GCIH Scanning and Mapping Practice Question
Which tool is best suited for identifying potentially misconfigured SMB services that could be leveraged for lateral movement within a compromised Windows environment?
⚠ Common exam trap
Candidates mistakenly choose general-purpose vulnerability scanners or packet analyzers, overlooking tools specifically built with extensible scripting engines for SMB enumeration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Nmap with NSE scripts
Nmap's scripting engine (NSE) provides dedicated scripts like 'smb-vuln*' that can scan for specific vulnerabilities such as MS17-010. By integrating these scripts directly into the scanning workflow, responders can quickly map the attack surface and identify high-value targets for lateral movement without switching tools, ensuring a cohesive and efficient assessment of the environment's configuration security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wireshark
Why it's wrong here
Wireshark is a powerful packet analyzer, not a scanner. While it can capture SMB traffic for later analysis, it is not designed for active discovery or vulnerability identification. It is a passive tool that requires the traffic to exist, making it unsuitable for mapping and identifying vulnerable services on a network.
- ✓
Nmap with NSE scripts
Why this is correct
Nmap is a versatile scanner that, when combined with NSE scripts, can detect specific SMB-related vulnerabilities and configurations. This allows the responder to map the network and verify the security posture of Windows-based machines, identifying potential weak points that could be exploited to gain unauthorized access or move laterally across the network.
- ✗
Netcat
Why it's wrong here
Netcat is a networking utility for reading and writing data across network connections. While it can be used for basic port checking, it lacks the automation and specialized vulnerability-checking capabilities required to identify SMB configuration issues across a large number of hosts efficiently, making it a poor choice for comprehensive network mapping.
- ✗
Tcpdump
Why it's wrong here
Tcpdump is a command-line packet sniffer used for troubleshooting and debugging network traffic. Like Wireshark, it does not actively probe targets or report on service vulnerabilities. It provides visibility into raw traffic but cannot perform the automated scanning required to inventory vulnerabilities across multiple Windows systems in an enterprise.
About these practice questions
One of 322 original GCIH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.