CEH Enumeration and System Hacking Practice Question
During a penetration test, an analyst detects that an SNMP agent on a network device is using the default community string 'public'. Which TWO actions can the analyst perform using this information? (Choose TWO.)
⚠ Common exam trap
Many candidates assume that a default read‑only community string like 'public' provides full administrative control over the device, but it only grants read‑only access. Therefore, actions such as writing configurations or disabling the agent are not possible without a read‑write community string.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enumerate user accounts and system details
The default SNMP community string 'public' typically grants read-only access to the SNMP agent. With read-only access, the analyst can perform an SNMPwalk (using tools like snmpwalk or MIB browsers) to enumerate the entire Management Information Base (MIB) tree, which often includes system details, user accounts, running processes, and network configurations. This enumeration is a key step in the Enumeration phase of a penetration test, as it can reveal sensitive information without authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enumerate user accounts and system details
Why this is correct
SNMP Management Information Bases (MIBs) are structured databases that store a wealth of information about network devices. Many standard MIB objects, such as those under the `host` or `users` branches, are designed to expose system details like operating system versions, running services, and even lists of local user accounts. This information, often accessible with a default read-only community string, is invaluable for attackers performing reconnaissance to identify potential vulnerabilities or valid login names.
- ✗
Extract encrypted passwords from the device
Why it's wrong here
While SNMP MIBs can contain sensitive configuration data, they are not designed to store or directly expose user passwords, whether plaintext or encrypted. Device passwords are typically stored in secure, non-SNMP-accessible memory or configuration files, often hashed and salted, making direct extraction via SNMP queries infeasible. Even if a MIB object were to reference a password, it would likely be a pointer or a non-recoverable hash, not the extractable credential itself.
- ✗
Write new configuration to the device
Why it's wrong here
Writing new configuration to a device via SNMP requires specific write permissions, typically granted through a "private" or "read-write" community string. The default and most common community string, "public," provides only read-only access to the MIB. Without a valid write community string, an attacker cannot modify MIB objects to alter device settings or inject new configurations, rendering this action impossible in a standard read-only scenario.
- ✓
Perform SNMPwalk to enumerate the MIB tree
Why this is correct
The `snmpwalk` utility is specifically designed to query an SNMP agent and retrieve all MIB objects and their values within a specified branch of the MIB tree. This operation is inherently a read-only function, requiring only a read community string (e.g., "public") to traverse and enumerate the available information. It systematically queries OIDs, making it an effective tool for comprehensive reconnaissance without needing write privileges.
- ✗
Disable the SNMP agent remotely
Why it's wrong here
Disabling the SNMP agent remotely is a configuration change that modifies the operational state of the device, thus requiring write access. This action involves setting a specific MIB object to a value that instructs the agent to cease operation. Without a valid write community string, an attacker cannot issue the necessary `SNMP SET` command to alter the agent's status and shut it down.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.