CEH Enumeration and System Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Disable SNMP entirely

  Why it's wrong here

  Disabling SNMP entirely would indeed prevent any enumeration attempts, as the service would no longer be running on the device. However, SNMP is a critical protocol for network device monitoring and management, providing valuable operational insights into device status, performance, and configuration. Completely disabling it would severely impair an organization's ability to effectively manage and troubleshoot its network infrastructure, making it an impractical and often unacceptable solution for many environments where management functionality is essential.

• ✗

  Use SNMPv3 with encryption

  Why it's wrong here

  While SNMPv3 offers robust security features like authentication and encryption (privacy), the `snmpwalk v2c` command specifically targets SNMPv2c, which relies on community strings for access. Migrating to SNMPv3 would be a significant security upgrade, but it doesn't directly address the immediate vulnerability of using default or weak community strings in an existing SNMPv2c deployment. The most effective countermeasure for the *current* v2c enumeration attempt is to secure the v2c configuration itself, rather than implementing a different protocol version.

• ✓

  Change the default community string and restrict SNMP access to specific IPs

  Why this is correct

  Changing the default community string, such as 'public', immediately invalidates the attacker's current enumeration attempt, as they would no longer possess the correct credential for SNMPv2c access. Simultaneously, restricting SNMP access to specific, authorized IP addresses through Access Control Lists (ACLs) provides an additional layer of defense. This combination ensures that only trusted management stations can even attempt to communicate with the SNMP agent, significantly reducing the attack surface and preventing unauthorized information disclosure.

• ✗

  Block ICMP echo requests

  Why it's wrong here

  Blocking ICMP echo requests, commonly known as ping, is a network security measure primarily aimed at preventing network discovery or denial-of-service attacks that exploit ICMP. However, SNMP (Simple Network Management Protocol) operates over UDP ports 161 (agent) and 162 (manager), and its enumeration process is entirely independent of ICMP. Therefore, blocking ICMP echo requests would have no impact whatsoever on an attacker's ability to perform an `snmpwalk` operation against an SNMP agent.

Go deeper

Related to this question