How should I use these Enumeration and System Hacking practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Enumeration and System Hacking questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Enumeration and System Hacking domain.

CEH · topic practice

Enumeration and System Hacking practice questions

Practise Certified Ethical Hacker CEH Enumeration and System Hacking practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Enumeration and System Hacking

Practice 10 questions Browse domain →

What the exam tests

What to know about Enumeration and System Hacking

Enumeration and System Hacking questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Enumeration and System Hacking exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Enumeration and System Hacking questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Enumeration and System Hacking explanation →

A security analyst wants to enumerate NetBIOS names on a Windows network. Which built-in Windows command-line tool should they use?

Trap 1: nslookup

nslookup is used for DNS queries, not NetBIOS enumeration.

Trap 2: netstat

netstat displays active TCP connections, listening ports, and network statistics, not NetBIOS names.

Trap 3: net view

net view displays shared resources on a network but does not enumerate NetBIOS names directly.

Study all Enumeration and System Hacking common traps →

A
nslookup
Why wrong: nslookup is used for DNS queries, not NetBIOS enumeration.
B
netstat
Why wrong: netstat displays active TCP connections, listening ports, and network statistics, not NetBIOS names.
C
nbtstat
nbtstat is the correct command for NetBIOS name resolution and enumeration.
D
net view
Why wrong: net view displays shared resources on a network but does not enumerate NetBIOS names directly.

Enumeration and System Hacking practice questions

What to know about Enumeration and System Hacking

Common Enumeration and System Hacking exam traps

Enumeration and System Hacking questions

A security analyst wants to enumerate NetBIOS names on a Windows network. Which built-in Windows command-line tool should they use?

During a penetration test, you gain access to a target system as a low-privileged user. Which of the following is the BEST next step according to the CEH system hacking methodology (CHPSET)?

A security analyst observes a suspicious SUID binary /usr/bin/evil in a Linux system. Which type of vulnerability does this indicate, and what is the MOST likely objective of an attacker who placed it?

A penetration tester runs the following command against a target Linux server: smbclient -L 192.168.1.10 -N. The output lists several shares including 'Admin$', 'C$', and 'IPC$'. Which of the following is the MOST likely next step for further enumeration?

An attacker uses the VRFY command on an SMTP server to check the existence of email addresses. The server responds with '250 OK' for 'admin@company.com' and '550 No such user' for 'fake@company.com'. Which SMTP enumeration technique is being used?

A security analyst finds multiple failed login attempts in the system logs, followed by a successful login from an unusual IP address. The attacker then deleted the log entries for that session. Which step of the system hacking methodology (CHPSET) does the log deletion represent?

Which of the following tools is specifically designed to perform password cracking using rainbow tables?

During a penetration test, you successfully execute a privilege escalation attack by abusing a service running with SYSTEM privileges on a Windows machine. Which of the following techniques is MOST likely being used?

A penetration tester executes the command: snmpwalk -c public -v2c 192.168.1.50. Which of the following BEST describes the purpose of this command?

A security analyst is investigating a compromised Linux system. The /var/log/auth.log file appears to be truncated, and the timestamps on several binaries in /bin/ have been modified. Which of the following tools or techniques is the attacker MOST likely using to cover tracks?

During a penetration test, you discover an LDAP server on port 389 that allows anonymous binds. Which of the following enumeration techniques would provide the MOST comprehensive information about the directory structure?

An attacker has gained access to a Windows server and wants to crack the password hashes extracted from the SAM file. The attacker knows the passwords are complex but wants to maximize speed. Which tool is BEST suited for high-speed password cracking using GPU acceleration?

Which TWO of the following are valid SMTP enumeration commands that can be used to discover valid email addresses? (Select 2)

Which TWO of the following are common tools used for SMB enumeration? (Select 2)

Which THREE of the following are password cracking techniques that can be used with Hashcat? (Select 3)

A security analyst runs `nbtstat -A 192.168.1.10` and receives output showing a table with names like COMPUTER<00>, COMPUTER<20>, and DOMAIN<1B>. What type of information has the analyst gathered?

During a penetration test, you execute the command `enum4linux -a 192.168.1.20`. The output reveals that the 'backup' account has a blank password and belongs to the 'Domain Admins' group. Which phase of the CHPSET methodology does identifying this vulnerability belong to?

An attacker has gained initial access to a Windows system and wants to escalate privileges to SYSTEM. They find that the SeImpersonatePrivilege is enabled for their current user. Which tool or technique is specifically designed to leverage this privilege for elevation?

A system administrator wants to enumerate all users in an Active Directory domain. Which protocol and query technique should they use?

Track your progress over time

Start a Enumeration and System Hacking only practice session

Related CEH topic practice pages

Footprinting, Reconnaissance and Scanning practice questions

Enumeration and System Hacking practice questions

Malware, Social Engineering and Network Attacks practice questions

Web Application and Injection Attacks practice questions

Introduction to Ethical Hacking practice questions

Scanning Networks and Enumeration practice questions

Vulnerability Analysis and System Hacking practice questions

Advanced Topics: Wireless, Cloud, IoT, Cryptography practice questions

Footprinting and Reconnaissance practice questions

Network and Web Application Attacks practice questions

Wireless, IoT and Cloud Security practice questions

Cryptography and Malware Analysis practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid