CEH Enumeration and System Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  SMB share names and permissions

  Why it's wrong here

  SNMP (Simple Network Management Protocol) is designed for monitoring and managing network devices, not for enumerating file shares. SMB (Server Message Block) shares operate on a different application layer protocol, typically over TCP port 445. Discovering SMB share names and their associated permissions requires specific SMB enumeration tools, such as smbclient or enum4linux, which directly interact with the SMB service to query its shared resources. SNMP MIBs do not contain this type of information.

• ✓

  System information and version details

  Why this is correct

  The snmpwalk command, especially when targeting the default MIB tree or the "system" group (OID 1.3.6.1.2.1.1), is highly effective at retrieving fundamental device information. This includes critical details like the operating system description (sysDescr), device hostname (sysName), system uptime (sysUpTime), and administrative contact information (sysContact). This makes it a primary method for initial reconnaissance to identify the type and version of the target system.

• ✗

  Network topology and routing tables

  Why it's wrong here

  While SNMP can expose a device's local routing table entries (found within the "ip" group, OID 1.3.6.1.2.1.4) and interface status, a single snmpwalk command on one host does not directly reveal a comprehensive network topology. Constructing a full network topology requires correlating data from multiple devices, often involving specialized discovery protocols or querying each device individually for its connections. The command provided primarily enumerates the MIB of the target host, not the broader network structure.

• ✗

  Active directory users and groups

  Why it's wrong here

  Active Directory user accounts, groups, and other directory service objects are managed and queried using the Lightweight Directory Access Protocol (LDAP), typically over TCP ports 389 or 636. SNMP is a distinct network management protocol and does not inherently provide access to Active Directory's directory information tree. While highly customized MIBs could theoretically expose some user-related data, it is not a standard or typical function of SNMP to enumerate AD users and groups.

Go deeper

Related to this question