CEH Enumeration and System Hacking Practice Question
An attacker attempts to enumerate valid email users by connecting to an SMTP server and issuing the following commands: EHLO example.com, VRFY root, VRFY admin, VRFY user1. Which SMTP enumeration technique is being used?
⚠ Common exam trap
Watch out — candidates often confuse VRFY with EXPN, thinking both verify users, but EXPN expands aliases/groups while VRFY checks individual mailboxes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VRFY
The VRFY command is specifically designed to verify whether a mailbox exists on an SMTP server. By issuing VRFY followed by usernames (root, admin, user1), the attacker can enumerate valid email users based on the server's responses (e.g., 250 or 251 for valid, 550 for invalid). This is a classic SMTP user enumeration technique.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RCPT TO
Why it's wrong here
The RCPT TO command is used within an active SMTP mail transaction to specify the intended recipient of the email. While a server might accept a RCPT TO for a non-existent user initially, it does not provide immediate, definitive feedback on user existence at the command level, as the actual delivery failure occurs later. Therefore, it is not a direct or reliable method for real-time user enumeration compared to dedicated verification commands.
- ✗
MAIL FROM
Why it's wrong here
The MAIL FROM command initiates the mail transfer sequence, declaring the sender's email address for the current message. Its sole purpose is to identify the origin of the email, not to query the existence of a recipient mailbox on the server. This command precedes any recipient specification and offers no mechanism to verify potential target users.
- ✗
EXPN
Why it's wrong here
The EXPN (Expand) command requests the SMTP server to return the actual membership of a mailing list or alias. While it can reveal multiple valid user accounts if the target is a list, its function is specifically to expand predefined groups, not to verify the existence of an arbitrary, individual user account. It is not designed for direct, single-user enumeration.
- ✓
VRFY
Why this is correct
The VRFY (Verify) command is an SMTP instruction specifically designed to query the mail server about the existence and validity of a particular mailbox name. A compliant server will respond by either confirming the user's full name and mailbox, or by indicating that the user does not exist. This direct feedback mechanism makes VRFY an ideal and explicit command for enumerating valid user accounts on a mail server.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.