The answer is to use ldapsearch to query the directory for all attributes. This is correct because when an LDAP server on port 389 permits anonymous binds, it effectively grants unauthenticated read access to the entire directory tree, allowing ldapsearch to retrieve comprehensive information including user accounts, groups, organizational units, and all associated attributes. On the Certified Ethical Hacker CEH exam, this scenario tests your understanding of LDAP enumeration with anonymous bind as a critical reconnaissance technique, often appearing in questions about service misconfigurations and information gathering. A common trap is assuming you need credentials or only specific base DNs, but anonymous bind bypasses authentication entirely. Memory tip: think of “anonymous bind” as an open book—ldapsearch flips through every page, revealing the full directory structure without needing a library card.
CEH Enumeration and System Hacking Practice Question
This CEH practice question tests your understanding of enumeration and system hacking. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
During a penetration test, you discover an LDAP server on port 389 that allows anonymous binds. Which of the following enumeration techniques would provide the MOST comprehensive information about the directory structure?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use ldapsearch to query the directory for all attributes
Option C is correct because `ldapsearch` with anonymous bind allows querying the LDAP directory for all attributes and entries, providing comprehensive information about the directory structure, including user accounts, groups, organizational units, and other objects. LDAP servers on port 389 often expose the entire directory tree when anonymous binds are permitted, making `ldapsearch` the most effective enumeration technique.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Run nmap with the smb-enum-shares script
Why it's wrong here
SMB enumeration is for Windows file sharing, not LDAP directory services.
✗
Perform a DNS zone transfer
Why it's wrong here
DNS zone transfer reveals DNS records, not LDAP directory structure.
✓
Use ldapsearch to query the directory for all attributes
Why this is correct
ldapsearch can retrieve all objects and attributes from an LDAP directory, especially with anonymous bind.
Related concept
Read the scenario before looking for a memorised answer.
✗
Use net view to list domain resources
Why it's wrong here
net view is a Windows command that lists shared resources on the network, not LDAP directory information.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse LDAP enumeration with SMB or DNS enumeration, assuming any network discovery tool will work, but only LDAP-specific queries (like `ldapsearch`) can extract directory structure from an LDAP server.
Trap categories for this question
Command / output trap
net view is a Windows command that lists shared resources on the network, not LDAP directory information.
Detailed technical explanation
How to think about this question
LDAP anonymous binds are allowed by default in many directory services (e.g., OpenLDAP, Active Directory Lightweight Directory Services) unless explicitly restricted. Using `ldapsearch -x -h <target> -b "dc=domain,dc=com" "(objectClass=*)" *` retrieves all entries and attributes, including sensitive data like `userPassword` (if not hashed) or `memberOf`. In real-world scenarios, misconfigured LDAP servers have exposed entire corporate directories, leading to privilege escalation or lateral movement.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CEH question in full detail.
Enumeration and System Hacking — This question tests Enumeration and System Hacking — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use ldapsearch to query the directory for all attributes — Option C is correct because `ldapsearch` with anonymous bind allows querying the LDAP directory for all attributes and entries, providing comprehensive information about the directory structure, including user accounts, groups, organizational units, and other objects. LDAP servers on port 389 often expose the entire directory tree when anonymous binds are permitted, making `ldapsearch` the most effective enumeration technique.
What should I do if I get this CEH question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a penetration test, the tester runs `ldapsearch -x -H ldap://192.168.1.20 -b 'dc=domain,dc=com' '(objectclass=*)'`. The output reveals user objects with 'userPassword' attributes in clear text. Which type of enumeration is being performed, and what is the security implication?
hard
A.NFS enumeration; it indicates that NFS shares are world-readable
✓ B.LDAP enumeration; it indicates that the LDAP server stores passwords in plaintext, posing a credential theft risk
C.SNMP enumeration; it indicates that the community string is weak
D.SMTP enumeration; it indicates that the mail server is misconfigured
Why B: The `ldapsearch` command is used to query an LDAP directory service. The option `-x` specifies simple authentication, and the filter `(objectclass=*)` retrieves all entries. The output revealing `userPassword` attributes in clear text indicates that the LDAP server is storing passwords in plaintext, which is a severe security risk because an attacker can directly harvest credentials for lateral movement or privilege escalation.
Variation 2. During a penetration test, you need to enumerate all users and groups from a Windows domain controller. Which tool is BEST suited for this task?
medium
✓ A.ldapsearch
B.nbtstat
C.smbclient
D.snmpwalk
Why A: ldapsearch is the best tool for enumerating users and groups from a Windows domain controller because it directly queries the Active Directory LDAP directory service (port 389 or 636 for LDAPS) using standard LDAP search filters. This allows retrieval of all user and group objects, including their attributes, without relying on NetBIOS or SMB file sharing. It is the most efficient and comprehensive method for structured directory enumeration in a domain environment.
Variation 3. A penetration tester wants to enumerate users and groups from a Windows domain controller via LDAP without logging in. Which of the following tools is MOST appropriate for anonymous LDAP enumeration?
medium
A.smbclient
✓ B.ldapsearch
C.snmpwalk
D.enum4linux
Why B: LDAP enumeration can be performed anonymously if the server allows. Tools like `ldapsearch` or `adfind` can query LDAP. Among the options, `ldapsearch` is the standard tool.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.