CEH Enumeration and System Hacking Practice Question
During a penetration test, you run `smtp-user-enum -M VRFY -U users.txt -t 10.0.0.10` and receive responses '252 2.5.2 User <username>' for some users and '550 5.1.1 User unknown' for others. What does this indicate?
⚠ Common exam trap
EC-Council often tests the distinction between VRFY and EXPN, where candidates mistakenly think EXPN is being used when the output clearly shows VRFY responses, or they assume any non-250 response means the server is secure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SMTP server is revealing valid usernames via the VRFY command
The VRFY command in SMTP (RFC 821) asks the server to verify whether a mailbox exists. A response starting with '252' indicates the user is valid, while '550 5.1.1' means the user does not exist. By comparing these responses, the attacker can enumerate valid usernames on the mail server, which is exactly what the output shows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SMTP server is using EXPN instead of VRFY
Why it's wrong here
The `smtp user enum m vrfy` command explicitly indicates the VRFY command was utilized, not EXPN. While EXPN is another SMTP command used for expanding mailing lists, it serves a distinct purpose from VRFY, which verifies the existence of a specific user. The question's context directly contradicts the assertion that EXPN was used, as the output clearly stems from VRFY responses.
- ✓
The SMTP server is revealing valid usernames via the VRFY command
Why this is correct
The differing server responses to the VRFY command—typically a '250 OK' for valid users and a '550 No such user' or similar for invalid ones—unambiguously confirm the server is revealing valid usernames. This behavior allows an attacker to systematically enumerate existing user accounts on the system. Such information is a critical vulnerability, enabling subsequent attacks like brute-force password attempts or targeted phishing campaigns.
- ✗
The SMTP server is vulnerable to command injection
Why it's wrong here
Command injection involves manipulating input to execute arbitrary commands on the server, which is not indicated by the VRFY command's behavior. The VRFY command is a standard, legitimate SMTP protocol function designed to verify user existence. The differing responses simply reflect the command's intended operation, not a flaw allowing for unauthorized code execution or shell command insertion.
- ✗
The SMTP server is properly configured to prevent enumeration
Why it's wrong here
A properly configured SMTP server would mitigate user enumeration by returning a generic, ambiguous response for both valid and invalid user queries via commands like VRFY or EXPN. This consistent response prevents attackers from distinguishing between existing and non-existent accounts. The observation of differing responses clearly indicates the server is *not* properly configured to prevent enumeration, as it provides the necessary distinction for attackers.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.