CEH Enumeration and System Hacking Practice Question
A security analyst runs the command `nbtstat -A 192.168.1.50` in a Windows environment. What information is the analyst attempting to retrieve?
⚠ Common exam trap
Candidates often confuse `nbtstat -A` (remote NetBIOS table) with `nbtstat -a` (local NetBIOS table) or with `netstat`, leading candidates to mistakenly choose active connections or routing information.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetBIOS names and services of the remote system
The `nbtstat -A` command queries the NetBIOS name table of a remote system by its IP address. NetBIOS over TCP/IP (NBT) maintains a table of names and services (e.g., workstation, server, messenger) that the remote host has registered. This is a classic enumeration technique to discover shares, logged-in users, and other NetBIOS resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The current routing table on the host
Why it's wrong here
The `nbtstat -a` command is specifically designed to query NetBIOS over TCP/IP (NetBT) information from a remote host. It does not interact with the operating system's IP routing mechanisms or display network topology. To view the local host's routing table, which details the paths packets take to reach various destinations based on their IP addresses, the correct command would be `route print` or `netstat -r` on Windows systems.
- ✗
Active network connections and listening ports
Why it's wrong here
The `nbtstat -a` command focuses solely on retrieving NetBIOS name table information and registered services from a specified IP address. It does not provide details about active TCP or UDP connections, nor does it list ports currently in a listening state on the system. For that comprehensive network connection and port status, including foreign addresses and process IDs, the `netstat` command, often with flags like `-an` or `-ano`, is the appropriate tool.
- ✗
DNS records for the host
Why it's wrong here
The `nbtstat -a` command is specifically engineered to query NetBIOS name services, which operate at a different layer and use a distinct naming resolution system compared to the Domain Name System (DNS). It will not retrieve DNS records such as A (address), MX (mail exchange), or NS (name server) records associated with a host. To query DNS records for a given host or domain, tools like `nslookup` or `dig` are the correct utilities.
- ✓
NetBIOS names and services of the remote system
Why this is correct
The `nbtstat -a 192.168.1.50` command correctly utilizes the `-a` (adapter status) flag to query the NetBIOS name table of the remote host at the specified IP address. This command enumerates the NetBIOS names registered by that system, including unique names, group names, and the services running on it, often revealing the computer name, workgroup/domain, and even the MAC address. This information is crucial for understanding the NetBIOS identity of a remote machine on the network.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst runs `nbtstat -A 192.168.1.50` from a Windows command prompt and receives output showing a table with names like 'WORKGROUP<00>', 'PC01<20>', and 'USER<03>'. What is the MOST likely purpose of this command?
medium- A.Perform a reverse DNS lookup
- ✓ B.Display the NetBIOS name table of the remote host
- C.Test connectivity to the remote host using ICMP
- D.Enumerate DNS records for the domain
Why B: The `nbtstat -A` command performs a NetBIOS name table lookup against a remote host using its IP address. The output shows NetBIOS names and their associated suffixes (e.g., <00> for Workstation service, <20> for File Server service, <03> for Messenger service), which are used for NetBIOS over TCP/IP (NBT) name resolution and service discovery. This is the correct purpose because the command specifically queries the remote host's NetBIOS name table, not DNS or ICMP.
Variation 2. A security analyst runs the command `nbtstat -A 192.168.1.105` on a Windows machine. What information is the analyst most likely trying to gather?
easy- ✓ A.The NetBIOS name table and MAC address of the remote host
- B.The LDAP directory structure of the domain
- C.The SNMP community strings of the target
- D.The SMB shares available on the remote host
Why A: The `nbtstat -A` command performs a NetBIOS name table lookup against the specified IP address using the NetBIOS over TCP/IP (NBT) protocol. It returns the remote host's NetBIOS name table, which includes registered names and services, along with the MAC address of the network adapter. This is a standard enumeration technique to identify the hostname, logged-in user, and other NetBIOS-related information.
Variation 3. A security analyst runs the command: nbtstat -A 192.168.1.10. The output shows the table of names for the remote machine. Which of the following is the MOST likely purpose of this command?
medium- A.To perform a DNS zone transfer
- B.To enumerate SNMP community strings on the remote host
- ✓ C.To enumerate NetBIOS names and services on the remote host
- D.To enumerate SMB shares on the remote host
Why C: The `nbtstat -A` command performs a NetBIOS name table lookup against a remote IP address, displaying the registered NetBIOS names and their associated service types (e.g., workstation, server, messenger). This is a core technique for NetBIOS enumeration, which reveals the remote host's computer name, logged-in user, and running NetBIOS services, making option C correct.
Variation 4. A security analyst runs `nbtstat -A 192.168.1.10` and receives a response with the computer name, logged-in user, and domain. Which protocol is being queried?
easy- ✓ A.NetBIOS
- B.SNMP
- C.LDAP
- D.SMTP
Why A: The `nbtstat -A` command performs a NetBIOS name service query (NBNS) against the target IP address using UDP port 137. It retrieves the NetBIOS name table, which includes the computer name, logged-in user, and domain membership, directly from the NetBIOS over TCP/IP (NetBT) protocol stack.
Variation 5. A security analyst runs 'nbtstat -A 192.168.1.105' and sees a table with the computer name 'FILESERVER' and a logged-in user 'admin'. Which of the following BEST describes the purpose of this command?
medium- A.Perform an SNMP walk to enumerate the remote host's MIB
- B.Execute a dictionary attack against the remote host's passwords
- C.Enumerate all SMB shares on the remote host
- ✓ D.Perform a NetBIOS name table lookup of the remote host
Why D: The command 'nbtstat -A' performs a NetBIOS name table lookup against a remote host using its IP address. It queries the NetBIOS over TCP/IP (NBT) service on UDP port 137 to retrieve the remote machine's NetBIOS name table, which includes the computer name and logged-in user. This is a standard enumeration technique to gather information about Windows hosts on a local network.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.