CEH Enumeration and System Hacking Practice Question
An analyst detects an SMB enumeration attempt in network logs. Which of the following tools would MOST likely generate such traffic?
⚠ Common exam trap
It's easy for candidates to confuse tools that scan ports (nmap) with tools that perform protocol-specific enumeration, leading them to choose nmap because it is a common scanning tool, but it does not generate SMB enumeration traffic itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
enum4linux 192.168.1.1
enum4linux is a tool specifically designed to enumerate SMB (Server Message Block) shares, users, and other information from Windows systems using the SMB protocol. The analyst detected SMB enumeration traffic, which is exactly what enum4linux generates by querying NetBIOS and SMB services (ports 139 and 445).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
nmap -sT 192.168.1.1
Why it's wrong here
Nmap's primary function is port scanning and service detection. While it can identify an open SMB port (e.g., 445/TCP) and even run NSE scripts for basic SMB info, `nmap -sT` specifically performs a TCP connect scan. This scan only confirms the port's status (open, closed, filtered), not detailed enumeration of shares, users, or groups. It lacks the dedicated SMB-specific queries that a specialized enumeration tool would execute to gather comprehensive information.
- ✓
enum4linux 192.168.1.1
Why this is correct
`enum4linux` is a wrapper script designed specifically for enumerating information from Windows and Samba hosts via NetBIOS and SMB. It leverages underlying tools like `rpcclient`, `net`, and `nmblookup` to extract a wide array of details. This includes user lists, group memberships, share names, password policies, and operating system information, making it highly effective for comprehensive SMB enumeration attempts.
- ✗
snmpwalk -v 2c 192.168.1.1
Why it's wrong here
`snmpwalk` is a command-line tool used to query devices that support the Simple Network Management Protocol (SNMP). The `-v 2c` flag specifies SNMP version 2c, and it retrieves information by traversing the Management Information Base (MIB) tree. This tool is entirely unrelated to the Server Message Block (SMB) protocol and cannot perform SMB enumeration, as its functionality is confined to querying SNMP-enabled services and their specific data structures.
- ✗
ldapsearch -h 192.168.1.1
Why it's wrong here
`ldapsearch` is a utility specifically designed for querying Lightweight Directory Access Protocol (LDAP) directories, such as Microsoft Active Directory. The `-h` flag specifies the host to connect to, and it retrieves directory information like user accounts, groups, and organizational units. It operates on a completely different protocol and port (typically 389 or 636) than SMB, rendering it ineffective for detecting or performing SMB enumeration attempts.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.