CEH Enumeration and System Hacking Practice Question
During a security assessment, an analyst runs 'enum4linux -a 10.0.0.5' and obtains a list of users, shares, and OS information. What protocol is enum4linux primarily using to gather this information?
⚠ Common exam trap
Many candidates confuse the underlying protocol (SMB/CIFS) with the transport or name-resolution layer (NetBIOS), leading them to select Option A because enum4linux historically used NetBIOS name lookups, but the core enumeration protocol is SMB/CIFS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SMB/CIFS
enum4linux is a wrapper around tools from the Samba suite, primarily using the SMB/CIFS protocol to query Windows systems for information such as user lists, shares, and OS details. It leverages SMB's remote IPC mechanisms (e.g., via \pipe\lsarpc or \pipe\samr) to enumerate these data points, making D the correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NetBIOS
Why it's wrong here
NetBIOS (Network Basic Input/Output System) provides name resolution and session services for older Windows networking, often running over TCP/IP as NBT. While SMB can utilize NetBIOS for transport and name resolution, enum4linux directly interacts with the Server Message Block (SMB) protocol itself. Therefore, specifying NetBIOS alone is insufficient as it describes a lower-level service rather than the specific application-layer protocol leveraged for enumeration.
- ✗
SNMP
Why it's wrong here
Simple Network Management Protocol (SNMP) is an application-layer protocol used for managing and monitoring network devices, such as routers, switches, and servers, by collecting information from their Management Information Bases (MIBs). Enum4linux, however, is specifically designed for enumerating Windows and Samba hosts to gather user, share, and system information. It does not query MIBs or utilize SNMP for its reconnaissance activities.
- ✗
LDAP
Why it's wrong here
Lightweight Directory Access Protocol (LDAP) is an application protocol for accessing and maintaining distributed directory information services, commonly used by Active Directory for user and group management. While LDAP can provide extensive directory information, enum4linux's primary function is to enumerate details directly from SMB services on target hosts. It does not query LDAP directories for its specific enumeration tasks, making LDAP an incorrect protocol for its operation.
- ✓
SMB/CIFS
Why this is correct
Enum4linux is a powerful enumeration tool specifically designed to interact with the Server Message Block (SMB) and Common Internet File System (CIFS) protocols. It leverages various SMB functionalities, such as querying NetBIOS name services, enumerating shares, listing users, and extracting operating system information from Windows and Samba hosts. This direct interaction with SMB/CIFS allows it to gather critical reconnaissance data for security assessments.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.