How does an account lockout policy help mitigate user enumeration?

It prevents attackers from making unlimited login attempts to guess valid usernames

It hides the existence of user accounts from the login page

It encrypts all login traffic to prevent interception

It requires users to change their passwords regularly

An Active Directory environment was found to allow unauthenticated users to query domain information via LDAP and SMB. The security team wants to reduce enumeration while maintaining normal operations for authenticated users. Which set of changes is most appropriate?

Disable SMB entirely and use only LDAP for all file access.

Disable anonymous LDAP binds and enforce SMB signing.

Enable LDAP over TLS and leave anonymous binds enabled.

Set all user accounts to require smart card login.

A small business wants to secure its Wi-Fi network against wardriving and unauthorized enumeration of connected devices. They currently use WPA2-PSK with a short passphrase and broadcast the SSID. Which change is most effective?

Change the SSID to a non-descriptive name and keep WPA2-PSK with the current passphrase.

Reduce the transmit power of the access point to cover only the office.

Use WPA3 or WPA2 with a long, random passphrase and disable SSID broadcast.

Enable MAC filtering and keep the SSID broadcast.

Why is disabling SMBv1 an important countermeasure against SMB enumeration?

SMBv1 is outdated and lacks modern security features, making it easier for attackers to enumerate and exploit

SMBv1 is the only protocol that supports file sharing on modern Windows systems

SMBv1 is required for all network printing services

SMBv1 provides encryption by default, so disabling it would increase risk

Which DNS security measure is specifically designed to prevent unauthorized zone transfers?

Restricting zone transfers to authorized secondary DNS servers only

Using DNSSEC to sign DNS records

Configuring the DNS server to use a non-standard port

Disabling recursion on the DNS server

EC-CouncilCertified Ethical Hacker

Domain 2Objective 7

Enumeration Countermeasures CEH Practice Questions (Page 10)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

16concepts

16 Concepts in This Objective

Enumeration Countermeasures Overview
Network Enumeration Countermeasures
Port Scanning Countermeasures
Service Enumeration Countermeasures
SNMP Enumeration Countermeasures
DNS Enumeration Countermeasures
Active Directory Enumeration Countermeasures
SMB Enumeration Countermeasures
LDAP Enumeration Countermeasures
Email Enumeration Countermeasures
User Enumeration Countermeasures
Web Enumeration Countermeasures
Wireless Enumeration Countermeasures
Cloud Enumeration Countermeasures
IoT Enumeration Countermeasures
Enumeration Countermeasure Tools and Techniques

Questions 46–50

46foundation · easy
How does an account lockout policy help mitigate user enumeration?
Select an answer first
47application · medium
An Active Directory environment was found to allow unauthenticated users to query domain information via LDAP and SMB. The security team wants to reduce enumeration while maintaining normal operations for authenticated users. Which set of changes is most appropriate?
Select an answer first
48application · medium
A small business wants to secure its Wi-Fi network against wardriving and unauthorized enumeration of connected devices. They currently use WPA2-PSK with a short passphrase and broadcast the SSID. Which change is most effective?
Select an answer first
49foundation · easy
Why is disabling SMBv1 an important countermeasure against SMB enumeration?
Select an answer first
50foundation · easy
Which DNS security measure is specifically designed to prevent unauthorized zone transfers?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.