312-50 Question 127
Single answer▪ System Hacking ConceptsDuring an authorized internal assessment, you obtain a standard domain user account and need to determine whether a legacy Windows file server is vulnerable to SMB relay-style credential abuse and weak authentication practices. You want to validate the risk without changing system settings or disrupting production services. Which action is the MOST appropriate first step?
- A
Use a protocol enumeration tool to verify whether SMB signing is required on the server and whether NTLM authentication is still accepted
- B
Run a password spraying attack against all domain users to identify accounts with weak passwords before testing SMB security controls
- C
Attempt Pass-the-Hash against the file server using hashes captured from another host to confirm whether lateral movement is possible
- D
Disable SMB signing on the file server temporarily and then perform a relay test to prove exploitability
Show answer and explanation
Correct answer: A
Explanation
This question tests practical application of system hacking concepts around Windows authentication, SMB security, and safe validation during an authorized engagement. In real environments, SMB relay risk commonly depends on whether SMB signing is enforced and whether NTLM-based authentication paths remain available. The correct workflow is to begin with non-disruptive enumeration before attempting intrusive exploitation. This aligns with standard ethical hacking methodology: identify, enumerate, verify controls, and only then proceed to approved exploitation if necessary. From a defensive and documentation standpoint, Microsoft security guidance has long emphasized reducing NTLM usage where possible and enabling or requiring SMB signing to mitigate relay-related abuse. Therefore, checking those settings is the most appropriate first step.
- A. Correct.
Correct. In a controlled CEH-style assessment, the least invasive and most appropriate first step is to enumerate the target's authentication and SMB protections. SMB relay attacks generally depend on conditions such as NTLM being in use and SMB signing not being required. Verifying whether SMB signing is required and whether NTLM is accepted helps determine exposure without modifying the host or using intrusive attack steps prematurely.
- B. Incorrect.
Incorrect. Password spraying is an active authentication attack and is not the best first step for evaluating SMB relay or weak protocol protections. It creates account lockout risk and tests a different issue: password hygiene. A candidate might choose this because weak passwords are part of system hacking, but it does not directly assess SMB signing or relay susceptibility.
- C. Incorrect.
Incorrect. Pass-the-Hash is a post-compromise lateral movement technique that assumes you already possess valid NTLM hashes and are ready to attempt authentication reuse. It is more invasive than simple enumeration and is not the most appropriate initial action when the immediate goal is to safely validate whether the server's SMB authentication configuration creates relay risk.
- D. Incorrect.
Incorrect. An ethical hacker should not weaken target security controls just to demonstrate exploitability unless explicitly authorized and carefully coordinated. Disabling SMB signing changes the system state, increases risk, and invalidates the purpose of assessing the server's existing configuration. A common misconception is that proving a vulnerability requires creating the vulnerable condition; in fact, assessment should measure the actual current exposure.