GCIH SMB Security Practice Question
An organization experiences a rapid spread of ransomware across the internal network. Analysts determine that the ransomware is exploiting SMB to move laterally. Which configuration effectively limits this spread by preventing SMB communication between workstations?
⚠ Common exam trap
Candidates often select 'disabling SMB' entirely or 'blocking all traffic' between workstations. This is incorrect because SMB is still required for legitimate server-client communication; the goal is specifically blocking host-to-host lateral movement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing Windows Firewall rules to block port 445 between workstations
Disabling SMB traffic between workstations, often referred to as intra-subnet or host-to-host SMB blocking, is a highly effective mitigation strategy against ransomware. By enforcing this via Windows Firewall or Group Policy, you prevent lateral movement, as ransomware frequently uses SMB to copy its own payload to other machines. This strategy adheres to the principle of least privilege, ensuring workstations only talk to servers, not to each other.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disabling the Workstation service on all servers
Why it's wrong here
Disabling the Workstation service on servers would prevent those servers from accessing other network resources, which is not the intended goal. The objective is to stop workstations from communicating with each other, not to isolate the servers from the rest of the infrastructure, which could break critical business functions.
- ✓
Implementing Windows Firewall rules to block port 445 between workstations
Why this is correct
Restricting SMB traffic on port 445 between workstations is a standard security practice to prevent lateral movement. Since workstations rarely need to share files directly with one another, blocking this traffic effectively stops many automated worms and ransomware variants from propagating across the local network segment during an active incident.
- ✗
Increasing the SMB session timeout duration
Why it's wrong here
Increasing the session timeout duration would have no impact on the spread of ransomware. If anything, it might allow malicious processes more time to complete their tasks. This setting is strictly for resource management and session stability, having no relevance to the security posture against lateral movement or malware.
- ✗
Enabling the Print Spooler service on all workstations
Why it's wrong here
The Print Spooler service is a frequent target for privilege escalation attacks and does not help contain SMB traffic. Enabling this service actually increases the attack surface of the workstations, providing attackers with more potential exploits rather than securing the environment against lateral movement or ransomware propagation.
Visual reference
About these practice questions
Courseiva writes every GCIH question from scratch — 322 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.