CEH Enumeration and System Hacking Practice Question
A security analyst runs 'nbtstat -A 192.168.1.105' and sees a table with the computer name 'FILESERVER' and a logged-in user 'admin'. Which of the following BEST describes the purpose of this command?
⚠ Common exam trap
It's easy for candidates to confuse the 'nbtstat' command with SMB enumeration tools, but 'nbtstat' only reveals NetBIOS names and logged-in users, not shares or passwords.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a NetBIOS name table lookup of the remote host
The command 'nbtstat -A' performs a NetBIOS name table lookup against a remote host using its IP address. It queries the NetBIOS over TCP/IP (NBT) service on UDP port 137 to retrieve the remote machine's NetBIOS name table, which includes the computer name and logged-in user. This is a standard enumeration technique to gather information about Windows hosts on a local network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform an SNMP walk to enumerate the remote host's MIB
Why it's wrong here
The `nbtstat` utility is designed for NetBIOS over TCP/IP diagnostics, specifically for name resolution and statistics. In contrast, an SNMP walk, which enumerates a remote host's Management Information Base (MIB) to gather system configuration and status, is performed using dedicated SNMP tools like `snmpwalk`. These are entirely different protocols and command-line utilities, serving distinct purposes in network reconnaissance.
- ✗
Execute a dictionary attack against the remote host's passwords
Why it's wrong here
`nbtstat` is a network diagnostic tool focused on NetBIOS name resolution and cache management. It provides information about registered NetBIOS names and their associated IP addresses. It does not possess any functionality to attempt authentication, brute-force credentials, or execute dictionary attacks against remote host passwords, which requires specialized cracking tools such as Hydra or Medusa.
- ✗
Enumerate all SMB shares on the remote host
Why it's wrong here
While NetBIOS can be a foundational layer for Server Message Block (SMB) communication, `nbtstat` itself is not designed to enumerate SMB shares. Its primary function is to display NetBIOS name tables and statistics. To discover and list available SMB shares on a remote host, an analyst would typically use tools like `smbclient`, `enum4linux`, or `nmap` scripts specifically tailored for SMB enumeration.
- ✓
Perform a NetBIOS name table lookup of the remote host
Why this is correct
The `nbtstat -a <IP_address>` (or `-A`) command is precisely used to perform a NetBIOS name table lookup of a remote host. This command queries the specified IP address for its registered NetBIOS names, which can reveal crucial information such as the computer's hostname, workgroup or domain membership, and potentially the username of the currently logged-on user, aiding in initial reconnaissance.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.