N10-009 Question 74
Single answerSMB: 445A systems administrator reports that users at a branch office cannot open shared folders on a file server at headquarters by using its hostname. The users can successfully ping the server, and Remote Desktop to the server works, but mapping a network drive fails. A firewall was recently deployed between the sites. The network technician confirms DNS resolution is correct and wants to restore SMB file sharing with the least unnecessary exposure. Which action should the technician take?
- A
Allow TCP port 445 from the branch office subnet to the file server
- B
Allow UDP port 137 from the branch office subnet to the file server
- C
Allow TCP port 3389 from the branch office subnet to the file server
- D
Allow TCP port 21 from the branch office subnet to the file server
Show answer and explanation
Correct answer: A
Explanation
The best answer is to allow TCP port 445 because SMB file sharing on current Windows systems uses direct-hosted SMB over TCP 445. This is the port typically required for accessing shared folders and mapping network drives across routed networks when SMB is permitted. Since ping and RDP are already working, the issue is not general connectivity or server reachability but application-specific access through the firewall. Allowing only TCP 445 from the branch subnet to the specific file server is the most targeted fix and aligns with least-privilege firewall design. Microsoft documentation and common enterprise firewall best practices identify TCP 445 as the primary port for SMB file and printer sharing, while older NetBIOS-related ports such as 137-139 are legacy components and are not the preferred solution in a modern DNS-based environment.
- A. Correct.
Correct. Modern SMB file sharing uses TCP port 445 for direct-hosted SMB. If users can ping the server and RDP works, basic IP connectivity exists, but SMB access will fail if TCP 445 is blocked by the firewall. Limiting the rule to the specific branch subnet and destination file server follows the requirement to restore access with minimal unnecessary exposure.
- B. Incorrect.
Incorrect. UDP 137 is associated with NetBIOS Name Service, which was used in older Windows networking environments. In this scenario, DNS resolution has already been confirmed as working, and modern SMB access to shared folders relies primarily on TCP 445 rather than UDP 137. Opening UDP 137 would not address the actual issue.
- C. Incorrect.
Incorrect. TCP 3389 is used by Remote Desktop Protocol. The scenario already states that Remote Desktop to the server works, so this port is not the cause of the file-sharing problem. Choosing this option reflects confusion between remote administration access and SMB file-sharing traffic.
- D. Incorrect.
Incorrect. TCP 21 is used by FTP control connections, not SMB. Although FTP can transfer files, it is not the protocol used for Windows shared folders or mapped network drives. Opening this port would not restore access to SMB shares.