CEH Enumeration and System Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Privilege escalation

  Why it's wrong here

  Privilege escalation involves actively exploiting a vulnerability or misconfiguration to gain higher access rights on a system, such as moving from a standard user to an administrator. While `enum4linux` might reveal an existing high-privilege account with a weak or blank password, the act of discovering this potential vulnerability is information gathering, not the active process of elevating privileges itself. Escalation would occur when those credentials are used to log in and then exploit further system weaknesses.

• ✓

  Cracking passwords

  Why this is correct

  Cracking passwords refers to the process of discovering or bypassing authentication credentials, often through brute-force, dictionary attacks, or exploiting weak password policies. The `enum4linux` tool can enumerate user accounts and sometimes directly reveal blank or easily guessable passwords for services like SMB, or provide usernames that are crucial for subsequent offline or online password cracking attempts. Identifying a blank password is a direct form of credential compromise, making it a discovery within the realm of password cracking.

• ✗

  Spying

  Why it's wrong here

  Spying, in the context of a penetration test, typically refers to the covert monitoring of user activities, network traffic, or system processes after initial access has been established. This involves observing ongoing operations, data exfiltration, or keystrokes. `enum4linux`, conversely, is an enumeration tool used during the reconnaissance and initial access phases to gather static information about users, groups, shares, and system configurations, rather than to monitor dynamic, real-time activities.

• ✗

  Executing applications

  Why it's wrong here

  Executing applications on a target system usually pertains to the post-exploitation phase, where an attacker runs malicious payloads, implants backdoors, or utilizes legitimate system tools to maintain persistence or further compromise the environment. `enum4linux` operates by querying information from the target system's SMB/NetBIOS services from the attacker's machine. It does not involve running arbitrary code or applications directly on the victim system; it passively requests and receives information.

Go deeper

Related to this question