CEH Enumeration and System Hacking Practice Question
A security analyst runs `ldapsearch -x -h 10.0.0.3 -b "dc=company,dc=com"` and receives a large number of entries including user objects. What type of information is being collected?
⚠ Common exam trap
Test-takers frequently confuse LDAP enumeration with other network discovery protocols (SMB, SNMP, NetBIOS) because all are used in the enumeration phase, but each uses distinct commands and ports—LDAP specifically targets directory services, not file shares or network device management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Active Directory users and attributes
The `ldapsearch` command with the `-x` flag (simple authentication) and `-b` base DN `"dc=company,dc=com"` performs an LDAP query against the specified server (10.0.0.3). LDAP is the protocol used to query and retrieve directory services, and in a Windows environment, Active Directory exposes user objects, groups, and their attributes via LDAP. Therefore, the output contains Active Directory users and their associated attributes, making D correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SMB share listings
Why it's wrong here
The ldapsearch command is a client utility for querying Lightweight Directory Access Protocol (LDAP) directories, not for interacting with Server Message Block (SMB) services. Enumerating SMB share listings typically involves tools like smbclient or enum4linux, which directly communicate over TCP ports 139 or 445 to list available network shares on Windows systems. Therefore, ldapsearch would not yield SMB share information.
- ✗
SNMP MIB values
Why it's wrong here
ldapsearch is exclusively used for querying LDAP directories, which store structured information like user accounts and network resources. Simple Network Management Protocol (SNMP) Management Information Base (MIB) values, conversely, are retrieved using tools such as snmpwalk or snmpget. These tools interact with SNMP agents on network devices to gather operational data, a function entirely separate from LDAP directory services.
- ✗
NetBIOS names and MAC addresses
Why it's wrong here
The ldapsearch command queries LDAP directories for objects and their attributes, which is distinct from NetBIOS enumeration. NetBIOS names and associated MAC addresses are typically discovered using utilities like nbtstat or nmblookup, which operate on the NetBIOS over TCP/IP (NBT) protocol. LDAP does not provide a mechanism to directly resolve or list NetBIOS names or their corresponding hardware addresses.
- ✓
Active Directory users and attributes
Why this is correct
The ldapsearch command is the primary utility for querying LDAP-compliant directories, including Microsoft Active Directory. The provided syntax ldapsearch -x -h 10.0.0.3 -b dc=co specifically targets an LDAP server at IP 10.0.0.3 for anonymous (simple) bind, searching within the base distinguished name dc=co. This operation is precisely how security analysts enumerate Active Directory users, groups, computers, and their associated attributes, making it the correct method for this task.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.