CEH Scanning Networks and Enumeration Practice Question
You are a penetration tester assessing a client's internal network. The client has provided you with a non-administrative domain user account. The target network consists of 200 Windows workstations and 5 Windows servers (one domain controller, one file server, two application servers, and one database server). All systems are fully patched and have host-based firewalls enabled. The client wants you to identify vulnerabilities that could be exploited from the internal network. After initial reconnaissance, you discover that all servers have SMB (port 445) open only to the domain controller and the file server has SMB open to all workstations. You have gained a foothold on a workstation via a phishing attack. From this workstation, you can reach the file server on port 445. What is the most effective next step to enumerate potential vulnerabilities on the file server?
⚠ Common exam trap
Candidates often assume a full vulnerability scan (Option C) is always the best next step, but in a stealthy penetration test with limited credentials, targeted SMB enumeration (Option D) is more effective and less likely to be detected.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enumerate SMB shares and session information using `net view \\fileserver` and `smbclient -L //fileserver`.
The client's objective is to enumerate potential vulnerabilities on the file server from the compromised workstation. Since SMB (port 445) is open between workstations and the file server, using `net view \\fileserver` and `smbclient -L //fileserver` allows you to list SMB shares, sessions, and other information without requiring administrative privileges or additional tools. This is a standard enumeration technique that reveals accessible resources, which can then be tested for misconfigurations or weak permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attempt to connect to the file server via RDP (port 3389) using the compromised user's credentials.
Why it's wrong here
Attempting to connect via RDP (port 3389) to a file server with limited user credentials is generally ineffective. File servers are primarily designed for data storage and sharing, not interactive desktop access, meaning RDP is often disabled or restricted to administrative accounts. Even if the port were open, a standard compromised user account from a workstation would almost certainly lack the necessary "Remote Desktop Users" group membership on the server to establish a session.
- ✗
Use PsExec to execute commands remotely on the file server using the compromised user account.
Why it's wrong here
Using PsExec to execute commands remotely on a file server requires elevated privileges, specifically local administrator rights on the target system. A compromised standard user account from a workstation will not possess these administrative credentials on the file server. Consequently, any attempt to use PsExec would result in an "Access Denied" error, making it an unsuitable initial reconnaissance or lateral movement technique without prior privilege escalation.
- ✗
Run a full vulnerability scan (e.g., Nessus) against the entire subnet to identify weaknesses.
Why it's wrong here
Running a full subnet vulnerability scan from a single compromised workstation would generate excessive network traffic and trigger host-based firewall alerts, as the file server’s SMB port is only open to workstations, not to a scanning tool’s IP range. This approach is tempting because Nessus is designed to systematically identify missing patches and misconfigurations across many hosts, and it would be correct if the client had granted administrative credentials and the firewall rules permitted broad scanning.
- ✓
Enumerate SMB shares and session information using `net view \\fileserver` and `smbclient -L //fileserver`.
Why this is correct
Enumerating SMB shares and session information using `net view \\fileserver` (on Windows) or `smbclient -L //fileserver` (on Linux/Kali) is a highly effective and low-impact reconnaissance method. These commands leverage the Server Message Block (SMB) protocol, the file server's core service, to list accessible shares and potential misconfigurations like null sessions. This approach directly targets the server's primary function and is designed to work even with standard user permissions, providing valuable insights into accessible resources.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.