CCNA Enumeration and System Hacking Questions — Page 3 of 3

151

MCQeasy

Which SNMP community string is typically used for read-only access by default on many devices?

A.snmp

B.private

C.admin

D.public

AnswerD

The "public" community string is the universally recognized and default read-only community string for SNMPv1 and SNMPv2c agents. This string allows an SNMP manager to query and retrieve various operational statistics and configuration details from a network device's Management Information Base (MIB) without the ability to alter any settings. Due to its widespread default configuration, "public" is frequently targeted by attackers seeking to gather network intelligence.

Why this answer

The default read-only community string in SNMPv1 and SNMPv2c is 'public'. This string acts as a password that allows an SNMP manager to query device MIB objects for monitoring purposes without making configuration changes. It is widely documented in RFC 1157 and is the standard default across most networking equipment.

Exam trap

The trap here is that candidates often confuse 'public' with 'private', mistakenly thinking 'private' is the read-only string, when in fact 'private' is the default read-write community string.

How to eliminate wrong answers

Option A is wrong because 'snmp' is not a standard default community string; it is occasionally used as a custom string but never as a default. Option B is wrong because 'private' is the default read-write community string, granting write access to modify device configurations, not read-only. Option C is wrong because 'admin' is a common administrative username, not an SNMP community string; SNMP community strings are separate from device login credentials.

Practice this question →

152

MCQhard

After gaining initial access to a Linux server, a penetration tester wants to maintain persistence by creating a backdoor. The tester decides to replace a common system binary with a trojanized version. Which of the following techniques is MOST likely to evade detection by file integrity monitoring (FIM) systems?

A.Replace the binary with a modified version that has the same file size and timestamp

B.Place the backdoor in a directory that is excluded from FIM monitoring

C.Use steganography to hide the backdoor inside an image file

D.Use a kernel-level rootkit that intercepts read operations to present the original binary's content

AnswerD

A kernel-level rootkit operates within the operating system's kernel, granting it the highest level of privilege and control. By hooking system calls, specifically `read()` operations, the rootkit can intercept requests from the FIM agent to read the compromised binary. Instead of returning the modified, malicious content, the rootkit presents the *original*, untampered content of the binary to the FIM system. This sophisticated deception ensures that the FIM system calculates the expected hash, thus reporting no integrity violation, while the malicious binary continues to execute its payload.

Why this answer

A kernel-level rootkit can intercept system calls (e.g., open, read) used by FIM tools to verify file integrity. When the FIM queries the trojanized binary, the rootkit returns the original, unmodified content, so the hash or checksum matches the baseline. This subverts detection at the kernel layer, bypassing user-space integrity checks entirely.

Exam trap

The trap here is that candidates often choose Option A, mistakenly believing that matching file size and timestamp is sufficient to evade FIM, but FIM relies on cryptographic hashes, not metadata, to detect changes.

How to eliminate wrong answers

Option A is wrong because simply matching file size and timestamp does not prevent FIM from detecting a changed cryptographic hash (e.g., SHA-256) of the binary; FIM tools compute hashes, not just metadata. Option B is wrong because placing the backdoor in an excluded directory is not a stealthy evasion technique—it relies on misconfiguration and would be obvious during a thorough audit or if the FIM policy is reviewed. Option C is wrong because steganography hides data within an image file, but replacing a system binary with an image would break system functionality and be immediately detected by FIM as a missing or altered binary.

Practice this question →

153

MCQmedium

A security analyst runs the command: nbtstat -A 192.168.1.10. The output shows the table of names for the remote machine. Which of the following is the MOST likely purpose of this command?

A.To perform a DNS zone transfer

B.To enumerate SNMP community strings on the remote host

C.To enumerate NetBIOS names and services on the remote host

D.To enumerate SMB shares on the remote host

AnswerC

The command `nbtstat -a 192.168.1.10` (or `-A` for adapter status) is precisely used to query the NetBIOS name table of a remote host. This query retrieves a list of NetBIOS names registered by the target machine, including the computer name, workgroup/domain name, and services like the Messenger service or File and Print Sharing, along with their associated types and status. This provides valuable information about the remote system's identity and active NetBIOS services.

Why this answer

The `nbtstat -A` command performs a NetBIOS name table lookup against a remote IP address, displaying the registered NetBIOS names and their associated service types (e.g., workstation, server, messenger). This is a core technique for NetBIOS enumeration, which reveals the remote host's computer name, logged-in user, and running NetBIOS services, making option C correct.

Exam trap

The trap here is that candidates confuse `nbtstat -A` (NetBIOS name table enumeration) with SMB share enumeration (`net view` or `smbclient`), because both are associated with Windows file sharing, but they operate at different protocol layers and serve distinct enumeration purposes.

How to eliminate wrong answers

Option A is wrong because DNS zone transfers are performed using `nslookup` or `dig` with specific zone transfer flags, not `nbtstat` which operates at the NetBIOS over TCP/IP layer. Option B is wrong because SNMP community string enumeration is done via tools like `snmpwalk` or `snmpenum` targeting UDP port 161, while `nbtstat` uses NetBIOS name service on UDP port 137. Option D is wrong because enumerating SMB shares is typically accomplished with `net view`, `smbclient`, or `enum4linux`, not `nbtstat` which only retrieves NetBIOS name tables, not share lists.

Practice this question →

154

MCQmedium

A security analyst reviews the following command output from a Linux system: `uid=0(root) gid=0(root) groups=0(root)`. The analyst suspects a privilege escalation attack. Which of the following techniques could have been used to achieve root access from a standard user account?

A.Token impersonation

B.Pass-the-hash attack

C.LLMNR/NBT-NS poisoning

D.SUID/GUID abuse

AnswerD

SUID (Set User ID) and SGID (Set Group ID) are special permissions in Linux that allow an executable file to run with the permissions of its owner (SUID) or group (SGID), rather than the user executing it. If a program owned by root has the SUID bit set, any user executing it will temporarily gain root privileges for the duration of that program's execution. Attackers can exploit misconfigured or vulnerable SUID/SGID binaries, such as those that allow arbitrary command execution or shell escapes, to elevate their privileges to root or another privileged user.

Why this answer

The command output shows the current user has UID 0, which is the root user. On Linux, SUID (Set User ID) and GUID (Group ID) bits allow executables to run with the permissions of the file owner (e.g., root). A standard user can exploit a misconfigured SUID binary (like `passwd` or a custom script) to execute commands with root privileges, achieving privilege escalation.

This is a classic Linux privilege escalation technique directly tied to the UID/GID output shown.

Exam trap

The trap here is that candidates confuse Windows-specific attacks (token impersonation, pass-the-hash, LLMNR poisoning) with Linux privilege escalation, failing to recognize that the `uid=0` output is a direct indicator of root access achieved via SUID/GUID abuse.

How to eliminate wrong answers

Option A is wrong because token impersonation is a Windows-specific attack that involves duplicating access tokens (e.g., via SeImpersonatePrivilege) and does not apply to Linux systems. Option B is wrong because pass-the-hash is a Windows network authentication attack that reuses NTLM hashes to authenticate without knowing the plaintext password; it is not relevant to Linux local privilege escalation. Option C is wrong because LLMNR/NBT-NS poisoning is a Windows network protocol attack used to intercept authentication requests on a local network, not a technique to escalate privileges on a local Linux system.

Practice this question →

155

MCQeasy

Which of the following is a primary purpose of the enumeration phase in a penetration test?

A.To gather in-depth information about the target system and its resources

B.To exploit identified vulnerabilities and gain access

C.To perform a vulnerability scan on the target network

D.To delete logs and cover tracks after a successful compromise

AnswerA

Enumeration is the active process of extracting detailed information from a target system or network, such as user accounts, group memberships, network shares, running services, and open ports. This granular data provides critical intelligence to identify potential attack vectors and misconfigurations, laying the groundwork for subsequent vulnerability analysis and exploitation attempts. It moves beyond simple port scanning to actively query services for specific configuration details.

Why this answer

The enumeration phase is the active process of extracting detailed information about a target system, such as user accounts, network shares, services, and system policies, using direct queries. This phase goes beyond passive reconnaissance by establishing connections to the target to gather data that can be used to identify attack vectors. In a CEH context, enumeration is specifically defined as the step where the tester collects in-depth information about the target's resources and potential entry points.

Exam trap

The trap here is that candidates often confuse enumeration with vulnerability scanning, but enumeration focuses on gathering system-specific information (like user accounts and shares) rather than scanning for known vulnerabilities.

How to eliminate wrong answers

Option B is wrong because exploiting vulnerabilities and gaining access is the purpose of the exploitation phase, not enumeration. Option C is wrong because performing a vulnerability scan is part of the vulnerability assessment phase, which typically occurs after enumeration and before exploitation. Option D is wrong because deleting logs and covering tracks is an activity of the post-exploitation or covering tracks phase, which occurs after a successful compromise, not during enumeration.

Practice this question →

156

MCQmedium

A penetration tester is performing SNMP enumeration against a network device and wants to retrieve the entire Management Information Base (MIB) tree. Which command should they use?

A.snmpwalk -v 2c -c public 192.168.1.1 .1

B.snmpset -v 2c -c private 192.168.1.1 1.3.6.1.2.1.1.0 s 'test'

C.snmpbulkwalk -v 2c -c public 192.168.1.1 .1

D.snmpget -v 2c -c public 192.168.1.1 1.3.6.1.2.1.1

AnswerA

This command correctly utilizes `snmpwalk` to perform comprehensive SNMP enumeration. The `-v 2c` flag specifies the use of SNMPv2c, a widely adopted version, and `-c public` employs the common default read-only community string. Crucially, initiating the walk with `.1` as the starting Object Identifier (OID) instructs `snmpwalk` to traverse and retrieve all available information from the entire Management Information Base (MIB) tree on the target device, which is the precise objective of thorough SNMP enumeration.

Why this answer

`snmpwalk` is specifically designed to retrieve a subtree of MIB objects by performing a series of GETNEXT requests starting from a given OID. Using `.1` as the root OID (which corresponds to the entire ISO tree) with the SNMPv2c community string 'public' will enumerate all accessible OIDs in the MIB tree, effectively dumping the entire Management Information Base.

Exam trap

The trap here is that candidates often confuse `snmpbulkwalk` as the correct answer because it is faster for large MIBs, but the CEH exam expects `snmpwalk` as the standard enumeration tool, and `snmpbulkwalk` may not be supported by all SNMP agents.

How to eliminate wrong answers

Option B is wrong because `snmpset` is used to modify SNMP objects, not to retrieve them; it requires write access (community 'private') and would fail to enumerate the MIB tree. Option C is wrong because `snmpbulkwalk` is optimized for bulk retrieval but is not the standard command for a full MIB tree walk; it uses GETBULK requests which may be blocked or behave differently on some devices, and the question asks for the command to use, not the most efficient one. Option D is wrong because `snmpget` retrieves only a single OID value (1.3.6.1.2.1.1) and does not walk the tree; it would return only the system description or a single scalar object, not the entire MIB.

Practice this question →

157

MCQmedium

During a security assessment, an analyst runs 'enum4linux -a 10.0.0.5' and obtains a list of users, shares, and OS information. What protocol is enum4linux primarily using to gather this information?

A.NetBIOS

B.SNMP

C.LDAP

D.SMB/CIFS

AnswerD

Enum4linux is a powerful enumeration tool specifically designed to interact with the Server Message Block (SMB) and Common Internet File System (CIFS) protocols. It leverages various SMB functionalities, such as querying NetBIOS name services, enumerating shares, listing users, and extracting operating system information from Windows and Samba hosts. This direct interaction with SMB/CIFS allows it to gather critical reconnaissance data for security assessments.

Why this answer

enum4linux is a wrapper around tools from the Samba suite, primarily using the SMB/CIFS protocol to query Windows systems for information such as user lists, shares, and OS details. It leverages SMB's remote IPC mechanisms (e.g., via \pipe\lsarpc or \pipe\samr) to enumerate these data points, making D the correct answer.

Exam trap

The trap here is that candidates confuse the underlying protocol (SMB/CIFS) with the transport or name-resolution layer (NetBIOS), leading them to select Option A because enum4linux historically used NetBIOS name lookups, but the core enumeration protocol is SMB/CIFS.

How to eliminate wrong answers

Option A is wrong because NetBIOS is a session-layer protocol used for name resolution and service discovery, but enum4linux relies on SMB/CIFS over TCP/445 (or NetBIOS over TCP/139) to perform its enumeration; the tool itself is not primarily a NetBIOS scanner. Option B is wrong because SNMP (Simple Network Management Protocol) uses UDP ports 161/162 and is designed for managing network devices, not for enumerating Windows user accounts or shares via SMB. Option C is wrong because LDAP (Lightweight Directory Access Protocol) operates on TCP/389 and is used for querying directory services like Active Directory, but enum4linux does not use LDAP by default; it uses SMB RPC calls to extract information.

Practice this question →

158

MCQmedium

During a penetration test, an analyst runs the command 'snmpwalk -v2c -c public 192.168.1.10' and receives a large amount of output. Which protocol and community string are being used?

A.SNMPv1 with community string public

B.SNMPv1 with community string private

C.SNMPv2c with community string public

D.SNMPv3 with user public

AnswerC

This option is correct because the command's `-v2c` flag precisely identifies SNMP version 2c, which offers significant improvements over SNMPv1, including enhanced bulk data transfer and more detailed error messages. Concurrently, the `-c public` flag accurately specifies the community string as 'public', a widely known default often targeted by attackers for initial reconnaissance during penetration tests.

Why this answer

The command 'snmpwalk -v2c -c public 192.168.1.10' explicitly specifies SNMP version 2c with the '-v2c' flag and the community string 'public' with the '-c' flag. SNMPv2c is the most common version for read-only queries, and 'public' is the default read-only community string. The large output indicates successful enumeration of the MIB tree, confirming the community string is correct.

Exam trap

The trap here is that candidates often confuse the '-v2c' flag with SNMPv1 or assume 'public' is always read-only, but the question tests the direct mapping of command-line arguments to protocol version and community string.

How to eliminate wrong answers

Option A is wrong because the command uses '-v2c', not '-v1', so SNMPv1 is not being used. Option B is wrong because it incorrectly specifies SNMPv1 and the community string 'private', which is typically used for read-write access, not the 'public' string shown in the command. Option D is wrong because SNMPv3 does not use community strings; it uses usernames and authentication/encryption parameters, and the command does not include any SNMPv3-specific flags like '-u' or '-l'.

Practice this question →

159

Multi-Selectmedium

Which TWO of the following tools are capable of cracking password hashes offline? (Select 2)

Select 2 answers

A.Hashcat

B.Hydra

C.John the Ripper

D.Nmap

E.Wireshark

AnswersA, C

Hashcat is an advanced offline password recovery utility renowned for its unparalleled speed, primarily achieved through extensive GPU acceleration. It supports a vast array of hash types, including NTLM, MD5, SHA-1, and bcrypt, and offers diverse attack modes such as dictionary, brute-force, mask, and hybrid attacks. This makes it exceptionally effective for cracking password hashes extracted from compromised systems or databases, enabling rapid auditing of password security.

Why this answer

Hashcat is a high-performance password recovery tool that supports offline cracking of password hashes using GPU acceleration. It can process a wide range of hash types (e.g., MD5, SHA-1, bcrypt, NTLM) by comparing precomputed or brute-force generated hashes against a target hash file, all without interacting with a live authentication server.

Exam trap

The trap here is that candidates often confuse online brute-forcing tools (like Hydra) with offline hash crackers, because both are used for password attacks, but Hydra requires a live target service and cannot process a static hash file.

Practice this question →

160

MCQeasy

Which of the following tools is specifically used to enumerate SMB shares and retrieve file listings from Windows systems?

A.ldapsearch

B.snmpwalk

C.smbclient

D.nmap

AnswerC

smbclient is a powerful command-line utility that acts as an SMB/CIFS client, similar to a Windows file explorer. It is specifically designed to interact with SMB servers, allowing users to list available shares on a target machine using the "-L" option, connect to specific shares, and browse, upload, or download files. Its direct capability to query and display network shares makes it the most appropriate tool for SMB enumeration.

Why this answer

smbclient is a tool from the Samba suite specifically designed to interact with SMB/CIFS shares. It allows an attacker to enumerate available shares on a Windows target and retrieve file listings by connecting to the SMB service (port 445 or 139) using commands like 'smbclient -L //target' or by mounting a share and listing its contents.

Exam trap

The trap here is that candidates often confuse nmap's ability to detect SMB services with the actual enumeration of shares and file listings, but nmap requires specific NSE scripts and does not provide the direct interactive file listing capability that smbclient offers.

How to eliminate wrong answers

Option A is wrong because ldapsearch is a tool for querying LDAP directory services (port 389/636), not for enumerating SMB shares or retrieving file listings from Windows systems. Option B is wrong because snmpwalk is used to retrieve SNMP MIB data (port 161/162) from network devices, not to interact with SMB shares. Option D is wrong because nmap is a port scanner and network mapper that can detect open SMB ports but cannot natively enumerate SMB shares or retrieve file listings without additional scripts (e.g., smb-enum-shares), and even then it is not the dedicated tool for direct file listing.

Practice this question →

161

MCQeasy

Which password cracking method uses a precomputed table of hash chains to reverse password hashes quickly?

A.Hybrid attack

B.Rainbow table attack

C.Dictionary attack

D.Brute-force attack

AnswerB

A rainbow table attack utilizes a precomputed table of hash chains to reverse cryptographic hash functions efficiently. Instead of brute-forcing each hash, the attacker looks up the target hash within the table, which maps hashes back to their original plaintext passwords. This method exploits a time-memory tradeoff, allowing for rapid password recovery without needing to compute every possible password combination during the attack.

Why this answer

A rainbow table attack is correct because it uses precomputed tables of hash chains to reverse password hashes quickly. Instead of computing the hash for every possible password in real time, the attacker looks up the hash in the table to find the corresponding plaintext, drastically reducing the time needed for cracking.

Exam trap

The trap here is that candidates confuse rainbow tables with dictionary attacks, thinking both use precomputed lists, but rainbow tables specifically use hash chains to cover many passwords efficiently, not a simple list of words.

How to eliminate wrong answers

Option A is wrong because a hybrid attack combines dictionary words with variations (e.g., appending numbers or symbols) but does not use precomputed hash chains. Option C is wrong because a dictionary attack tries a list of likely passwords by hashing each one and comparing, without any precomputed table. Option D is wrong because a brute-force attack tries every possible character combination sequentially, computing hashes on the fly, which is computationally expensive and does not rely on precomputed tables.

Practice this question →

162

MCQmedium

Which phase of the system hacking methodology (CHPSET) involves hiding files from the operating system using techniques such as rootkits or steganography?

A.Cracking passwords

B.Erasing tracks

C.Executing applications

D.Hiding files

AnswerD

Hiding files is a core activity within the "Maintaining Access" phase of system hacking, specifically represented by the 'H' in the CHIPSET acronym. This involves employing various techniques, such as rootkits, steganography, or manipulating file attributes and permissions, to conceal malicious tools, backdoors, or data staging areas from legitimate users, administrators, and security software, thereby ensuring persistence and operational secrecy on the compromised system.

Why this answer

The 'Hiding files' phase of the CHPSET (Cracking passwords, Hacking, Privilege escalation, Spying, Erasing tracks, Executing applications, Hiding files) methodology involves concealing malicious files from the operating system and security tools. Techniques such as rootkits (which hook system calls like NtQueryDirectoryFile to hide files from directory listings) and steganography (embedding data within innocent files like images or audio) are used to avoid detection. This phase directly follows 'Executing applications' and ensures the attacker's payload remains persistent and covert.

Exam trap

The trap here is that candidates confuse 'Erasing tracks' (clearing logs) with 'Hiding files' (concealing the files themselves), but the CEH CHPSET model separates these as distinct phases—'Hiding files' specifically refers to techniques like rootkits and steganography that hide the file from the OS, not just removing evidence of its execution.

How to eliminate wrong answers

Option A is wrong because 'Cracking passwords' is the initial phase of CHPSET, focused on gaining access through password attacks (e.g., brute force, rainbow tables), not hiding files. Option B is wrong because 'Erasing tracks' involves clearing logs (e.g., clearing Event Logs or using tools like `wevtutil`) to cover the attacker's footprint, not hiding files from the OS. Option C is wrong because 'Executing applications' refers to running the malicious payload (e.g., backdoor or keylogger) after privilege escalation, not the act of concealing files.

Practice this question →

163

MCQeasy

Which tool is specifically designed to crack Windows LM and NTLM hashes using precomputed tables?

A.Ophcrack

B.John the Ripper

C.Cain & Abel

D.Hashcat

AnswerA

Ophcrack is purpose-built for cracking Windows LM and NTLM hashes, leveraging precomputed rainbow tables for highly efficient password recovery. Its specialization allows it to quickly reverse these specific hash formats by performing a time-memory trade-off, making it exceptionally fast for common passwords. The tool comes with pre-generated tables, significantly reducing the computational effort required compared to on-the-fly cracking methods.

Why this answer

Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It relies on the time-memory trade-off technique, where hashes are looked up in precomputed tables rather than computed on the fly, making it highly efficient for these specific hash types. The tool is bundled with free rainbow tables for LM hashes and supports NTLM through additional table sets.

Exam trap

The trap here is that candidates often confuse 'precomputed tables' with general cracking tools like Hashcat or John the Ripper, which can also use precomputed tables in some configurations, but Ophcrack is the only tool specifically designed and optimized for that purpose with Windows LM/NTLM hashes.

How to eliminate wrong answers

Option B (John the Ripper) is wrong because it is a general-purpose password cracker that uses brute-force, dictionary, or incremental modes, not precomputed tables as its primary or designed method for Windows hashes. Option C (Cain & Abel) is wrong because while it can capture and crack Windows hashes, it relies on dictionary, brute-force, or cryptanalysis attacks, not precomputed rainbow tables. Option D (Hashcat) is wrong because it is a high-speed GPU-based cracker that uses brute-force, dictionary, or rule-based attacks, and although it supports precomputed tables via the '--stdout' mode with hashcat-utils, it is not specifically designed for precomputed table attacks like Ophcrack.

Practice this question →

164

MCQmedium

A penetration tester wants to enumerate users and groups from a Windows domain controller via LDAP without logging in. Which of the following tools is MOST appropriate for anonymous LDAP enumeration?

A.smbclient

B.ldapsearch

C.snmpwalk

D.enum4linux

AnswerB

ldapsearch is the correct tool because it is specifically designed for querying LDAP (Lightweight Directory Access Protocol) directories. It enables penetration testers to perform anonymous or authenticated queries to enumerate directory objects, including users, groups, and their associated attributes. This utility directly interacts with LDAP servers to retrieve the precise information required for user and group enumeration.

Why this answer

ldapsearch is the correct tool because it can perform anonymous LDAP queries against a Windows domain controller's LDAP service (port 389) without requiring authentication. By default, many Windows DCs allow anonymous binds to retrieve directory information such as user and group objects, making ldapsearch the most direct and appropriate choice for this task.

Exam trap

The trap here is that candidates confuse enum4linux (which uses SMB/RPC null sessions) with LDAP enumeration, but enum4linux does not perform anonymous LDAP queries and relies on different protocols and ports.

How to eliminate wrong answers

Option A is wrong because smbclient is used for SMB/CIFS file sharing and requires authentication to enumerate users or groups; it cannot perform LDAP queries. Option C is wrong because snmpwalk uses SNMP (UDP 161) to query MIB objects from network devices, not LDAP directory services, and is not designed for user/group enumeration from a domain controller. Option D is wrong because enum4linux is a wrapper tool that uses SMB, RPC, and NetBIOS to enumerate Windows systems, but it does not perform LDAP queries and typically requires some level of authentication or null session access, not anonymous LDAP binding.

Practice this question →