CEH Footprinting, Reconnaissance and Scanning Practice Question
During a penetration test, you run the command: nmap -sU -p 161,162 --script=snmp-brute 192.168.1.100. Which of the following is the PRIMARY goal of this scan?
⚠ Common exam trap
Watch out — candidates often confuse the `snmp-brute` script with SNMP MIB enumeration or general service discovery, but the script's explicit purpose is to brute-force community strings, not to read MIB values or scan TCP ports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Discover SNMP community strings via brute-force
The command uses the `-sU` flag for a UDP scan and targets ports 161 and 162, which are the standard SNMP ports. The `--script=snmp-brute` script attempts to brute-force SNMP community strings (the equivalent of passwords for SNMPv1/v2c). Therefore, the primary goal is to discover valid community strings, which is option A.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Discover SNMP community strings via brute-force
Why this is correct
This option correctly identifies the purpose of using Nmap's UDP scan (`-sU`) targeting the standard SNMP port (161) in conjunction with the `snmp-brute` NSE script. This script systematically attempts a list of common or custom community strings (like "public," "private," "manager") against the discovered SNMP agent. Successful brute-force reveals valid community strings, granting read or write access to the device's MIB, which is a critical step in reconnaissance and potential exploitation.
- ✗
Perform a ping sweep to discover live hosts
Why it's wrong here
A ping sweep, primarily used for host discovery, typically relies on sending ICMP Echo Request packets (`-PE`, `-PP`, `-PM`) or TCP SYN packets to common ports (`-PS`) across a range of IP addresses. The command `nmap -sU -p 161 --script snmp-brute` (implied by the correct answer) specifically performs a UDP port scan on port 161 and executes an SNMP-specific brute-force script, which is not designed for general host discovery via a ping sweep.
- ✗
Identify open TCP ports and services on the target
Why it's wrong here
The Nmap `-sU` flag explicitly designates a UDP scan, which probes for open UDP ports and associated services, not TCP ports. To identify open TCP ports and services, Nmap employs various TCP scan types such as SYN scan (`-sS`), Connect scan (`-sT`), or FIN scan (`-sF`). Therefore, a command leveraging `-sU` would not be used to enumerate TCP-based services.
- ✗
Enumerate SNMP MIB tree values
Why it's wrong here
While related to SNMP, enumerating MIB (Management Information Base) tree values involves querying the SNMP agent for specific OIDs (Object Identifiers) to retrieve detailed system information, such as network interfaces, running processes, or system uptime. This task is typically accomplished using Nmap's `snmp-info` or `snmp-walk` scripts, which perform detailed information gathering *after* a community string is known, rather than brute-forcing the community string itself.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.