A city GPO legacy setting disables SMB signing domain-wide. What conceptual link should the tester make in the report?
Select an answer to reveal the explanation.
Short Explanation
SMB signing is the handshake that says 'this session was not quietly redirected.' Switch it off domain-wide and you weaken a key defense against relay-shaped mischief. Call the GPO out as a hardening miss.
Full Explanation
If a city GPO legacy setting disables SMB signing domain-wide, the tester should link that signing policy influences resistance to relay-class techniques and that disabled signing is a hardening gap worth noting. Disabled SMB signing is not merely print-spooler aesthetics. Turning off signing does not automatically enforce Kerberos-only authentication everywhere. Signing settings remain relevant even when antivirus definitions are current. Exam caveat: connect protocol hardening controls to identity risk themes without providing a relay how-to. Operational check: confirm effective signing requirements via policy and sample hosts, recommend enabling SMB signing where compatible, pilot on non-critical OUs, and re-check printers and legacy appliances that often block enforcement. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments. Keep secret material and session artifacts in the approved vaulted workflow rather than chat paste or unprotected tickets used by mixed municipal teams.