CEH Enumeration and System Hacking Practice Question
A security analyst runs the command: nbtstat -A 192.168.1.10. The output shows the table of names for the remote machine. Which of the following is the MOST likely purpose of this command?
⚠ Common exam trap
Many exam-takers confuse `nbtstat -A` (NetBIOS name table enumeration) with SMB share enumeration (`net view` or `smbclient`), because both are associated with Windows file sharing, but they operate at different protocol layers and serve distinct enumeration purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To enumerate NetBIOS names and services on the remote host
The `nbtstat -A` command performs a NetBIOS name table lookup against a remote IP address, displaying the registered NetBIOS names and their associated service types (e.g., workstation, server, messenger). This is a core technique for NetBIOS enumeration, which reveals the remote host's computer name, logged-in user, and running NetBIOS services, making option C correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To perform a DNS zone transfer
Why it's wrong here
The `nbtstat` utility is designed for NetBIOS over TCP/IP (NBT) statistics and name resolution, not for DNS operations. Performing a DNS zone transfer involves querying a DNS server to retrieve a copy of its entire zone file, which is typically accomplished using DNS-specific tools like `dig` with the `AXFR` query type (e.g., `dig @<nameserver> <domain> AXFR`) or `nslookup` in non-interactive mode with `set type=any`.
- ✗
To enumerate SNMP community strings on the remote host
Why it's wrong here
The `nbtstat` command operates at the NetBIOS layer, which is distinct from the Simple Network Management Protocol (SNMP). Enumerating SNMP community strings requires interacting with the SNMP agent, typically listening on UDP port 161, by sending specific SNMP GET requests. Tools such as `snmpwalk`, `snmp-check`, or `onesixtyone` are designed for this purpose, attempting to guess or brute-force common community strings like 'public' or 'private' to gain access to device information.
- ✓
To enumerate NetBIOS names and services on the remote host
Why this is correct
The command `nbtstat -a 192.168.1.10` (or `-A` for adapter status) is precisely used to query the NetBIOS name table of a remote host. This query retrieves a list of NetBIOS names registered by the target machine, including the computer name, workgroup/domain name, and services like the Messenger service or File and Print Sharing, along with their associated types and status. This provides valuable information about the remote system's identity and active NetBIOS services.
- ✗
To enumerate SMB shares on the remote host
Why it's wrong here
While Server Message Block (SMB) can operate over NetBIOS, `nbtstat` specifically queries the NetBIOS name service for registered names, not the actual SMB shares themselves. To enumerate SMB shares on a remote host, one would use dedicated tools that interact directly with the SMB protocol, such as `smbclient` (e.g., `smbclient -L //192.168.1.10/ -N`) or `enum4linux`, which can list available shares, users, and groups by communicating with the SMB service on TCP port 445 or NetBIOS over TCP port 139.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.