CEH Enumeration and System Hacking Practice Question
A security analyst runs `nbtstat -A 192.168.1.10` and receives output showing a table with names like COMPUTER<00>, COMPUTER<20>, and DOMAIN<1B>. What type of information has the analyst gathered?
⚠ Common exam trap
Watch out — candidates often confuse `nbtstat -A` with commands that enumerate SMB shares or DNS records, but the key differentiator is the NetBIOS name table output with hex suffixes that explicitly indicate service types.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetBIOS names and their associated service types
The `nbtstat -A` command performs a NetBIOS name table lookup against the target IP address using the NetBIOS over TCP/IP (NBT) protocol. The output displays NetBIOS names (e.g., COMPUTER<00>, COMPUTER<20>, DOMAIN<1B>) along with their associated service type suffixes (hex bytes), which identify the services running on the host, such as Workstation Service (<00>), Server Service (<20>), and Domain Master Browser (<1B>). This allows the analyst to enumerate the host's NetBIOS names and their corresponding service types.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NetBIOS names and their associated service types
Why this is correct
The `nbtstat -A` (or `-a`) command is specifically designed to query a remote host's NetBIOS name table, displaying the NetBIOS names registered by that host. Each NetBIOS name is 16 characters long, with the 16th character (the suffix) indicating the service or application type associated with that name, such as `<20>` for a file server or `<00>` for a workstation service. This allows an analyst to identify active NetBIOS services on the target IP address, providing crucial reconnaissance information.
- ✗
SMB share lists and open sessions
Why it's wrong here
While NetBIOS over TCP/IP (NBT) is a foundational protocol for SMB, the `nbtstat` command itself does not directly enumerate SMB share lists or active sessions. Instead, `nbtstat` provides the NetBIOS names registered by a host, which might *indicate* the presence of an SMB server (e.g., a `<20>` suffix). To list actual SMB shares and open sessions, dedicated tools like `smbclient`, `enum4linux`, or `CrackMapExec` are required, as they interact with the SMB protocol directly at a higher level.
- ✗
DNS records for the host and domain
Why it's wrong here
The `nbtstat` utility is specifically designed to work with NetBIOS over TCP/IP (NBT) for name resolution on local networks, not the Domain Name System (DNS). NetBIOS names are distinct from DNS hostnames and are resolved through different mechanisms, such as NetBIOS Name Service (NBNS) broadcasts or WINS servers. To query DNS records for a host or domain, tools like `nslookup` (for Windows) or `dig` (for Linux/Unix) are used, which interact with DNS servers to retrieve A records, MX records, NS records, and other DNS-specific information.
- ✗
ARP cache entries for the subnet
Why it's wrong here
The `nbtstat` command is used for querying NetBIOS name information, which operates at the session layer (Layer 5) and presentation layer (Layer 6) of the OSI model, relying on TCP/IP for transport. Address Resolution Protocol (ARP), however, operates at the data link layer (Layer 2) and is responsible for mapping IP addresses to MAC addresses on a local network segment. To view the ARP cache entries on a system, the `arp -a` command (or similar platform-specific commands) is used, not `nbtstat`, as their functions are entirely distinct.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.