CEH Enumeration and System Hacking Practice Question
Which TWO tools can be used to enumerate SMB shares and users on a Windows target? (Choose two.)
⚠ Common exam trap
Many exam-takers confuse LDAP-based enumeration (ldapsearch) with SMB-based enumeration, or assume SNMP tools like snmpwalk can enumerate SMB shares, when in fact only tools that directly communicate over SMB/RPC (like smbclient and enum4linux) are appropriate for this task.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
smbclient
smbclient (A) is correct because its -L and -N options let you list SMB shares and, with -U, authenticate to enumerate shares and users on a Windows host over TCP 445/139. enum4linux (B) is correct because it wraps smbclient, rpcclient, and nmblookup to pull share lists, user lists, and group/password-policy data from SMB/RPC on Windows targets. nslookup (C) is wrong because it only queries DNS records and cannot touch SMB. snmpwalk (D) is wrong because it walks SNMP OIDs (UDP 161) and does not enumerate SMB shares or users. ldapsearch (E) is wrong because it queries LDAP directories (TCP 389/636) rather than SMB/RPC services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
smbclient
Why this is correct
smbclient is a powerful command-line utility for interacting with SMB/CIFS shares on Linux/Unix systems. It can be used to list available shares on a target host using the `-L` option, and with appropriate credentials, it can also enumerate users by attempting to connect to specific shares or by leveraging null sessions if permitted. This makes it a primary tool for SMB enumeration.
- ✓
enum4linux
Why this is correct
enum4linux is a wrapper script around the samba-utils tools, specifically designed to enumerate information from Windows and Samba hosts. It automates the process of extracting user lists, group memberships, share names, operating system information, and more, often leveraging null sessions or provided credentials to gather comprehensive details about SMB services. Its specialized design makes it highly effective for this task.
- ✗
nslookup
Why it's wrong here
nslookup is a network administration command-line tool used for querying the Domain Name System (DNS) to obtain domain name or IP address mapping or other DNS records. While it can resolve hostnames to IP addresses, it has no inherent capability to interact with or enumerate SMB shares or users directly. Its function is strictly limited to DNS resolution.
- ✗
snmpwalk
Why it's wrong here
snmpwalk is a utility that uses SNMP GETNEXT requests to query a network entity for a tree of information. It is designed to enumerate data from devices that support the Simple Network Management Protocol (SNMP), such as network devices and servers, to gather system information, network statistics, and more. It cannot interact with SMB services or enumerate SMB shares and users.
- ✗
ldapsearch
Why it's wrong here
ldapsearch is a command-line utility for querying directories that support the Lightweight Directory Access Protocol (LDAP), such as Active Directory or OpenLDAP. It allows users to search for entries, attributes, and organizational units within an LDAP directory. While it can enumerate users and groups stored in an LDAP directory, it does not directly interact with or enumerate SMB shares.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.