CEH Enumeration and System Hacking Practice Question
During a penetration test, the tester runs `enum4linux -U 192.168.1.20` and obtains a list of usernames. What service is being enumerated, and what is the primary risk associated with this information disclosure?
⚠ Common exam trap
The CEH exam often tests the association between the specific enumeration tool and its corresponding service, so the trap here is confusing enum4linux with other enumeration tools like `snmpwalk` (SNMP) or `ldapsearch` (LDAP), leading candidates to pick a plausible-sounding but incorrect service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SMB; it can facilitate password spraying or brute‑force attacks
enum4linux is a tool that queries SMB (Server Message Block) services on a target, typically over TCP ports 139 or 445. The `-U` flag specifically enumerates users from the SAM database via the SMB protocol. The primary risk of obtaining a valid username list is that it enables password spraying or brute-force attacks against SMB authentication, which can lead to unauthorized access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NFS; it can lead to unauthorized file access
Why it's wrong here
The `enum4linux` utility is specifically designed to interact with the Server Message Block (SMB) protocol, not Network File System (NFS). While NFS is a common file-sharing protocol on Unix-like systems and misconfigurations can indeed lead to unauthorized file access, `enum4linux` does not possess the functionality to enumerate or exploit NFS shares. Therefore, this tool would not be used in the scenario described to target NFS.
- ✗
SNMP; it can reveal community strings
Why it's wrong here
The `enum4linux` tool focuses exclusively on enumerating user and share information via the Server Message Block (SMB) protocol. Simple Network Management Protocol (SNMP), on the other hand, is used for managing network devices and can reveal sensitive data like community strings if poorly secured. However, `enum4linux` lacks any built-in capabilities to query SNMP agents or exploit SNMP vulnerabilities, making it an incorrect association for the given command.
- ✓
SMB; it can facilitate password spraying or brute‑force attacks
Why this is correct
`enum4linux` specifically leverages the Server Message Block (SMB) protocol to enumerate user information from Windows or Samba hosts, directly identifying the service in the scenario. Obtaining a list of valid usernames, as achieved by the `-U` flag, is a critical precursor for credential-based attacks. This disclosed information significantly facilitates password spraying, where common passwords are tried against numerous accounts, or targeted brute-force attacks against specific user accounts.
- ✗
LDAP; it can expose directory structure
Why it's wrong here
Lightweight Directory Access Protocol (LDAP) is a protocol for accessing and maintaining distributed directory information services, often used for user authentication and directory structures. While LDAP can certainly expose sensitive organizational data if not properly secured, `enum4linux` is specifically engineered to enumerate information from Windows and Samba hosts using the Server Message Block (SMB) protocol, not LDAP. Dedicated LDAP enumeration tools would be required to map directory structures.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.