CEH v13 Enumeration Practice Questions 2026

Extracting usernames, shares, and service details via SMB, LDAP, SNMP, NetBIOS, and SMTP enumeration. Exam focus: map each protocol to the information it leaks — SMB shares, LDAP users, SNMP strings, NetBIOS names, SMTP users — and recognize the unconfigured service behind every "which source was exposed" scenario.

⚠️ Important Disclaimer: These practice questions are original study material created by CEHStudy for educational purposes. They are NOT EC-Council exam questions and do NOT replicate the actual exam. CEHStudy is not affiliated with or endorsed by EC-Council.

Question 1: SNMP enumeration with the default community strings 'public' and 'private' is commonly performed with:

A) enum4linux B) aircrack-ng C) snmpwalk / snmpget D) sqlmap

Answer: C — snmpwalk/snmpget traverse the MIB tree; unchanged default communities let attackers pull system info, interfaces, and routing tables.

Question 2: The default ports used by LDAP are:

A) 161 and 162 B) 137 and 138 C) 389 (unencrypted) and 636 (LDAPS) D) 25 and 110

Answer: C — LDAP listens on 389, LDAPS on 636. Port 161/162 is SNMP; 137/138 is NetBIOS; 25/110 are SMTP/POP3.

Question 3: NetBIOS names (computer names, usernames, workgroups) can be enumerated via which service port?

A) 139 — NetBIOS Session Service B) 3268 C) 636 D) 8080

Answer: A — NetBIOS uses ports 137 (Name Service), 138 (Datagram), and 139 (Session); tools like nbtscan, enum4linux, and rpcclient abuse these to enumerate Windows hosts.

Question 4: Which SMTP commands can be abused to verify whether a user account exists?

A) NOOP and QUIT only B) VRFY and EXPN C) DATA and RSET only D) STARTTLS and EHLO

Answer: B — VRFY asks the server to confirm an address and EXPN expands mailing lists; if left enabled they hand attackers valid usernames (tools: smtp-user-enum, Swaks).

Question 5: The term 'enumeration' refers to:

A) Scanning for open ports only B) Cracking password hashes C) Extracting usernames, hostnames, IPs, and service details beyond simply finding open ports D) Exploiting a confirmed vulnerability

Answer: C — Enumeration takes scanning one step further by pulling actionable intelligence — accounts, shares, services — that can be targeted in the next attack phase.

Question 6: enum4linux is a tool for enumerating:

A) SMTP servers B) NetBIOS/SMB (Windows) systems such as users, groups, and shares C) SNMP routers D) DNS zones

Answer: B — enum4linux wraps rpcclient, smbclient, and nmblookup to enumerate Windows/Active Directory hosts over SMB and NetBIOS.

Question 7: A successful SNMP walk using the default 'public' community can reveal:

A) Email message contents B) Application source code C) System information, interface statistics, and routing tables D) User password hashes

Answer: C — 'public' is read-only, so it leaks system details (uptime, hostname, interfaces, routes) — a rich passive-recon goldmine, but not passwords or email.

Question 8: The ldapsearch utility is used to enumerate:

A) HTTP request smuggling bugs B) LDAP directory contents such as users, groups, and organizational units C) ICMP response times D) Wireless access points

Answer: B — ldapsearch issues LDAP queries against directory servers (e.g., Active Directory over LDAP) to extract user lists and group memberships.

Question 9: Compared to scanning, enumeration differs because it:

A) Never interacts with the target B) Extracts actionable account and service details from the target C) Only maps which ports are open D) Is always passive and unloggable

Answer: B — Scanning tells you what's listening; enumeration interrogates those services to learn usernames, shares, versions, and structure.

Question 10: Swaks is a tool used to:

A) Scan wireless networks B) Craft and test SMTP transactions to enumerate mail servers C) Fuzz web applications D) Parse PCAP files

Answer: B — Swaks (Swiss Army Knife for SMTP) sends custom SMTP commands — handy for VRFY/EXPN enumeration and mail-server misconfiguration testing.

Related Glossary Terms

Continue Your CEH v13 Prep

Frequently Asked Questions

How many CEH v13 Enumeration practice questions are on this page?

This page includes 10 original multiple-choice practice questions for CEH v13 Module 4 (Enumeration). Each question includes a detailed explanation of the correct answer and why the other options are wrong. The full CEHStudy question bank covers all 20 modules with 200+ questions — see the practice hub at https://cehstudy.com/ceh-practice-questions/ for every module.

What does CEH v13 Module 4 (Enumeration) cover?

Extracting usernames, shares, and service details via SMB, LDAP, SNMP, NetBIOS, and SMTP enumeration. These are the same topics tested under this module on the EC-Council 312-50 exam. Pair this quiz with our free Module 4 flashcards at https://cehstudy.com/ceh-v13/module-04/ to close any gaps.

Are these real CEH exam questions?

No. Every question on CEHStudy is original study material written for exam preparation. They match the style, difficulty, and domain coverage of the actual CEH v13 exam but are not leaked or reproduced EC-Council questions.

How should I use this Enumeration quiz for exam prep?

Answer all 10 questions without peeking at explanations, then click "Show My Score". Review every explanation — especially the ones you missed — and re-test those topics with our free CEH flashcards. Aim for 80% or higher on module quizzes before scheduling the exam.

Where do I find CEH Enumeration flashcards?

Our free flashcard app covers all 20 CEH v13 modules including Module 4 (Enumeration). Visit the CEH flashcards page at https://cehstudy.com/ or the Module 4 page at https://cehstudy.com/ceh-v13/module-04/. No account or sign-up required.

CEH v13 Module 4: Enumeration — Free Practice Questions with Explanations