workstation. NetFlow records show TCP connection metadata, not RF conditions, so a wireless problem would not appear as sequential management-protocol connections to multiple servers. Any connectivity trouble would affect all traffic equally, not produce targeted internal probing.
- ✗
The user is likely printing documents to multiple shared printers.
Why it's wrong here
Printing to shared printers might use SMB for spooler traffic, but it would target a small number of known print devices or print servers, not many internal hosts in succession. Print jobs also do not create repeated WinRM authentication attempts, since WinRM is a remote management protocol used for PowerShell and administrative commands. This combination of many SMB targets plus WinRM login attempts points to active network exploration rather than printing.
Go deeper
Related to this question
Learn chapter
Lateral Movement Techniques
Key term
Post-exploitation
Post-exploitation is the phase of a penetration test that begins after an attacker has gained initial access to a system, focusing on maintaining access, escalating privileges, moving laterally, and achieving the test's objectives.
Key term
Exploitation
Exploitation is the act of using a vulnerability or weakness in a system, network, or application to gain unauthorized access, cause damage, or extract data.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.