CEH Enumeration and System Hacking Practice Question

A penetration tester is attempting to enumerate user accounts on a mail server. They connect to port 25 and issue the commands `VRFY root` and `EXPN support`. Which protocol is being targeted?

⚠ Common exam trap

Watch out — candidates often confuse SMTP commands with other protocol operations, such as associating VRFY with LDAP directory lookups or EXPN with SNMP expansion, because they focus on the word 'enumerate' rather than the specific port and command syntax.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

SMTP

The commands VRFY and EXPN are SMTP (Simple Mail Transfer Protocol) commands defined in RFC 821 and RFC 5321. VRFY is used to verify whether a mailbox exists on the server, while EXPN expands a mailing list alias to reveal its members. Since the tester connected to port 25 (the default SMTP port) and issued these commands, SMTP is the protocol being targeted.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
LDAP
Why it's wrong here
LDAP (Lightweight Directory Access Protocol) operates primarily on TCP port 389 and is designed for querying and modifying directory services. It relies on specific search filters and attributes (e.g., `(sAMAccountName=*)`) to enumerate user information, often requiring proper authentication or anonymous bind permissions. LDAP does not utilize the `VRFY` or `EXPN` commands; these are specific to the SMTP protocol and are not recognized or processed by an LDAP server for user verification.
✓
SMTP
Why this is correct
The Simple Mail Transfer Protocol (SMTP) is the correct answer because it includes specific commands like `VRFY` (verify) and `EXPN` (expand) that can be leveraged for user enumeration. The `VRFY` command attempts to validate a specific email address or username on the target mail server, often returning a 250 OK response if the account exists. Similarly, `EXPN` can reveal members of a mailing list or alias, indirectly confirming valid user accounts. When not disabled or restricted, these commands provide a direct method for attackers to identify valid user accounts on a system.
✗
SMB
Why it's wrong here
Server Message Block (SMB) is a network file sharing protocol that primarily operates over TCP port 445 (or 139 for NetBIOS over TCP/IP). While SMB can be exploited for user enumeration through methods such as null sessions or specific Remote Procedure Call (RPC) functions like `NetUserEnum`, it is fundamentally distinct from email protocols. SMB does not support or interpret SMTP-specific commands like `VRFY` or `EXPN`; attempting to use these against an SMB service would result in an unrecognized command error.
✗
SNMP
Why it's wrong here
The Simple Network Management Protocol (SNMP) operates on UDP ports 161 (for agent requests) and 162 (for traps) and is used for managing and monitoring network devices. SNMP agents expose management data as variables in a Management Information Base (MIB), which can be queried using Object Identifiers (OIDs) and often authenticated via community strings. While SNMP can sometimes reveal system user accounts through specific MIB OIDs, it does not employ or respond to the `VRFY` or `EXPN` commands, which are exclusively part of the SMTP protocol.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question