CEH Enumeration and System Hacking Practice Question
During a network assessment, you use SNMPwalk against a target. Which of the following is a prerequisite for successful SNMP enumeration?
⚠ Common exam trap
A common mix-up: candidates confuse SNMP's UDP port 161 with TCP or assume SNMP requires a username/password like SSH, but the CEH exam emphasizes that the community string is the sole authentication token for SNMPv1/v2c enumeration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Knowledge of the SNMP community string
SNMP enumeration relies on the SNMP community string, which acts as a password-like credential for read or read/write access to MIB data. Without the correct community string (defaults are often 'public' for read-only and 'private' for read-write), SNMPwalk cannot authenticate with the target agent and will fail to retrieve any OID values.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An open TCP port 161
Why it's wrong here
SNMP agents primarily listen for requests on UDP port 161, not TCP. While some non-standard or trap-related implementations might utilize TCP, the default and expected protocol for SNMP queries like those performed by `snmpwalk` is UDP. Therefore, an open TCP port 161 would not facilitate a successful `snmpwalk` operation against a standard SNMP agent, as the agent would not be listening on that TCP port for incoming queries.
- ✗
The target must be running Linux
Why it's wrong here
SNMP is a widely adopted network protocol supported across a vast array of operating systems and network devices, including Windows, various Unix-like systems (such as Linux, macOS, and BSD), network routers, switches, and printers. It is a cross-platform standard designed for heterogeneous network environments and is not exclusive to Linux. Therefore, assuming the target must be running Linux is incorrect, as `snmpwalk` can be used to query SNMP agents on virtually any platform that supports the protocol.
- ✓
Knowledge of the SNMP community string
Why this is correct
For SNMPv1 and SNMPv2c, the community string serves as a clear-text password or authentication credential required to access the SNMP agent's Management Information Base (MIB). Without knowing the correct read-only or read-write community string, an `snmpwalk` utility cannot successfully query the device for its managed objects. This string effectively controls access permissions, allowing or denying the retrieval of system information and acting as the primary security mechanism for these older SNMP versions.
- ✗
A valid username and password
Why it's wrong here
SNMPv1 and SNMPv2c, the versions most commonly targeted by basic `snmpwalk` commands, do not utilize traditional usernames and passwords for authentication. Instead, they rely solely on the community string for access control, which is passed in clear text. While SNMPv3 does incorporate user-based security models with authentication (e.g., MD5, SHA) and encryption (e.g., DES, AES), `snmpwalk` against a target typically implies the simpler community string mechanism of earlier versions, making a username and password irrelevant for those contexts.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.