CEH Enumeration and System Hacking Practice Question
A security engineer runs SNMPwalk on a network device and receives community strings as 'public' and 'private'. What is the PRIMARY concern?
⚠ Common exam trap
EC-Council often tests the distinction between 'default credentials' and 'exploitation vectors'—candidates mistakenly associate 'public/private' with encryption or malware, when the real risk is unauthorized information disclosure via SNMP enumeration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The device may be exposing sensitive configuration information
The SNMP community strings 'public' and 'private' are default read-only and read-write credentials defined in SNMPv1 and SNMPv2c. An attacker who can SNMPwalk the device with these strings can enumerate the entire MIB tree, including system configuration, routing tables, interface details, and user accounts. This directly exposes sensitive configuration information, making C the primary concern.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The device is vulnerable to buffer overflow attacks
Why it's wrong here
SNMPwalk is a diagnostic tool designed to query and retrieve information from a device's Management Information Base (MIB). Its successful execution indicates a responsive SNMP agent, not necessarily a memory corruption vulnerability. Buffer overflow attacks typically involve crafted input designed to overwrite memory, which is distinct from the read-only information gathering performed by snmpwalk.
- ✗
The device is infected with malware
Why it's wrong here
A successful snmpwalk operation simply confirms that the SNMP service is active and responding to queries, which is a normal operational state for many network devices. This activity provides no direct evidence of malicious software presence, unusual process execution, or unauthorized system modifications typically associated with malware infection. Detecting malware requires different forensic techniques or security monitoring tools.
- ✓
The device may be exposing sensitive configuration information
Why this is correct
When an snmpwalk command successfully retrieves data using common or default community strings, it signifies that the device's SNMP agent is configured insecurely. This allows an attacker to access extensive Management Information Base (MIB) data, which frequently includes critical system details, network interface configurations, routing tables, and even potentially sensitive user account information. Such information leakage provides valuable reconnaissance for further targeted attacks.
- ✗
The device is using outdated encryption protocols
Why it's wrong here
SNMPv1 and SNMPv2c, which are typically exploited by snmpwalk using community strings, do not incorporate any form of encryption for the data transmitted. These versions rely solely on plaintext community strings for basic access control, offering no confidentiality protection against eavesdropping. Therefore, the issue is a complete absence of encryption, rather than the use of outdated cryptographic protocols.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.