CEH Enumeration and System Hacking Practice Question
Which enumeration technique would be MOST effective for gathering usernames from an SMTP server that supports the VRFY command?
⚠ Common exam trap
Many exam-takers confuse VRFY with EXPN (which expands mailing lists) or assume any enumeration technique (like SNMP or LDAP) can be adapted to SMTP, but the question specifically ties the technique to the protocol command supported by the server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SMTP VRFY enumeration
The VRFY command is an SMTP protocol command (RFC 821) that allows a client to verify whether a specific mailbox exists on the server. Since the question explicitly states the SMTP server supports VRFY, sending VRFY requests with common usernames or using a wordlist directly enumerates valid usernames, making SMTP VRFY enumeration the most effective technique.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SNMP enumeration using SNMPwalk
Why it's wrong here
SNMPwalk is a utility designed to query devices that implement the Simple Network Management Protocol (SNMP), retrieving information from their Management Information Bases (MIBs). This protocol is primarily used for network device management, monitoring, and configuration, not for querying email server user accounts. Therefore, attempting to use SNMPwalk for enumerating user accounts on an SMTP server would be ineffective, as SNMP operates on a different protocol and data model entirely unrelated to email services.
- ✓
SMTP VRFY enumeration
Why this is correct
The SMTP VRFY command is specifically designed to verify the existence of a user on the mail server without actually sending an email. When an attacker sends a VRFY request with a potential username, the server responds by indicating whether the user exists, often revealing the full name or email address if present. This direct query capability makes VRFY an extremely effective and straightforward technique for enumerating valid user accounts on an SMTP server, provided the server has not been configured to disable or restrict this command.
- ✗
NetBIOS enumeration using nbtstat
Why it's wrong here
NetBIOS (Network Basic Input/Output System) is a session layer protocol primarily used for local area network (LAN) communication on Windows systems, facilitating name resolution and data transfer between computers. The `nbtstat` utility is specifically used to display NetBIOS over TCP/IP (NetBT) protocol statistics, NetBIOS name tables, and the NetBIOS name cache. It is entirely unrelated to email protocols like SMTP and cannot be used to query user accounts on an SMTP server, which operates at the application layer over TCP/IP.
- ✗
LDAP anonymous queries
Why it's wrong here
Lightweight Directory Access Protocol (LDAP) is an application protocol used for accessing and maintaining distributed directory information services, such as user accounts, groups, and network resources. While LDAP directories often store user information, performing anonymous queries against an LDAP server would only be effective for user enumeration if the target SMTP server integrates with an LDAP directory and allows unauthenticated access to user attributes. However, LDAP is a distinct protocol from SMTP, and directly querying an SMTP server using LDAP commands is not feasible for email user enumeration.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.