CEH Enumeration and System Hacking Practice Question
A security analyst wants to enumerate all users from an SMTP server. Which of the following SMTP commands can be used for user enumeration?
⚠ Common exam trap
It's easy for candidates to confuse VRFY with EXPN or think that HELO or MAIL FROM can be abused for enumeration, but only VRFY directly queries the server for user existence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VRFY
The VRFY command is used in SMTP to verify whether a mailbox exists on the server. By issuing VRFY followed by a username, the server typically responds with a 250 code if the user exists or a 550 code if not, enabling user enumeration. This is a recognized technique in security assessments to discover valid email accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DATA
Why it's wrong here
The DATA command is used in SMTP to signal the start of the message content, including headers and body, after the sender and recipient have been successfully specified. It does not provide any mechanism to query the existence of user accounts on the server; its sole purpose is to transmit the actual email data for delivery to already validated recipients. Therefore, attempting to enumerate users with DATA would be ineffective as it operates at a later stage of the email transmission process.
- ✗
MAIL FROM
Why it's wrong here
The MAIL FROM command is an essential part of the SMTP conversation, used to specify the sender's email address to the server. Its primary function is to identify the origin of the message for delivery and bounce-back purposes, not to query or validate recipient accounts. While a valid sender is required to proceed with email transmission, this command offers no direct means to enumerate potential users on the target system.
- ✗
HELO
Why it's wrong here
The HELO (or EHLO for Extended HELO) command initiates an SMTP conversation, identifying the client's hostname to the server. This initial handshake establishes the communication session and allows the client to declare its capabilities, but it does not involve any querying of user accounts or mailboxes. Its role is purely foundational for the connection, making it unsuitable for user enumeration attempts.
- ✓
VRFY
Why this is correct
The VRFY (Verify) command is specifically designed to query an SMTP server to determine if a particular mailbox or user exists on the system. When provided with a username or email address, the server typically responds with information indicating whether the user is valid, often including their full name or a success code. This direct validation capability makes VRFY a highly effective tool for enumerating valid user accounts on an SMTP server, which is precisely what the security analyst aims to achieve.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.