Enumeration Techniques: NetBIOS and LDAP
Which TWO of the following are valid enumeration techniques? (Select 2)
Quick Answer
The answer is NetBIOS enumeration using nbtstat and LDAP enumeration. NetBIOS enumeration is valid because the nbtstat utility queries the NetBIOS name table over TCP/IP, revealing computer names, logged-in users, and domain membership—information that attackers harvest during reconnaissance. LDAP enumeration is equally valid, as it involves querying a directory service like Active Directory with tools such as ldapsearch to extract user lists, group memberships, and organizational units, often without authentication. On the Certified Ethical Hacker CEH exam, this question tests your ability to distinguish active enumeration techniques from passive footprinting; a common trap is confusing LDAP enumeration with DNS zone transfers or SNMP sweeps. Remember that both NetBIOS and LDAP rely on specific service ports (137-139 and 389) and are frequently paired in internal network scans. Memory tip: “Net and LDAP, the enumeration trap”—if the tool queries a service for structured data, it’s enumeration, not just scanning.
⚠ Common exam trap
EC-Council often tests the distinction between active reconnaissance techniques (like enumeration) and attack techniques (like ARP poisoning or DoS), so candidates mistakenly select options that are network attacks rather than information-gathering methods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
LDAP enumeration
LDAP enumeration is a valid enumeration technique because it involves querying a Lightweight Directory Access Protocol (LDAP) service to extract information about users, groups, computers, and other objects from a directory service like Microsoft Active Directory. Attackers use tools such as ldapsearch or ADExplorer to anonymously or authenticatedly browse the directory tree, revealing usernames, group memberships, and organizational units, which are critical for planning further attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
LDAP enumeration
Why this is correct
LDAP enumeration queries directory services.
- ✓
NetBIOS enumeration using nbtstat
Why this is correct
nbtstat is used for NetBIOS enumeration.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning is a man-in-the-middle attack.
- ✗
DNS cache poisoning
Why it's wrong here
DNS cache poisoning is an attack to redirect traffic.
- ✗
ICMP flooding
Why it's wrong here
ICMP flooding is a denial-of-service attack, not enumeration.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are enumeration techniques?
easy- A.Buffer overflow
- B.Cross-site scripting
- ✓ C.LDAP enumeration
- D.SQL injection
- ✓ E.SMTP enumeration
Why C: LDAP enumeration is a technique used to query Lightweight Directory Access Protocol (LDAP) directories, such as Microsoft Active Directory, to extract information about users, groups, computers, and network resources. Attackers use tools like ldapsearch or ADSI Edit to anonymously or authenticatedly browse the directory tree, often revealing sensitive data like usernames, email addresses, and group memberships. This is a core enumeration method because it directly targets directory services to gather reconnaissance data. SMTP enumeration involves querying an SMTP server to identify valid user accounts, often using commands like VRFY (verify) or EXPN (expand). This can reveal usernames that can then be used for further attacks like brute-forcing or phishing.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.