CEH Enumeration and System Hacking Practice Question
A penetration tester wants to enumerate users and groups from a Windows domain controller via LDAP without logging in. Which of the following tools is MOST appropriate for anonymous LDAP enumeration?
⚠ Common exam trap
Test-takers frequently confuse enum4linux (which uses SMB/RPC null sessions) with LDAP enumeration, but enum4linux does not perform anonymous LDAP queries and relies on different protocols and ports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ldapsearch
ldapsearch is the correct tool because it can perform anonymous LDAP queries against a Windows domain controller's LDAP service (port 389) without requiring authentication. By default, many Windows DCs allow anonymous binds to retrieve directory information such as user and group objects, making ldapsearch the most direct and appropriate choice for this task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
smbclient
Why it's wrong here
smbclient is a command-line utility used to interact with Server Message Block (SMB) network shares, primarily for accessing shared files and printers on Windows or Samba servers. It facilitates browsing, uploading, and downloading files, and managing shared resources. This tool operates exclusively within the SMB protocol domain and lacks the capability to query or enumerate objects from an LDAP (Lightweight Directory Access Protocol) directory service.
- ✓
ldapsearch
Why this is correct
ldapsearch is the correct tool because it is specifically designed for querying LDAP (Lightweight Directory Access Protocol) directories. It enables penetration testers to perform anonymous or authenticated queries to enumerate directory objects, including users, groups, and their associated attributes. This utility directly interacts with LDAP servers to retrieve the precise information required for user and group enumeration.
- ✗
snmpwalk
Why it's wrong here
snmpwalk is a network management tool used to query devices that implement the Simple Network Management Protocol (SNMP). Its primary function is to systematically traverse and retrieve information from a device's Management Information Base (MIB) tree, providing details about network interfaces, system uptime, and other operational statistics. snmpwalk is entirely unrelated to LDAP and cannot be used to enumerate users or groups from a directory service.
- ✗
enum4linux
Why it's wrong here
enum4linux is a powerful wrapper script specifically designed for enumerating information from Windows and Samba hosts using NetBIOS and SMB protocols. It leverages various underlying tools to extract details such as user lists, group memberships, share names, and operating system information. However, its functionality is strictly limited to SMB/NetBIOS enumeration and does not provide any capability to query or interact with LDAP directory services.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.