312-50 Question 111
Single answer▪ Enumeration CountermeasuresDuring an internal security assessment, a tester is able to query a Windows-based file server over SMB and identify valid domain usernames by observing different responses to failed authentication attempts. The organization wants to reduce the likelihood of username and account enumeration without disrupting normal domain operations. Which action is the MOST appropriate countermeasure?
- A
Enable the policy to not display the last signed-in username and standardize authentication failure messages so they do not reveal whether the username or password was incorrect
- B
Disable DNS on the file server so attackers cannot resolve the host before attempting SMB authentication
- C
Turn off all Windows event logging related to logon failures so attackers cannot correlate account validity
- D
Allow anonymous SID/Name translation to remain enabled so failed lookups blend in with valid responses
Show answer and explanation
Correct answer: A
Explanation
The best answer is Option 1 because the scenario is specifically about reducing information leakage that helps an attacker confirm valid usernames during enumeration. In Windows environments, effective countermeasures include minimizing username exposure at logon, avoiding verbose or differentiating authentication error messages, restricting anonymous enumeration, and hardening SMB/NetBIOS exposure. Microsoft security baselines and Windows security options commonly recommend controls such as not displaying the last signed-in user, limiting anonymous access, and auditing failed logons rather than disabling them. Options 2 and 3 are poor countermeasures because they either disrupt normal services without addressing the enumeration vector or reduce visibility. Option 4 is the opposite of a countermeasure because anonymous SID/name translation can facilitate user and group enumeration.
- A. Correct.
Correct. Enumeration countermeasures on Windows commonly include reducing information disclosure during logon and authentication workflows. Hiding the last logged-on username prevents unnecessary username disclosure at the console, and using generic logon failure behavior helps avoid confirming whether a submitted username is valid. In practice, administrators also pair this with restricting anonymous enumeration and unnecessary SMB/NetBIOS exposure. This option directly addresses the scenario: the tester is distinguishing valid from invalid accounts based on authentication responses.
- B. Incorrect.
Incorrect. Disabling DNS does not address the root issue of account enumeration through SMB authentication behavior. An attacker on the internal network can still connect directly by IP address, and DNS is a core service that would likely disrupt legitimate operations. This is a common misconception: removing name resolution does not meaningfully mitigate username enumeration over an already reachable service.
- C. Incorrect.
Incorrect. Disabling logon failure logging weakens detection and incident response rather than preventing enumeration. Security logging is a key control for identifying brute-force attempts, password spraying, and enumeration activity. The tester in the scenario is using protocol responses, not event logs, to identify usernames. Best practice is to retain and monitor relevant logs, not suppress them.
- D. Incorrect.
Incorrect. Allowing anonymous SID/Name translation increases, rather than decreases, the risk of enumeration. Attackers can abuse null sessions or unauthenticated lookups in poorly hardened environments to map users, groups, and SIDs. The correct security posture is to restrict anonymous enumeration and SID/name translation where operationally feasible.