CEH Enumeration and System Hacking Practice Question
A penetration tester is enumerating services on a target Windows server. Which TWO tools are specifically designed for SMB enumeration? (Select two.)
⚠ Common exam trap
The trap here is that candidates may select Nmap because it has SMB scripts, but the question asks for tools 'specifically designed' for SMB enumeration, which excludes general-purpose scanners like Nmap.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
enum4linux
enum4linux (D) is a Perl script that wraps Samba tools like smbclient, rpcclient, and net to enumerate SMB shares, users, and OS information from Windows systems. smbclient (E) is a native Samba client that allows direct interaction with SMB shares, including listing, connecting, and transferring files. Both are purpose-built for SMB enumeration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
John the Ripper
Why it's wrong here
John the Ripper is primarily a password cracking utility designed to perform offline brute-force or dictionary attacks against hashed passwords. While it's crucial for post-exploitation phases involving credential compromise, it does not enumerate active network services on a target system. Its function is to test password strength or recover lost passwords, not discover running services.
- ✗
SNMPwalk
Why it's wrong here
SNMPwalk is a command-line tool specifically designed to query devices using the Simple Network Management Protocol (SNMP). It retrieves information from a device's Management Information Base (MIB), providing details about network interfaces, system uptime, and other SNMP-managed components. However, it is not used for enumerating common Windows services such as NetBIOS, SMB, or RPC, which are typically targeted during Windows service enumeration.
- ✗
Nmap
Why it's wrong here
Nmap is a versatile network scanner primarily used for host discovery, port scanning, and service version detection. While it can identify open ports and the services listening on them, it is not specifically designed for the detailed enumeration of Windows-specific information like user accounts, group memberships, or shared folders via NetBIOS/SMB protocols. For deep Windows service enumeration, more specialized tools are often required to extract granular details.
- ✓
enum4linux
Why this is correct
enum4linux is a comprehensive tool specifically designed for enumerating information from Windows and Samba hosts. It automates the process of extracting user lists, group memberships, shared resources, password policies, and other critical details by querying NetBIOS and SMB services. This makes it highly effective for gathering intelligence on a Windows target, going beyond simple port identification to deep service enumeration.
- ✓
smbclient
Why this is correct
smbclient is a powerful command-line utility that functions as an SMB/CIFS client, enabling direct interaction with shared resources on Windows and Samba servers. Penetration testers use it to list available shares, browse directory contents, and even transfer files, providing detailed insights into the file and print sharing services. This direct access is crucial for enumerating shared folders and understanding potential data exposure on a target Windows system.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.