CEH Enumeration and System Hacking Practice Test 3 — 15 Questions

Question 1

A system administrator wants to enumerate all users in an Active Directory domain. Which protocol and query technique should they use?

Accepted Answer

LDAP anonymous query. LDAP anonymous queries allow unauthenticated users to query an Active Directory domain for directory information, including user enumeration. While modern Active Directory configurations often restrict anonymous LDAP binds by default for security reasons, if enabled or misconfigured, it becomes a highly effective technique for enumerating users without credentials.

Answer

SNMP with public community string

Answer

SMB null session

Answer

SMTP VRFY

Question 2

A penetration tester runs `snmpwalk -c public -v2c 192.168.1.50 1.3.6.1.2.1.1` and receives a list of system descriptions, uptime, and contact information. Which type of information is the tester primarily gathering?

Accepted Answer

System information and version details. The `snmpwalk` command with the OID `1.3.6.1.2.1.1` (the system group in MIB-II, defined in RFC 1213) queries the SNMP agent for system-level information. The output includes system description, uptime, contact, and version details, which are all part of the system group. This is a classic enumeration technique to gather system information and version details from a target device using SNMP with the default public community string.

Answer

SMB share names and permissions

Answer

Network topology and routing tables

Answer

Active directory users and groups

Question 3

During a penetration test, you run `smtp-user-enum -M VRFY -U users.txt -t 10.0.0.10` and receive responses '252 2.5.2 User <username>' for some users and '550 5.1.1 User unknown' for others. What does this indicate?

Accepted Answer

The SMTP server is revealing valid usernames via the VRFY command. The VRFY command in SMTP (RFC 821) asks the server to verify whether a mailbox exists. A response starting with '252' indicates the user is valid, while '550 5.1.1' means the user does not exist. By comparing these responses, the attacker can enumerate valid usernames on the mail server, which is exactly what the output shows.

Answer

The SMTP server is using EXPN instead of VRFY

Answer

The SMTP server is vulnerable to command injection

Answer

The SMTP server is properly configured to prevent enumeration

Question 4

An attacker has obtained password hashes from a Windows system. They plan to use rainbow tables to crack them. Which tool would be most appropriate for generating and using rainbow tables?

Accepted Answer

RainbowCrack. RainbowCrack is the tool specifically designed for generating and using rainbow tables, which are precomputed hash chains used to reverse cryptographic hash functions. The question explicitly asks for the tool most appropriate for generating and using rainbow tables, and RainbowCrack directly supports both creating rainbow tables (with rtgen) and performing lookups (with rcsort and rcrack).

Answer

Hashcat

Answer

Ophcrack

Answer

John the Ripper

Question 5

Which of the following tools is specifically used to enumerate SMB shares and retrieve file listings from Windows systems?

Accepted Answer

smbclient. smbclient is a tool from the Samba suite specifically designed to interact with SMB/CIFS shares. It allows an attacker to enumerate available shares on a Windows target and retrieve file listings by connecting to the SMB service (port 445 or 139) using commands like 'smbclient -L //target' or by mounting a share and listing its contents.

Answer

ldapsearch

Answer

snmpwalk

Answer

nmap

Question 6

A security administrator notices repeated failed login attempts from a single IP address targeting the SSH service. The attempts use common usernames (root, admin, test) and a list of passwords from a dictionary. What type of password attack is being conducted?

Accepted Answer

Dictionary attack. This is a dictionary attack because the attacker uses a predefined list of common usernames and passwords (a dictionary) against the SSH service. Unlike a brute-force attack that tries all possible combinations, a dictionary attack only tests likely entries from a wordlist, making it faster but limited to the dictionary's contents.

Answer

Rainbow table attack

Answer

Hybrid attack

Answer

Brute-force attack

Question 7

A Linux system has a script named 'backup' owned by root with the SUID bit set and world-executable permissions. A standard user executes the script and discovers it runs a command that reads /etc/shadow and writes output to a world-readable file. What is the most likely intended exploitation path?

Accepted Answer

SUID abuse to read sensitive files. The SUID bit on the 'backup' script, owned by root and world-executable, allows any user to execute it with root privileges. If the script reads /etc/shadow (which is normally root-only) and writes the output to a world-readable file, an attacker can exploit this to exfiltrate password hashes. This is a classic SUID abuse scenario where a privileged binary or script is used to access sensitive files.

Answer

GUID abuse

Answer

LD_PRELOAD injection

Answer

Token impersonation

Question 8

An incident responder finds that the Windows Event Logs on a compromised server have been cleared, and the Security log shows gaps in coverage. Additionally, a rootkit is suspected. Which phase of the hacking methodology does the clearing of logs represent?

Accepted Answer

Erasing tracks. Clearing Windows Event Logs and creating gaps in the Security log is a classic post-exploitation step to remove forensic evidence of the attacker's actions. In the CEH hacking methodology, this falls under 'Erasing tracks' (also known as covering tracks), which is the final phase after maintaining access. The rootkit suspicion further supports this, as rootkits often include log-wiping or log-modification capabilities to hide their presence.

Answer

Privilege escalation

Answer

Cracking passwords

Answer

Executing applications

Question 9

Which TWO tools can be used to enumerate SMB shares and users on a Windows target? (Choose two.)

Accepted Answer

smbclient. smbclient (A) is correct because its -L and -N options let you list SMB shares and, with -U, authenticate to enumerate shares and users on a Windows host over TCP 445/139. enum4linux (B) is correct because it wraps smbclient, rpcclient, and nmblookup to pull share lists, user lists, and group/password-policy data from SMB/RPC on Windows targets. nslookup (C) is wrong because it only queries DNS records and cannot touch SMB. snmpwalk (D) is wrong because it walks SNMP OIDs (UDP 161) and does not enumerate SMB shares or users. ldapsearch (E) is wrong because it queries LDAP directories (TCP 389/636) rather than SMB/RPC services.

Answer

nslookup

Answer

snmpwalk

Answer

ldapsearch

Question 10

Which THREE of the following are valid techniques in the system hacking methodology (CHPSET)? (Choose three.)

Accepted Answer

Privilege escalation. In the CEH system hacking methodology (often summarized as CHPSET: Cracking passwords, Hiding files, Privilege escalation, Executing applications, Covering tracks/erasing tracks, and Creating backdoors), privilege escalation (A) is a core step because after gaining initial access the attacker elevates from a low-privileged account to root/SYSTEM or administrator rights to fully control the target. Erasing tracks (C) is also a core step, covering log tampering, clearing event logs, disabling auditing, and removing artifacts so the intrusion is not detected or attributed. Cracking passwords (E) is the first phase of CHPSET, where techniques such as dictionary, brute-force, rainbow-table, and hybrid attacks recover or bypass credentials to obtain valid access. Social engineering (B) is not part of the system hacking methodology; it belongs to the earlier footprinting/scanning or social-engineering phase of the CEH attack lifecycle. Network sniffing (D) is likewise a separate CEH domain (sniffing), used for capturing traffic, not a step in the CHPSET system hacking sequence.

Answer

Social engineering

Answer

Network sniffing

Question 11

A security analyst runs 'nbtstat -A 192.168.1.10' and receives a table showing the machine name and a list of names registered. Which service is being enumerated?

Accepted Answer

NetBIOS. The 'nbtstat -A' command performs a NetBIOS name table lookup against a remote IP address using the NetBIOS over TCP/IP (NBT) protocol. It queries the target's NetBIOS name service (UDP port 137) and returns the registered names, including the machine name, workgroup/domain, and logged-in users. This directly enumerates the NetBIOS service, making D the correct answer.

Answer

SNMP

Answer

LDAP

Answer

SMTP

Question 12

During a penetration test, you need to enumerate SMB shares on a Windows target. Which of the following tools is specifically designed for this purpose?

Accepted Answer

enum4linux. enum4linux is specifically designed to enumerate SMB shares and other information from Windows and Samba systems. It leverages the SMB/CIFS protocol to extract share listings, user lists, and other details using tools like smbclient, rpclient, and net, making it the correct choice for SMB enumeration.

Answer

ldapsearch

Answer

nmap

Answer

snmpwalk

Question 13

Which SNMP community string is typically used for read-only access by default on many devices?

Accepted Answer

public. The default read-only community string in SNMPv1 and SNMPv2c is 'public'. This string acts as a password that allows an SNMP manager to query device MIB objects for monitoring purposes without making configuration changes. It is widely documented in RFC 1157 and is the standard default across most networking equipment.

Answer

snmp

Answer

private

Answer

admin

Question 14

An attacker attempts to enumerate valid email users by connecting to an SMTP server and issuing the following commands: EHLO example.com, VRFY root, VRFY admin, VRFY user1. Which SMTP enumeration technique is being used?

Accepted Answer

VRFY. The VRFY command is specifically designed to verify whether a mailbox exists on an SMTP server. By issuing VRFY followed by usernames (root, admin, user1), the attacker can enumerate valid email users based on the server's responses (e.g., 250 or 251 for valid, 550 for invalid). This is a classic SMTP user enumeration technique.

Answer

RCPT TO

Answer

MAIL FROM

Answer

EXPN

Question 15

A tester runs 'snmpwalk -v2c -c public 192.168.1.1' and receives a large amount of system information. What does this command do?

Accepted Answer

It walks the SNMP MIB tree using version 2c and the public community string.. The `snmpwalk` command is used to retrieve a subtree of management values from an SNMP agent. The `-v2c` flag specifies SNMP version 2c, which uses community-based security, and `-c public` provides the community string 'public' (often the default read-only community). The command walks the entire MIB tree starting from the root, returning all available OID values, which explains the large amount of system information received.

Answer

It performs a brute-force attack on SNMP community strings.

Answer

It enumerates users on a Windows domain.

Answer

It sets SNMP values using the private community string.