CEH Enumeration and System Hacking Practice Question
A security analyst runs `nbtstat -A 192.168.1.50` from a Windows command prompt and receives output showing a table with names like 'WORKGROUP<00>', 'PC01<20>', and 'USER<03>'. What is the MOST likely purpose of this command?
⚠ Common exam trap
It's easy for candidates to confuse `nbtstat -A` with DNS-related commands or ICMP-based tools, because they see an IP address in the command and assume it is performing a reverse lookup or connectivity test, rather than recognizing it as a NetBIOS-specific enumeration technique.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Display the NetBIOS name table of the remote host
The `nbtstat -A` command performs a NetBIOS name table lookup against a remote host using its IP address. The output shows NetBIOS names and their associated suffixes (e.g., <00> for Workstation service, <20> for File Server service, <03> for Messenger service), which are used for NetBIOS over TCP/IP (NBT) name resolution and service discovery. This is the correct purpose because the command specifically queries the remote host's NetBIOS name table, not DNS or ICMP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform a reverse DNS lookup
Why it's wrong here
The `nbtstat` command is specifically designed for NetBIOS over TCP/IP (NetBT) statistics and name resolution, not for DNS operations. Performing a reverse DNS lookup, which involves resolving an IP address to a hostname, is a function of the Domain Name System. This task is typically accomplished using DNS-specific tools like `nslookup` with the `-x` option or `dig -x`, which query DNS servers directly.
- ✓
Display the NetBIOS name table of the remote host
Why this is correct
The `nbtstat -a <IP_address>` command is precisely used to display the NetBIOS name table of a remote host identified by its IP address. This utility queries the specified remote machine directly to retrieve the NetBIOS names it has registered, including its computer name, workgroup or domain name, and any services actively listening for NetBIOS connections. This functionality directly matches the described action of querying a remote host's NetBIOS name table.
- ✗
Test connectivity to the remote host using ICMP
Why it's wrong here
Testing network connectivity to a remote host using ICMP (Internet Control Message Protocol) echo requests and replies is the primary function of the `ping` utility. While `nbtstat` interacts over the network, its purpose is focused on NetBIOS name resolution and statistics, not on sending ICMP packets to determine general IP-level reachability. Therefore, `nbtstat` does not perform the diagnostic function of testing basic network connectivity via ICMP.
- ✗
Enumerate DNS records for the domain
Why it's wrong here
The `nbtstat` command-line utility is dedicated to troubleshooting NetBIOS name resolution issues and displaying NetBIOS over TCP/IP (NetBT) statistics. It operates exclusively within the NetBIOS naming system, which is distinct from the Domain Name System (DNS). Enumerating DNS records for a domain, such as A, MX, or NS records, requires DNS-specific tools like `nslookup`, `dig`, or `host`, which are designed to query DNS servers directly for domain information.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.