300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity

By Cisco · Question Mode

QuestionQ17

Forensics Techniques

Question Image

Refer to the exhibit. An engineer is analyzing a TCP stream in Wireshark following a suspicious email containing a URL. What should be determined about the SMB traffic from this stream?

Explanation

SMB Session Setup carries NTLM authentication. An NTLMSSP challenge together with STATUS_MORE_PROCESSING_REQUIRED indicates challenge-response authentication is in progress, and STATUS_LOGON_FAILURE shows the authentication attempt did not succeed.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!