CEH Enumeration and System Hacking Practice Question
A security analyst uses the nbtstat -a command against a target IP address. What information is the analyst MOST likely attempting to retrieve?
⚠ Common exam trap
Test-takers frequently confuse nbtstat -a with retrieving only the MAC address, because the output does display a MAC address line, but the command's primary function is to enumerate the NetBIOS name table.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetBIOS name table of the remote machine
The nbtstat -a command is used to query the NetBIOS name table of a remote machine by its IP address. This table contains the NetBIOS names registered by the remote host, such as the computer name, workgroup/domain, and any services running over NetBIOS (e.g., file sharing). The analyst is most likely attempting to enumerate these names for reconnaissance or to identify potential targets for further exploitation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Active directory domain controllers
Why it's wrong here
The `nbtstat -a` command queries NetBIOS over TCP/IP (NBT) name tables and does not directly enumerate Active Directory domain controllers. While a domain controller might register NetBIOS names, `nbtstat` lacks the functionality to query specific Active Directory service records (SRV records) or LDAP information that uniquely identify a machine as a domain controller. Identifying domain controllers typically requires tools like `nslookup` to query DNS for `_ldap._tcp.dc._msdcs` records or direct LDAP queries.
- ✗
List of all open TCP ports
Why it's wrong here
The `nbtstat` utility is designed for diagnosing NetBIOS over TCP/IP issues and displaying NetBIOS name information, not for enumerating open TCP ports. It operates at the session/application layer, focusing on NetBIOS name resolution and statistics. Discovering open TCP ports requires port scanning tools like Nmap, which actively probe specific port numbers on a target host to determine their status, or using `netstat -an` to view local connections.
- ✓
NetBIOS name table of the remote machine
Why this is correct
The `nbtstat -a <IP_address>` command is specifically used to query and display the NetBIOS name table of a remote machine. This table contains a list of NetBIOS names registered by the target host, including unique names (e.g., workstation name, messenger service) and group names (e.g., domain/workgroup name), along with their associated types and registration status. This information is crucial for understanding the remote machine's NetBIOS identity and services.
- ✗
The MAC address of the target
Why it's wrong here
The `nbtstat -a` command provides NetBIOS name information and IP addresses, but it does not display the Media Access Control (MAC) address of the target. MAC addresses are hardware addresses found at the data link layer (Layer 2) of the OSI model. To obtain a MAC address, especially for devices on the local network segment, tools like `arp -a` (Address Resolution Protocol cache) or network sniffers are typically used, as `nbtstat` operates at a higher protocol layer.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.