Cert Master

KT-NET Port anomalies

NetFlow shows workstations initiating SMB(445) to hundreds of internal hosts at night. Likely?

Multiple choice — select one answer

Answer choices

  1. a. Evidence that DNS filtering is misconfigured on guest Wi-Fi only, without security or identity team coordination per policy.
  2. b. Proof that users need local admin to fix printer drivers faster
  3. c. Lateral movement or worm-like propagation requiring isolation and EDR hunt
  4. d. Normal Windows Update behavior that security should ignore completely, without security or identity team coordination per policy.

Architectural breakdown & explanation

Mass internal SMB from workstations is abnormal and often post-compromise.

Correct answer(s): c. Lateral movement or worm-like propagation requiring isolation and EDR hunt

Exam domain: Port anomalies (17% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Network Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications