A penetration tester is enumerating a Windows server that appears to have SMB enabled. The tester wants to list all accessible SMB shares and also retrieve the NetBIOS name table of the target. Which combination of commands will accomplish both tasks?

smbclient -L // -U guest and nbtstat -a

smbclient // /share and nbtstat -n

A security team is hardening a network that currently exposes NetBIOS, SNMP, LDAP, and SMB services. The team wants to implement countermeasures that reduce enumeration risk across all four services. Which of the following actions are appropriate countermeasures? (Select all that apply.)

Change SNMP community strings to strong, non-default values.

Disable NetBIOS over TCP/IP on hosts that do not require it.

Enable SNMP traps on all devices.

Disable SMBv1 and restrict SMB share permissions.

Which NetBIOS service name and UDP port combination is commonly associated with the NetBIOS Name Service, which is used to resolve NetBIOS names to IP addresses?

NetBIOS Name Service, UDP port 137

NetBIOS Session Service, TCP port 139

Server Message Block (SMB), TCP port 445

NetBIOS Datagram Service, UDP port 138

A penetration tester is assessing a Windows network that has both SMB and NetBIOS enabled. The tester needs to enumerate SMB shares and also identify the NetBIOS names of the hosts. The tester has a valid domain account but wants to minimize the number of tools used. Which approach is most efficient?

Use net view to list shares and ping -a to resolve NetBIOS names.

Use nmap with the smb-enum-shares and nbstat scripts.

Use smbclient to list shares and nbtstat to query NetBIOS names.

Use enum4linux with the -a flag to perform a comprehensive enumeration that includes SMB shares and NetBIOS information.

A penetration tester is enumerating SMB shares on a Windows server and wants to connect to a share named 'Data' anonymously. Which command should the tester use?

smbclient //server/Data -U guest

EC-CouncilCertified Ethical Hacker

Domain 2Objective 6

Enumeration (NetBIOS, SNMP, LDAP, SMB) CEH Practice Questions (Page 3)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

5concepts

Questions 11–15

11application · medium
A penetration tester is enumerating a Windows server that appears to have SMB enabled. The tester wants to list all accessible SMB shares and also retrieve the NetBIOS name table of the target. Which combination of commands will accomplish both tasks?
Select an answer first
12expert · hard · select all that apply
A security team is hardening a network that currently exposes NetBIOS, SNMP, LDAP, and SMB services. The team wants to implement countermeasures that reduce enumeration risk across all four services. Which of the following actions are appropriate countermeasures? (Select all that apply.)
Select an answer first
13foundation · easy
Which NetBIOS service name and UDP port combination is commonly associated with the NetBIOS Name Service, which is used to resolve NetBIOS names to IP addresses?
Select an answer first
14expert · hard
A penetration tester is assessing a Windows network that has both SMB and NetBIOS enabled. The tester needs to enumerate SMB shares and also identify the NetBIOS names of the hosts. The tester has a valid domain account but wants to minimize the number of tools used. Which approach is most efficient?
Select an answer first
15application · medium
A penetration tester is enumerating SMB shares on a Windows server and wants to connect to a share named 'Data' anonymously. Which command should the tester use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.