Which SMB feature is designed to protect data in transit by preventing tampering at the channel level?

Which SMB feature is designed to protect data in transit by preventing tampering at the channel level?

• A. SMB Multichannel
• B. Pre-Authentication integrity
• C. SMB Encryption
• D. Cluster Dialect Fencing

Answer: (B)

Safeguarding data in transit during SMB session setup relies on ensuring the pre-authentication exchange cannot be tampered with. Pre-authentication integrity adds a cryptographic check across the negotiation and session-setup messages that are sent before credentials are exchanged. This means any attempt by an attacker to modify those pre-authentication messages will be detected, and the connection will be aborted before a session is established, preventing an impersonation or man-in-the-middle from taking over the channel. This is different from features that secure data after the channel is established. For example, encrypting SMB traffic protects the actual data moving over the channel once a session is active, but it’s not about guarding the pre-authentication handshake itself. Other options focus on using multiple network paths for performance or on dialect negotiation protections within clusters, rather than on ensuring the integrity of the pre-authentication channel.

Safeguarding data in transit during SMB session setup relies on ensuring the pre-authentication exchange cannot be tampered with. Pre-authentication integrity adds a cryptographic check across the negotiation and session-setup messages that are sent before credentials are exchanged. This means any attempt by an attacker to modify those pre-authentication messages will be detected, and the connection will be aborted before a session is established, preventing an impersonation or man-in-the-middle from taking over the channel.

This is different from features that secure data after the channel is established. For example, encrypting SMB traffic protects the actual data moving over the channel once a session is active, but it’s not about guarding the pre-authentication handshake itself. Other options focus on using multiple network paths for performance or on dialect negotiation protections within clusters, rather than on ensuring the integrity of the pre-authentication channel.