CEH Enumeration and System Hacking Practice Question

A tester runs 'snmpwalk -v2c -c public 192.168.1.1' and receives a large amount of system information. What does this command do?

⚠ Common exam trap

Test-takers frequently confuse `snmpwalk` with a brute-force tool or think it can modify SNMP values, but the command strictly performs read-only enumeration using the specified community string.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It walks the SNMP MIB tree using version 2c and the public community string.

The `snmpwalk` command is used to retrieve a subtree of management values from an SNMP agent. The `-v2c` flag specifies SNMP version 2c, which uses community-based security, and `-c public` provides the community string 'public' (often the default read-only community). The command walks the entire MIB tree starting from the root, returning all available OID values, which explains the large amount of system information received.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
It walks the SNMP MIB tree using version 2c and the public community string.
Why this is correct
The `snmpwalk` command is specifically designed to query a network device and retrieve all information available within its Management Information Base (MIB) tree, starting from a specified OID (or the root if none is given). The `v2c` flag explicitly dictates the use of SNMP version 2c, which offers improved security and data types over v1. The `c public` argument specifies "public" as the community string, acting as a password for read-only access to the device's SNMP agent at IP address 192.168.1.1. This effectively performs a comprehensive enumeration of the device's configuration and status.
✗
It performs a brute-force attack on SNMP community strings.
Why it's wrong here
This statement is incorrect because `snmpwalk` is a diagnostic and enumeration tool, not a brute-forcing utility. While it requires a community string to operate, it does not attempt multiple strings in an automated fashion to discover a valid one. A brute-force attack, by definition, involves systematically trying numerous potential community strings from a list or dictionary until a successful authentication occurs, a task typically performed by specialized tools such as `onesixtyone` or `nmap` scripts.
✗
It enumerates users on a Windows domain.
Why it's wrong here
This is incorrect because SNMP, even when successfully queried, primarily provides information about the network device itself, such as system uptime, network interfaces, running processes, and installed software. While it might reveal local user accounts on a specific machine through certain MIBs, it does not inherently enumerate users within an entire Windows domain. Domain user enumeration typically requires protocols like SMB/CIFS, LDAP, or specific Active Directory queries, which are outside the scope of SNMP's capabilities.
✗
It sets SNMP values using the private community string.
Why it's wrong here
This statement is false because the `snmpwalk` command is exclusively used for retrieving (reading) information from an SNMP agent, traversing the MIB tree to collect data. It does not possess the functionality to modify or set any values on the target device. To perform write operations, such as changing configuration parameters or device settings via SNMP, a different utility like `snmpset` would be required, and it would typically necessitate a write-enabled community string, often "private," for authentication.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question