CEH Enumeration and System Hacking Practice Question
A penetration tester discovers a service running on UDP port 161 with a default community string 'public'. They use `snmpwalk -v2c -c public 192.168.1.10` and retrieve extensive system information. Which enumeration technique is being performed?
⚠ Common exam trap
Many candidates confuse SNMP enumeration with other enumeration techniques because they see 'enumeration' in the question, but the specific use of UDP port 161 and the `snmpwalk` command uniquely identifies SNMP enumeration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SNMP enumeration
The question describes using SNMP (Simple Network Management Protocol) over UDP port 161 with the default community string 'public' and the `snmpwalk` command to retrieve system information. This is a classic SNMP enumeration technique, where an attacker queries MIB (Management Information Base) data to extract details like running processes, user accounts, and network configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SMB enumeration
Why it's wrong here
Server Message Block (SMB) primarily operates over TCP port 445 for direct host communication, facilitating file and printer sharing, and remote administration. While older NetBIOS over TCP/IP (NBT) services utilize UDP ports 137 and 138 for name resolution and datagram services, the fundamental SMB protocol itself relies on a reliable TCP connection. Therefore, discovering a service on a generic UDP port, especially UDP 161, would not indicate an SMB service.
- ✗
LDAP enumeration
Why it's wrong here
The Lightweight Directory Access Protocol (LDAP) is a client-server protocol used for accessing and maintaining distributed directory information services, predominantly operating over TCP. Its standard unencrypted communication uses TCP port 389, while secure LDAP (LDAPS) utilizes TCP port 636. There is no standard UDP port associated with the core LDAP service operations, making it an incorrect identification for a service found on a UDP port.
- ✗
SMTP enumeration
Why it's wrong here
Simple Mail Transfer Protocol (SMTP) is the internet standard for sending electronic mail, and it is exclusively a TCP-based protocol. Standard unencrypted mail transfer between servers occurs over TCP port 25, with client mail submission typically using TCP port 587 or secure SMTPS on TCP port 465. Consequently, a service identified on any UDP port, particularly UDP 161, cannot be an SMTP service.
- ✓
SNMP enumeration
Why this is correct
Simple Network Management Protocol (SNMP) is a foundational protocol for managing and monitoring network devices, and it predominantly uses UDP for its operations. SNMP agents typically listen for manager requests on UDP port 161, while managers receive asynchronous notifications (traps and informs) on UDP port 162. Enumeration tools like `snmpwalk` specifically target UDP port 161 to query and retrieve the entire Management Information Base (MIB) tree from compliant devices, confirming its relevance to a service on UDP 161.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.