mediumMultiple Choice
PT0-002 Practice Question: A penetration tester is writing a Bash script to…
A penetration tester is writing a Bash script to enumerate network shares on multiple Windows hosts. The script uses smbclient to list shares. Which command should be used within the script to attempt to connect to a host with a known username and password?
⚠ Common exam trap
Many candidates confuse the `-L` (list shares) option with the direct share connection syntax (`//host/share`), or they mistakenly select a different tool like `smbmap` when the question explicitly specifies using `smbclient` in the script.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
smbclient -L //host -U username%password
The `smbclient -L //host` command lists available shares on a remote SMB/CIFS host, and appending `-U username%password` provides the credentials for authentication. This matches the requirement to enumerate network shares on multiple Windows hosts using a known username and password within a Bash script.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
smbclient -L //host -U username%password
Why this is correct
The -L flag in smbclient instructs the client to list all available SMB shares on the specified server, rather than mounting a particular share. Supplying credentials with -U username%password is necessary on modern Windows systems where guest or anonymous access to the share list is typically disabled. This command is ideal for a bash enumeration script because it produces parseable output of share names, types, and comments, and it works across SMB dialects supported by the target. It is the canonical smbclient way to enumerate shares.
- ✗
smbclient //host/share -U username%password
Why it's wrong here
This variant attempts to establish a direct connection to a single named share, such as \\host\share or //host/share, and if successful, drops into an interactive smbclient prompt. It does not enumerate the server's overall share list, so it provides no visibility into other shares that may exist. In an enumeration workflow, you must first use -L to discover available shares, then connect to a specific share afterward; using this command prematurely may fail if the share does not exist or access is denied.
- ✗
smbmap -H host -u username -p password
Why it's wrong here
smbmap is a separate tool from smbclient, and although it can enumerate shares (even with recursive listing and access checks), the question specifically asks for a bash script using smbclient. The syntax differs: smbmap uses -H for the host, -u for username, and -p for password, and it is not a smbclient command. While smbmap is a valid alternative in many Pentest+ scenarios, the constraint here is smbclient, making this option incorrect.
- ✗
net use \\host\share /user:username password
Why it's wrong here
net use is a Windows built-in command for mapping network drives or connecting to SMB shares on Windows systems, not a Linux/bash command. On a typical penetration testing distribution like Kali, net use is unavailable in a bash script unless over a non-standard compatibility layer. Furthermore, net use \\host\share connects to a specific share rather than enumerating all shares, so it does not fulfill the enumeration goal even if run on a Windows-based target.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 777 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.