GCIH SMB Security Practice Question
An incident handler is reviewing SMB traffic and notices multiple 'Tree Connect' requests to the IPC$ share. What does this activity typically signify in an attack scenario?
⚠ Common exam trap
Students often dismiss IPC$ share connections as normal background operating system noise, failing to recognize that repeated null sessions indicate active attacker reconnaissance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An attacker is likely performing reconnaissance or lateral movement.
The IPC$ (Inter-Process Communication) share is a special share used by Windows for communication between network devices, often for administrative functions. Attackers frequently connect to IPC$ to perform null sessions or to interact with the service control manager to remotely execute code. Identifying frequent, unauthorized connections to IPC$ is a strong indicator of reconnaissance or lateral movement, as it is a common starting point for an attacker to enumerate the system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A standard user is accessing their home directory.
Why it's wrong here
Accessing a home directory would involve connecting to a user-specific share, not the IPC$ share. The IPC$ share is for system-level communication and administrative tasks. Connecting to it is abnormal for standard user operations and is a clear indicator of system-level interaction that warrants further investigation by security teams.
- ✓
An attacker is likely performing reconnaissance or lateral movement.
Why this is correct
The IPC$ share is a primary target for attackers during the reconnaissance phase. It allows them to interact with the system's administrative features without needing a standard file share. Frequent connections to IPC$ are a hallmark of an attacker mapping the network or attempting to execute remote commands via SMB.
- ✗
The workstation is simply performing routine backups.
Why it's wrong here
Backups typically target specific data shares, not the IPC$ system share. While some backup agents might interact with system shares, the pattern of 'Tree Connect' requests suggests an active, manual exploration or malicious scripted interaction rather than the expected behavior of a managed, automated enterprise backup solution.
- ✗
The SMB server is correctly enforcing message signing.
Why it's wrong here
Message signing is a cryptographic configuration, not a behavioral pattern of connecting to shares. Connecting to IPC$ has no relation to whether the traffic is signed or encrypted. It is a sign of activity level, not protocol security configuration, and must be analyzed separately to assess the risk of the connection.
About these practice questions
Courseiva writes every GCIH question from scratch — 322 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.