312-50 Question 108
Single answerenumeration)During an internal CEH-authorized assessment, you discover a Windows Server that exposes TCP 135, 139, and 445. The client wants you to identify valid domain user accounts without attempting password attacks or making disruptive changes. Which action is the most appropriate enumeration step to gather usernames from this host in a practical and low-impact way?
- A
Use rpcclient to query SAMR/LSA information over SMB/RPC, such as enumdomusers, if the server permits anonymous or authenticated enumeration
- B
Run a SYN flood against TCP 445 to force the SMB service to reveal active user sessions in error responses
- C
Send repeated ARP requests to the server and parse the MAC address table to recover domain usernames
- D
Use traceroute to identify intermediate routers and infer usernames from hop naming conventions
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use SMB/RPC-based enumeration, such as rpcclient against Microsoft services exposed on ports 139/445 and RPC endpoint mapping on 135. In real assessments, enumeration is the phase where the tester extracts useful details such as usernames, groups, shares, and policies from accessible services. For Windows environments, SAMR and LSA RPC interfaces are classic sources of account information when anonymous enumeration is allowed or when valid credentials are provided. This is consistent with Microsoft RPC/SMB behavior and common security guidance that recommends restricting anonymous SID/NAME translation and SAMR enumeration. By contrast, flooding, ARP inspection, and traceroute do not provide account enumeration and either introduce unnecessary risk or target the wrong layer of the network stack.
- A. Correct.
Correct. On Windows networks, SMB/RPC-based enumeration through interfaces such as SAMR and LSA is a standard, low-impact way to enumerate domain or local user information when permissions allow it. Tools such as rpcclient can query functions like enumdomusers, querydispinfo, and related RPC calls. This aligns with practical enumeration activity in CEH: collecting account information from exposed Microsoft services without immediately moving into authentication attacks.
- B. Incorrect.
Incorrect. A SYN flood is a denial-of-service technique, not an enumeration method, and it violates the requirement to avoid disruptive activity. SMB services do not expose usernames through being flooded with half-open connections; using a flood here would be both noisy and operationally inappropriate.
- C. Incorrect.
Incorrect. ARP operates at Layer 2 for IP-to-MAC resolution on the local segment. It can help identify hosts, not domain usernames. MAC address information does not contain Windows account data, so this reflects a misunderstanding between host discovery and account enumeration.
- D. Incorrect.
Incorrect. Traceroute helps map network paths and identify routing hops. Although hostnames along the path may reveal infrastructure naming patterns, traceroute does not enumerate user accounts from a Windows server. This is network reconnaissance, not user enumeration.