N10-009 Question 75
Single answerSMB: 445A systems administrator has migrated a department's shared files from an old server to a new Windows file server. Users on the local network report that they can ping the new server by name and access its web-based management page, but they cannot open shared folders using \fileserver\shared. A firewall review shows that only ports 80, 443, 53, and 3389 are currently allowed to the server. Which change should the administrator make FIRST to restore access to the file shares?
- A
Allow TCP port 445 to the file server
- B
Allow UDP port 137 to the file server
- C
Allow TCP port 21 to the file server
- D
Allow TCP port 389 to the file server
Show answer and explanation
Correct answer: A
Explanation
The key detail is that users can reach the server by name and access other services, which indicates the server is online and basic connectivity exists. The failed access method, \fileserver\shared, specifically points to SMB/CIFS file sharing. In modern Microsoft networking, SMB is typically carried directly over TCP port 445. If a firewall allows web, DNS, and RDP traffic but blocks 445, shared folders will not be accessible even though the host appears reachable. NetBIOS-related ports such as 137 were more important in legacy environments, but current Windows SMB implementations primarily use TCP 445. This aligns with standard Microsoft documentation and common enterprise firewall best practices, where SMB should be allowed only where needed because port 445 is a frequent target for lateral movement and malware.
- A. Correct.
Correct. Modern SMB file sharing in Windows commonly uses direct hosting over TCP port 445. If users can resolve the server name and reach other services, but cannot access shared folders with a UNC path, blocking TCP 445 is the most likely cause. Opening this port is the first step to restore SMB access.
- B. Incorrect.
Incorrect. UDP 137 is associated with NetBIOS Name Service, which was used in older NetBIOS-based Windows networking. In this scenario, users can already ping the server by name, so name resolution is functioning. Modern SMB access does not require UDP 137 when using direct SMB over TCP 445.
- C. Incorrect.
Incorrect. TCP 21 is used for FTP, which is a different file transfer protocol and not used for standard Windows file shares accessed with \server\share paths. Someone might choose this if they are thinking generally about file access rather than specifically about SMB.
- D. Incorrect.
Incorrect. TCP 389 is used for LDAP, typically for directory services such as Active Directory queries. While directory services may support authentication and resource discovery in some environments, blocking 389 would not directly prevent SMB file sharing if the specific symptom is inability to connect to shared folders and the issue is limited to the file server's allowed ports.