GIAC Certified Incident Handler (GCIH) — Question 66

What task is a Windows administrator performing with the command below, executed from a file server with an IP address of 46.95.101.82?

C:\> net session \\46.95.101.109 /del

Answer options

• A. Remove the share being offered from 46.95.101.82
• B. Disconnect the SMB session from host 46.95.101.82
• C. Delete the SMB share being offered from 46.95.101.109
• D. Disconnect the SMB session from host 46.95.101.109

Correct answer: C

Explanation

The correct answer is C because the command 'net session \46.95.101.109 /del' is specifically used to delete the SMB share associated with the IP address 46.95.101.109. The other options misinterpret the command's function, either referencing the wrong IP address or incorrectly describing the action as disconnecting sessions rather than removing a share.