Which Windows service is commonly exploited by null sessions to access shared resources on a network?

• A. Web Server
• B. File and Printer Sharing
• C. DHCP Client
• D. Print Spooler

Answer: (B)

Null sessions are unauthenticated connections that use SMB to reach shared resources on a Windows server. The File and Printer Sharing service is what provides those SMB shares, so attackers commonly target this service to enumerate shares and access resources without valid credentials. The other options don’t provide the standard channel for anonymously accessing network shares: Web Server serves web pages, DHCP Client handles IP configuration, and the Print Spooler deals with printers rather than general file/print shares. To reduce risk, limit anonymous SMB access, disable File and Printer Sharing on networks where it isn’t needed, and apply patches that close related vulnerabilities.