CEH Enumeration and System Hacking Practice Question
During a penetration test, an analyst uses enum4linux with the -a flag against a target. Which of the following is the MOST comprehensive set of information that can be obtained?
⚠ Common exam trap
Many exam-takers assume enum4linux -a only retrieves shares or NetBIOS data, underestimating its full scope of SMB/RPC-based enumeration that includes users, groups, OS details, and password policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User list, share list, OS information, password policy, and group memberships
enum4linux with the -a flag performs a comprehensive enumeration against a target, leveraging SMB, RPC, and NetBIOS over TCP/IP. It retrieves user lists, share lists, OS information, password policy details, and group memberships by querying the remote Windows system via SMB RPC calls (e.g., SAMR, LSA, SRVSVC). This makes it the most complete set of information obtainable from a single command, as the -a flag essentially runs all available enumeration modules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Only the domain admins and local admins
Why it's wrong here
The '-a' option in enum4linux is designed for comprehensive enumeration, not just limited to administrative accounts. It attempts to retrieve a full list of users, including standard user accounts, and then identifies their group memberships, which may include local and domain administrators. Therefore, stating it *only* enumerates admins is incorrect as its scope is much broader, encompassing all enumerated users and their associated groups.
- ✓
User list, share list, OS information, password policy, and group memberships
Why this is correct
The '-a' (all) option in enum4linux is specifically designed to perform a full suite of enumeration functions against a target Windows or Samba system. This includes gathering a detailed user list, available SMB share names, operating system version information, the configured password policy, and comprehensive group memberships for identified users and groups. This comprehensive output provides critical intelligence for subsequent penetration testing phases.
- ✗
Only the SMB shares and open sessions
Why it's wrong here
While enum4linux with the '-a' option does indeed enumerate SMB shares, and can sometimes infer open sessions through other data, its capabilities extend far beyond these two specific data points. The tool's primary strength lies in its ability to extract a wide array of user, group, and policy information, making the claim that it *only* gathers shares and sessions a significant understatement of its full functionality. This option provides a partial, rather than complete, description of the output.
- ✗
Only the NetBIOS name table
Why it's wrong here
The NetBIOS name table is primarily obtained using tools like 'nbtstat -A <IP_address>', which queries the NetBIOS Name Service directly. While enum4linux might leverage NetBIOS for initial host discovery or name resolution, its core function with the '-a' option is to enumerate SMB/Samba services, extracting detailed user, group, share, and policy information via RPC calls. Therefore, limiting its output to *only* the NetBIOS name table fundamentally misrepresents the tool's purpose and extensive enumeration capabilities.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.