mediumMultiple Choice
PT0-002 Practice Question: A penetration tester wants to enumerate user…
A penetration tester wants to enumerate user accounts and SMB shares from a Windows machine without authenticating. Which tool is specifically designed for this purpose and is commonly used in Linux penetration testing distributions?
⚠ Common exam trap
Candidates often confuse enum4linux with smbclient or nmap, thinking that any SMB-related tool can perform null session enumeration, but enum4linux is the only one specifically built to automate this process without authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
enum4linux
enum4linux is specifically designed to enumerate user accounts, SMB shares, and other information from Windows machines via the SMB protocol without requiring authentication. It leverages the SMB null session vulnerability (CVE-1999-0504) to query the remote system for data such as user lists, share lists, and OS details, making it a standard tool in Linux penetration testing distributions like Kali Linux.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
nmap
Why it's wrong here
While Nmap excels at port scanning and service detection to identify that SMB (ports 139/445) is open, it does not natively enumerate SMB users without credentials. The --script smb-enum-users requires valid authentication for most modern Windows targets, and the output is far less comprehensive than dedicated SMB enumeration tools. Thus, Nmap is best used for reconnaissance of open shares and services, not as a primary user-enumeration method.
- ✓
enum4linux
Why this is correct
enum4linux is a dedicated wrapper around Samba tools (rpcclient, net, nmblookup) and is purpose-built for enumerating Windows/Samba hosts via the SMB and RPC protocols. It can list users, groups, shares, password policy, and OS information without credentials by abusing null sessions or guest access, making it the ideal choice for this task. Its automated scripts (enumusers, enumshares, enumpolicy) provide a comprehensive picture of the target's SMB exposure.
- ✗
smbclient
Why it's wrong here
smbclient allows you to interact with SMB shares, and the -L flag can list share names and sometimes a basic banner, but it does not directly enumerate local users or domain accounts. For detailed user enumeration, smbclient generally requires valid credentials and even then it's not designed for user account enumeration—that is rpcclient's or enum4linux's job. Its primary use case is file browsing and transfer, not security reconnaissance.
- ✗
hydra
Why it's wrong here
Hydra is a network authentication brute-force tool that tests passwords against services like SMB, SSH, and HTTP by trying many username/password combinations. It cannot enumerate user accounts without first having a list of usernames to attack; it only verifies credentials. Therefore, Hydra is applied after enumeration (often using usernames gathered by tools like enum4linux), making it irrelevant to the enumeration phase.
Go deeper
Related to this question
Learn chapter
Writing Penetration Test Reports
Key term
CVE
CVE stands for Common Vulnerabilities and Exposures, which is a publicly available list of standardized identifiers for known security vulnerabilities in software and hardware.
Key term
Penetration testing
Penetration testing is a simulated cyberattack on a computer system, network, or application to find security weaknesses before real attackers can exploit them.
About these practice questions
One of 777 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.