CEH Enumeration and System Hacking Practice Question
A security analyst runs 'nbtstat -A 192.168.1.10' and receives a table showing the machine name and a list of names registered. Which service is being enumerated?
⚠ Common exam trap
Test-takers frequently confuse the nbtstat command with other enumeration tools, mistakenly thinking it queries SNMP or LDAP because those services also reveal system information, but nbtstat is exclusively a NetBIOS enumeration command.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetBIOS
The 'nbtstat -A' command performs a NetBIOS name table lookup against a remote IP address using the NetBIOS over TCP/IP (NBT) protocol. It queries the target's NetBIOS name service (UDP port 137) and returns the registered names, including the machine name, workgroup/domain, and logged-in users. This directly enumerates the NetBIOS service, making D the correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SNMP
Why it's wrong here
SNMP (Simple Network Management Protocol) is used for managing and monitoring network devices and their functions, often querying Management Information Base (MIB) data. Enumeration of SNMP typically involves using specialized tools like snmpwalk or snmpget, which communicate over UDP ports 161/162 to retrieve device configuration and status. The `nbtstat` command, however, is designed to query NetBIOS over TCP/IP (NBT) name tables and has no functionality for interacting with SNMP agents or MIBs.
- ✗
LDAP
Why it's wrong here
LDAP (Lightweight Directory Access Protocol) is primarily used for accessing and maintaining distributed directory information services, such as user accounts, groups, and network resources within an organization. Enumeration of LDAP directories is performed using specific client tools like `ldapsearch` or `adfind`, which interact with LDAP servers, typically on TCP ports 389 or 636 (LDAPS). The `nbtstat` utility does not interact with LDAP services; its function is solely related to NetBIOS name resolution and status, making it irrelevant for LDAP enumeration.
- ✗
SMTP
Why it's wrong here
SMTP (Simple Mail Transfer Protocol) is the standard protocol for sending and receiving email messages between mail servers, typically operating on TCP port 25. SMTP enumeration involves directly interacting with an SMTP server to identify valid user accounts, often using commands such as `VRFY`, `EXPN`, or `RCPT TO` to test for existing mailboxes. The `nbtstat` command has no functionality related to email protocols or SMTP server interaction; it operates at a different network layer to query NetBIOS information, not mail server details.
- ✓
NetBIOS
Why this is correct
The `nbtstat` command is a dedicated utility for diagnosing and troubleshooting NetBIOS over TCP/IP (NBT) name resolution issues and displaying NetBIOS name table information. When executed with the `-a` (adapter status) or `-A` (adapter status by IP address) switch followed by an IP address, `nbtstat` queries the remote machine for its NetBIOS name table. This process reveals registered names, services, and often MAC addresses, directly constituting NetBIOS enumeration and making it the correct answer.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.