CEH Enumeration and System Hacking Practice Question
A security analyst runs `nbtstat -A 192.168.1.10` and receives a response with the computer name, logged-in user, and domain. Which protocol is being queried?
⚠ Common exam trap
Many candidates confuse `nbtstat -A` (which queries NetBIOS over TCP/IP) with `nbtstat -a` (which queries by name) or assume it uses a different protocol like SMB, but the command specifically targets the NetBIOS name service on UDP 137.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetBIOS
The `nbtstat -A` command performs a NetBIOS name service query (NBNS) against the target IP address using UDP port 137. It retrieves the NetBIOS name table, which includes the computer name, logged-in user, and domain membership, directly from the NetBIOS over TCP/IP (NetBT) protocol stack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NetBIOS
Why this is correct
The `nbtstat` command is a dedicated utility for querying NetBIOS over TCP/IP (NetBT) information, which provides name resolution and session services for legacy Windows networking components. When an analyst runs `nbtstat -a <IP_address>`, it specifically attempts to retrieve the NetBIOS name table from the specified remote host. This command directly interacts with the NetBIOS protocol to gather details like registered names and MAC addresses, making NetBIOS the correct answer.
- ✗
SNMP
Why it's wrong here
Simple Network Management Protocol (SNMP) is used for monitoring and managing network devices, collecting data such as device status, network traffic, and error rates. It operates on distinct UDP ports (161 for agents, 162 for managers) and uses Management Information Bases (MIBs) to structure data. The `nbtstat` utility is entirely unrelated to SNMP and cannot be used to query or interact with SNMP agents or retrieve SNMP-specific data.
- ✗
LDAP
Why it's wrong here
Lightweight Directory Access Protocol (LDAP) is an application protocol for accessing and maintaining distributed directory information services, commonly used for user authentication and storing organizational data. It typically runs over TCP port 389 or 636 (LDAPS) and uses a hierarchical structure for data storage. `nbtstat` is a NetBIOS utility and possesses no functionality to query or interact with an LDAP directory server, as their purposes and underlying mechanisms are distinct.
- ✗
SMTP
Why it's wrong here
Simple Mail Transfer Protocol (SMTP) is the standard protocol for sending email across IP networks, facilitating communication between mail servers and clients for message delivery. It primarily operates on TCP port 25 for unencrypted mail transfer and port 587 for client submission. The `nbtstat` command is designed exclusively for NetBIOS information retrieval and has no connection to email services or SMTP operations, making it an incorrect association.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.