SY0-301 · Question #246
A malicious program modified entries in the LMHOSTS file of an infected system. Which of the following protocols would have been affected by this?
The correct answer is C. NetBIOS. The LMHOSTS file is a static local lookup table used by NetBIOS over TCP/IP to resolve NetBIOS names (Windows computer names) to IP addresses. It is the NetBIOS equivalent of the hosts file (which resolves DNS hostnames). By poisoning the LMHOSTS file, an attacker can redirect…
Question
A malicious program modified entries in the LMHOSTS file of an infected system. Which of the following protocols would have been affected by this?
Options
- AICMP
- BBGP
- CNetBIOS
- DDNS
How the community answered
(59 responses)- A7% (4)
- B3% (2)
- C76% (45)
- D14% (8)
Explanation
The LMHOSTS file is a static local lookup table used by NetBIOS over TCP/IP to resolve NetBIOS names (Windows computer names) to IP addresses. It is the NetBIOS equivalent of the hosts file (which resolves DNS hostnames). By poisoning the LMHOSTS file, an attacker can redirect NetBIOS name resolution to malicious IPs, enabling man-in-the-middle attacks on Windows file sharing (SMB) and other NetBIOS-dependent services. ICMP (A) is a Layer 3 protocol for diagnostics (ping, traceroute) and is not affected by name resolution files. BGP (B) is a dynamic routing protocol used between autonomous systems on the internet and has no relation to LMHOSTS. DNS (D) uses the separate hosts file (C:\Windows\System32\drivers\etc\hosts) for static overrides, not LMHOSTS.
Topics
Community Discussion
No community discussion yet for this question.