CEH Enumeration and System Hacking Practice Question
A security analyst observes repeated log entries showing `EXPN` commands from an external IP address to the company's mail server. What is the MOST likely objective of this activity?
⚠ Common exam trap
Candidates often confuse `EXPN` with `VRFY` (which verifies a single user) or assume any SMTP command is part of an attack delivery mechanism, rather than recognizing it as a reconnaissance technique for user enumeration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enumerating valid email addresses and mailing list members
The `EXPN` command is part of the SMTP protocol (RFC 5321) and is used to expand a mailing list or alias, revealing the individual email addresses that belong to it. By repeatedly issuing `EXPN` commands, an attacker can enumerate valid email addresses and mailing list members, which is a reconnaissance technique for gathering targets for phishing or social engineering. This aligns with the enumeration phase of system hacking, where the goal is to extract user and service information.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Testing SMTP authentication mechanisms
Why it's wrong here
Authentication in SMTP typically involves the `AUTH` command, followed by a specific mechanism like PLAIN or LOGIN, to verify user credentials before allowing mail submission. The `EXPN` command, however, is designed solely to request the expansion of mailing lists or aliases into their constituent addresses and does not facilitate any form of credential exchange or verification, making it entirely unrelated to testing authentication mechanisms.
- ✗
Attempting to perform a denial-of-service attack
Why it's wrong here
While some SMTP commands can be exploited for denial-of-service (DoS) attacks, such as sending excessively large messages or exploiting resource-intensive operations, the `EXPN` command itself is a lightweight query. Its function is to return a list of addresses, which does not inherently consume significant server resources in a manner that would lead to a DoS condition, nor is it typically used in high-volume, repetitive attacks for that purpose.
- ✓
Enumerating valid email addresses and mailing list members
Why this is correct
The `EXPN` (Expand) command in SMTP is specifically designed to request the server to return the actual delivery addresses for a given mailing list, alias, or even a single user. By issuing `EXPN <address>`, a security analyst or attacker can determine if an address is valid and, if it represents a list or alias, retrieve all the individual email addresses associated with it, aiding in reconnaissance and target identification.
- ✗
Delivering spam emails through open relay
Why it's wrong here
Delivering spam emails, especially through an open relay, primarily involves a sequence of SMTP commands including `MAIL FROM`, `RCPT TO`, and `DATA` to specify the sender, recipient, and the actual message content, respectively. The `EXPN` command merely queries for address expansion and does not facilitate the actual transmission or delivery of email messages, making it unsuitable for sending spam.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.