CEH Scanning Networks and Enumeration Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  List of running processes

  Why this is correct

  SNMP agents can provide a comprehensive list of running processes on a managed device. This information is typically found within the Host Resources MIB (RFC 2790), specifically by querying objects like `hrSWRunTable`. This table contains details such as process ID, name, path, and current status, which is crucial for system monitoring and troubleshooting.

• ✗

  Captured network packets

  Why it's wrong here

  Captured network packets cannot be obtained directly through SNMP. SNMP is a protocol designed for managing and monitoring network devices by collecting specific management information from MIBs, not for intercepting or storing the actual data plane traffic. Tools like Wireshark or tcpdump are used for packet capture, operating at a lower level of the network stack.

• ✗

  User account passwords

  Why it's wrong here

  User account passwords are not stored in SNMP Management Information Bases (MIBs) and therefore cannot be obtained via SNMP queries. Storing sensitive credentials like passwords in MIBs would represent a severe security vulnerability, as SNMP community strings, especially in versions 1 and 2c, are often transmitted in cleartext. MIBs are designed to store operational and configuration data, not authentication secrets.

• ✗

  Modify network interface settings

  Why it's wrong here

  While SNMP can be used to modify network interface settings if write access is configured (e.g., via a specific write community string in SNMPv1/v2c or authenticated write operations in SNMPv3), the question specifically asks what *information can be obtained*. Modifying settings is an *action* or *configuration task*, not the *retrieval of information*. Therefore, this option describes an operational capability rather than an informational retrieval.

• ✓

  Routing table entries

  Why this is correct

  SNMP agents can readily provide detailed routing table entries from a managed network device. This critical network information is typically exposed through the `ipRouteTable` object within the IP-MIB (RFC 4293), which contains entries for all active routes, including destination, next hop, interface, and metric. Obtaining this data is fundamental for network topology mapping and performance analysis.

Go deeper

Related to this question