nerdexam
EC-Council

312-50V11 · Question #642

What ports should be blocked on the firewall to prevent NetBIOS traffic from not coming through the firewall if your network is comprised of Windows NT, 2000, and XP?(Choose all that apply.

The correct answer is B. 135 C. 139 E. 445. NetBIOS and related Windows networking services use ports 135, 139, and 445, all of which must be blocked at the firewall to prevent NetBIOS and SMB traffic from traversing the network boundary.

Enumeration

Question

What ports should be blocked on the firewall to prevent NetBIOS traffic from not coming through the firewall if your network is comprised of Windows NT, 2000, and XP?(Choose all that apply.

Options

  • A110
  • B135
  • C139
  • D161
  • E445
  • F1024

How the community answered

(59 responses)
  • A
    2% (1)
  • B
    93% (55)
  • D
    3% (2)
  • F
    2% (1)

Why each option

NetBIOS and related Windows networking services use ports 135, 139, and 445, all of which must be blocked at the firewall to prevent NetBIOS and SMB traffic from traversing the network boundary.

A110

Port 110 is used by POP3 (Post Office Protocol) for email retrieval and has no relation to NetBIOS traffic.

B135Correct

Port 135 is used by Microsoft RPC (Remote Procedure Call) and DCOM, which underpin many NetBIOS-dependent services and must be blocked to prevent remote service exploitation. Port 139 is the NetBIOS Session Service port used for file and printer sharing over NetBIOS on older Windows systems. Port 445 is the Microsoft-DS (SMB over TCP) port used by Windows 2000 and later for direct SMB communication without NetBIOS, and blocking it prevents modern SMB-based attacks.

C139Correct

Port 139 is the NetBIOS Session Service port used for file and printer sharing over NetBIOS on older Windows systems.

D161

Port 161 is used by SNMP (Simple Network Management Protocol) for network device monitoring, not NetBIOS.

E445Correct

Port 445 is the Microsoft-DS (SMB over TCP) port used by Windows 2000 and later for direct SMB communication without NetBIOS, and blocking it prevents modern SMB-based attacks.

F1024

Port 1024 is the first port in the dynamic/registered range and is not specifically associated with NetBIOS services.

Concept tested: NetBIOS and SMB port blocking on firewalls

Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/netbios-over-tcpip-name-resolution

Topics

#NetBIOS#port filtering#SMB ports#firewall rules

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice