CEH Enumeration and System Hacking Practice Question
During a penetration test, a tester runs enum4linux against a Windows server and receives the following output: 'S-1-5-21-3623811015-3361044348-30300820-500' and 'S-1-5-21-3623811015-3361044348-30300820-501'. Which TWO conclusions can be drawn from this output?
⚠ Common exam trap
It's easy for candidates to assume the Guest account is enabled simply because its SID is listed, but enumeration only proves existence, not account status.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Guest account SID was enumerated
The SID ending in -500 is the well-known RID for the built-in Administrator account, and the SID ending in -501 is the RID for the built-in Guest account. Enum4linux enumerates user SIDs from the SAM database via SMB null sessions, confirming that both the Administrator and Guest account SIDs were retrieved. Therefore, options B and C are correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Guest account is enabled
Why it's wrong here
The presence of a Security Identifier (SID) for the Guest account (RID 501) in enum4linux output confirms its existence on the system, but it does not inherently indicate whether the account is currently enabled or disabled. enum4linux primarily enumerates SIDs, users, and groups, not their active status. Determining account enablement typically requires additional queries, such as using `net user` commands or more detailed SMB status checks, which are not part of the standard SID enumeration output.
- ✓
The Guest account SID was enumerated
Why this is correct
The enumeration of the Guest account SID is directly evidenced by the enum4linux output showing a Security Identifier (SID) ending with the Relative Identifier (RID) 501. RID 501 is a well-known, universal identifier for the Guest account on Windows systems. Successfully retrieving this specific SID confirms that the penetration tester has identified the unique identifier for the Guest account on the target machine, a key piece of reconnaissance information.
- ✓
The Administrator account SID was enumerated
Why this is correct
The enum4linux output explicitly demonstrates the enumeration of the Administrator account's Security Identifier (SID) by displaying a SID that concludes with the Relative Identifier (RID) 500. RID 500 is the universally recognized identifier for the built-in Administrator account on Windows systems. This successful enumeration provides the unique identifier for the most privileged local account, which is crucial for understanding the target's account structure during a penetration test.
- ✗
The server is a domain controller
Why it's wrong here
The enum4linux output, while providing valuable user and group enumeration, does not contain sufficient information to definitively conclude that the target server is a domain controller. A domain controller would typically present a domain SID (e.g., S-1-5-21-domain_identifier-...) and enumerate domain-specific users and groups. The presence of only local RIDs (like 500 and 501) suggests it could be a standalone server or workstation, lacking the context of a full Active Directory domain.
- ✗
Password policy was retrieved
Why it's wrong here
The primary function of enum4linux is to enumerate users, groups, shares, and system information via SMB/NetBIOS, not to retrieve detailed password policy settings. The typical output from enum4linux, which focuses on SIDs and account names, does not include specific parameters such as minimum password length, complexity requirements, or account lockout thresholds. Retrieving password policy usually requires different tools or specific queries against the Local Security Authority (LSA) or Active Directory.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.