QuestionQ17

Forensics Techniques

Question Image

Refer to the exhibit. An engineer is analyzing a TCP stream in Wireshark following a suspicious email containing a URL. What should be determined about the SMB traffic from this stream?

  • A It is redirecting to a malicious phishing website,
  • B It is exploiting redirect vulnerability
  • C It is requesting authentication on the user site.
  • D It is sharing access to files and printers.
Explanation

SMB Session Setup carries NTLM authentication. An NTLMSSP challenge together with STATUS_MORE_PROCESSING_REQUIRED indicates challenge-response authentication is in progress, and STATUS_LOGON_FAILURE shows the authentication attempt did not succeed.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!