CEH Enumeration and System Hacking Practice Question
A security analyst runs the command `nbtstat -A 192.168.1.105` on a Windows machine. What information is the analyst most likely trying to gather?
⚠ Common exam trap
Many candidates confuse `nbtstat -A` with `net view` or `nbtstat -a`, mistakenly thinking it lists SMB shares or uses a hostname instead of an IP address, when in fact `-A` specifically targets a remote IP and returns the NetBIOS name table and MAC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NetBIOS name table and MAC address of the remote host
The `nbtstat -A` command performs a NetBIOS name table lookup against the specified IP address using the NetBIOS over TCP/IP (NBT) protocol. It returns the remote host's NetBIOS name table, which includes registered names and services, along with the MAC address of the network adapter. This is a standard enumeration technique to identify the hostname, logged-in user, and other NetBIOS-related information.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The NetBIOS name table and MAC address of the remote host
Why this is correct
The `nbtstat -a` (or `-A`) command is specifically designed to display the NetBIOS name table of a remote computer, identified by its IP address. This table includes registered NetBIOS names, their types, and crucially, the MAC address associated with the network interface. It provides valuable information for identifying systems and services relying on NetBIOS over TCP/IP, making it a direct and effective reconnaissance tool for this protocol.
- ✗
The LDAP directory structure of the domain
Why it's wrong here
The `nbtstat` utility is designed for NetBIOS over TCP/IP diagnostics and cannot interact with Lightweight Directory Access Protocol (LDAP) services. LDAP directory structures, which store organizational and user information, require specialized client tools like `ldapsearch` on Linux or graphical interfaces such as AD Explorer for Windows Active Directory environments. Attempting to enumerate LDAP with `nbtstat` would yield no relevant information, as it operates on a different protocol stack.
- ✗
The SNMP community strings of the target
Why it's wrong here
Simple Network Management Protocol (SNMP) community strings are credentials used to access management information bases (MIBs) on network devices. The `nbtstat` command is entirely unrelated to SNMP and lacks the functionality to query or discover these strings, as it focuses solely on NetBIOS statistics. Tools such as `snmpwalk`, `snmp-check`, or `onesixtyone` are specifically engineered to enumerate SNMP community strings and retrieve MIB data from target devices.
- ✗
The SMB shares available on the remote host
Why it's wrong here
Server Message Block (SMB) shares are network file and printer sharing resources provided by Windows systems. The `nbtstat` command is limited to NetBIOS name resolution and statistics, offering no capability to list or interact with SMB shares directly. Enumerating available SMB shares requires dedicated tools like `smbclient` on Linux, `enum4linux`, or `CrackMapExec`, which actively query the SMB service for share information, often running on TCP port 445.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.