CEH Enumeration and System Hacking Practice Question
Which TWO of the following are valid methods for enumerating users on a SMTP server? (Select 2)
⚠ Common exam trap
Candidates often confuse RCPT TO (which can indirectly reveal user existence through response codes) with a dedicated enumeration command, but the CEH exam specifically expects VRFY and EXPN as the two valid SMTP enumeration methods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EXPN
EXPN (Expand) and VRFY (Verify) are SMTP commands defined in RFC 821 that allow an attacker to enumerate valid email addresses and mailing list members on a mail server. EXPN reveals the members of a mailing list, while VRFY confirms whether a specific mailbox exists. Both commands are often disabled in production to prevent user enumeration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
EXPN
Why this is correct
The SMTP EXPN (Expand) command is a valid method for enumerating users by requesting the expansion of a mailing list or alias. When a server processes an EXPN command for a known list, it typically returns the individual email addresses of all members, thereby revealing valid user accounts on the system. This direct disclosure of recipient lists makes it a powerful tool for reconnaissance during the enumeration phase.
- ✗
MAIL FROM
Why it's wrong here
The MAIL FROM command in SMTP is used to specify the sender's email address for the current mail transaction. Its primary function is to inform the receiving server of the message's origin, which is crucial for delivery and bounce-back notifications. This command does not inherently provide a mechanism to query or discover valid user accounts on the target system, making it unsuitable for enumeration purposes.
- ✗
RCPT TO
Why it's wrong here
The RCPT TO command designates the recipient of an email message within an SMTP session. While an attacker might infer valid users by observing differing server responses (e.g., "User unknown" vs. "OK") to numerous RCPT TO attempts, this is an indirect method of enumeration. Unlike VRFY and EXPN, RCPT TO is fundamentally designed for specifying message delivery, not for directly querying user existence or list membership.
- ✓
VRFY
Why this is correct
The SMTP VRFY (Verify) command is a direct method for enumerating valid user accounts on a mail server. When an attacker sends a VRFY command with a potential username, the server responds by confirming whether that user exists on the system, often returning the full name or email address if valid. This explicit verification capability makes VRFY a straightforward and powerful tool for identifying active user accounts.
- ✗
AUTH
Why it's wrong here
The AUTH command in SMTP is specifically designed for client authentication, allowing a sender to prove their identity to the mail server before relaying messages. Its purpose is to establish a secure and authorized session, typically involving credentials like username and password. This command does not provide any functionality to discover or verify the existence of other user accounts on the system, making it irrelevant for enumeration.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.