CEH Enumeration and System Hacking Practice Question
During a penetration test, you need to enumerate SMB shares on a Windows target. Which of the following tools is specifically designed for this purpose?
⚠ Common exam trap
Watch out — candidates often choose nmap because it can scan for SMB services, but the question asks for a tool specifically designed for enumerating SMB shares, not just detecting the service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
enum4linux
enum4linux is specifically designed to enumerate SMB shares and other information from Windows and Samba systems. It leverages the SMB/CIFS protocol to extract share listings, user lists, and other details using tools like smbclient, rpclient, and net, making it the correct choice for SMB enumeration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ldapsearch
Why it's wrong here
ldapsearch is a command-line utility used to query Lightweight Directory Access Protocol (LDAP) servers. Its primary function is to retrieve information stored within an LDAP directory, such as user accounts, groups, and organizational units. It operates on TCP ports 389 (LDAP) or 636 (LDAPS) and has no inherent capability to interact with or enumerate Server Message Block (SMB) shares, which utilize different protocols and ports for file and printer sharing.
- ✗
nmap
Why it's wrong here
nmap (Network Mapper) is a versatile open-source utility for network discovery and security auditing, primarily used for port scanning and service detection. While nmap can identify systems with open SMB ports (TCP 445 or 139) and even execute specific NSE scripts like smb-enum-shares.nse to attempt share enumeration, its core functionality is broad network mapping. It is not a dedicated, comprehensive SMB enumeration suite like enum4linux, which integrates various SMB-specific enumeration techniques.
- ✓
enum4linux
Why this is correct
enum4linux is a powerful Perl script specifically designed for enumerating information from Windows and Samba hosts, making it ideal for SMB share enumeration during penetration tests. It consolidates multiple SMB-specific enumeration techniques, including querying for user lists, group memberships, operating system information, and crucially, listing available SMB shares and their permissions. This tool leverages protocols like NetBIOS and SMB to gather comprehensive details, providing a focused and efficient approach to discovering shared resources.
- ✗
snmpwalk
Why it's wrong here
snmpwalk is a command-line application used to query network devices that support the Simple Network Management Protocol (SNMP). Its purpose is to retrieve a tree of information from an SNMP agent by performing a sequence of GETNEXT requests. This tool is exclusively designed for managing and monitoring network devices via SNMP (typically UDP ports 161/162) and has no functionality to interact with or enumerate Server Message Block (SMB) shares.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.