CEH Enumeration and System Hacking Practice Question
A penetration tester uses `smbclient -L //192.168.1.30 -N` and receives a list of shares including a hidden administrative share (C$) and a user share named "Backup". What is the most immediate security concern?
⚠ Common exam trap
The trap here is that candidates focus on the existence of the C$ administrative share or the Backup share's name, rather than recognizing that the ability to enumerate any shares without authentication (null session) is the most critical and immediate vulnerability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Null session enumeration is possible, allowing information gathering
The `-N` flag in the `smbclient` command suppresses password prompts, enabling a null session connection. The fact that the command successfully lists shares without authentication indicates that null session enumeration is permitted, which is a critical security flaw. This allows an attacker to gather sensitive information (share names, user lists, etc.) without any credentials, often serving as the first step in a targeted attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Backup share may contain sensitive data
Why it's wrong here
The `smbclient -L` command is designed to list available shares on a target system, not to inspect their contents or determine the sensitivity of data within them. While a share named 'Backup' might indeed contain sensitive information, the command itself only reveals the share's existence and accessibility, not the nature of its files. Therefore, concluding that it 'may contain sensitive data' is an assumption beyond the direct output or function of the enumeration command.
- ✗
SMB signing is not enabled
Why it's wrong here
The `smbclient -L` command with the `-N` flag attempts an unauthenticated (null session) connection to list shares, but it does not directly test or report on the status of SMB signing. SMB signing is a security mechanism that verifies the authenticity of SMB packets to prevent tampering and relay attacks. Determining whether SMB signing is enabled or enforced typically requires analyzing network traffic or using tools specifically designed to query SMB security configurations, which this command does not do.
- ✓
Null session enumeration is possible, allowing information gathering
Why this is correct
The command `smbclient -L 192.168.1.30 -N` explicitly attempts to perform a null session enumeration, meaning it tries to list shares without providing any credentials. If this command successfully returns a list of shares, it confirms that the target system permits unauthenticated access for information gathering. This vulnerability allows an attacker to discover available network resources, user accounts, and group information, which is crucial for subsequent attack phases.
- ✗
The C$ share is a default administrative share
Why it's wrong here
While the C$ share is indeed a common default administrative share on Windows operating systems, the `smbclient -L` command only lists shares that are explicitly made available for enumeration. The command itself does not guarantee that C$ will be present in the output, as its visibility depends on the target system's specific configuration and permissions. Therefore, stating its existence as a direct conclusion from merely running the command, without seeing its output, is an assumption rather than a direct finding.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.