PT0-001 · Question #208
A company received a report with the following finding While on the internal network the penetration tester was able to successfully capture SMB broadcasted user ID and password information on the…
The correct answer is B. Enable network-level authentication C. Remove the ability from Domain Users to join domain computers to the network. The attack describes SMB broadcast credential capture followed by unauthorized domain joining, requiring remediations that address both the authentication exposure and the domain-join privilege.
Question
A company received a report with the following finding While on the internal network the penetration tester was able to successfully capture SMB broadcasted user ID and password information on the network and decode this information This allowed the penetration tester to then join their own computer to the ABC domain Which of the following remediation's are appropriate for the reported findings'? (Select TWO)
Options
- ASet the Schedule Task Service from Automatic to Disabled
- BEnable network-level authentication
- CRemove the ability from Domain Users to join domain computers to the network
- DSet the netlogon service from Automatic to Disabled
- ESet up a SIEM alert to monitor Domain joined machines
- FSet "Digitally sign network communications" to Always
How the community answered
(26 responses)- A4% (1)
- B58% (15)
- D12% (3)
- E23% (6)
- F4% (1)
Why each option
The attack describes SMB broadcast credential capture followed by unauthorized domain joining, requiring remediations that address both the authentication exposure and the domain-join privilege.
Disabling the Task Scheduler service is unrelated to SMB credential capture or unauthorized domain joins and would disrupt legitimate scheduled system operations.
Enabling Network Level Authentication (NLA) requires users to authenticate before a full network session is established, reducing the window where broadcast credentials can be intercepted and replayed against network services.
By default, domain users can join up to 10 machines to the domain via the ms-DS-MachineAccountQuota attribute. Removing this permission directly prevents an attacker who has captured valid credentials from adding an unauthorized machine to the domain, which was the final step of the described attack.
Disabling the Netlogon service would break all domain authentication entirely and is not a targeted or practical remediation for the described attack.
A SIEM alert is a detection control, not a preventive remediation - it monitors for events but does not stop the described attack from succeeding.
Enabling SMB signing mitigates relay attacks where captured tokens are forwarded, but the scenario describes credentials being decoded (cracked), making it less directly targeted than the chosen remediations.
Concept tested: SMB credential capture remediation and domain join privilege control
Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/machine-account-quota-attribute
Topics
Community Discussion
No community discussion yet for this question.