CEH Enumeration and System Hacking Practice Question
A security analyst is investigating a potential SMB-based attack. They notice unusual traffic on port 445 from a host running `enum4linux`. Which of the following enumeration actions could `enum4linux` perform that would generate such traffic?
⚠ Common exam trap
It's easy for candidates to confuse enum4linux with a general-purpose scanning tool, but it is strictly an SMB enumeration utility that relies on SMB-specific RPC calls over port 445.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enumerating SMB shares and user accounts
enum4linux is a tool specifically designed for enumerating information from Windows and Samba systems via the SMB protocol (port 445). It can list SMB shares, retrieve user account lists, and gather other system details by querying the SMB service, which directly generates traffic on port 445.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Scanning for open ports on the target system
Why it's wrong here
Scanning for open ports on the target system is not the primary function of `enum4linux`. While `enum4linux` interacts with TCP port 445 for SMB services, it is a specialized SMB enumeration tool designed to extract specific information like user lists and share names, not to perform a comprehensive scan for all open ports. General port scanning across various protocols is typically accomplished with dedicated tools such as Nmap, which can identify a wide range of active services.
- ✓
Enumerating SMB shares and user accounts
Why this is correct
`enum4linux` is a dedicated Linux command-line utility specifically engineered to enumerate SMB (Server Message Block) information from Windows and Samba systems. It leverages the SMB protocol, primarily over TCP port 445, to gather critical intelligence such as user accounts, group memberships, available network shares, and password policies. This direct interaction with SMB services makes it the correct tool for detailed reconnaissance of SMB-based targets.
- ✗
Performing a DNS zone transfer
Why it's wrong here
A DNS zone transfer uses TCP port 53, not SMB port 445, so `enum4linux`—which specifically queries SMB services for user, share, and group listings—cannot generate traffic on port 445 by performing a zone transfer. This option tempts because `enum4linux` is often used for network reconnaissance, and DNS zone transfers are another enumeration technique that reveals domain records, but they operate on a completely different protocol and port.
- ✗
Querying SNMP MIB values using community strings
Why it's wrong here
Querying SNMP MIB values using community strings involves the Simple Network Management Protocol, which operates over UDP ports 161 (for agent requests) and 162 (for traps). `enum4linux` is an SMB enumeration tool and lacks the functionality to communicate with SNMP agents or interpret their Management Information Base (MIB) structures. Therefore, it cannot be used to query SNMP data, which requires specific SNMP client tools like `snmpwalk` or `snmpget`.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.