312-50 Question 82
Single answer▪ Enumeration ConceptsDuring an authorized internal assessment of a Windows-based corporate network, you have already identified a domain controller with TCP 389, 445, and 139 open. Your objective is to enumerate valid domain user accounts as quietly as possible before attempting any password attacks. Which action is the most appropriate next step?
- A
Use an SMB/RPC-based enumeration tool such as enum4linux-ng or rpcclient to query user and group information from the target
- B
Launch a SYN flood against port 389 to force the domain controller to reveal active sessions and usernames
- C
Run a vulnerability scanner in aggressive mode against the entire subnet to identify default credentials on all hosts
- D
Perform ARP spoofing against the default gateway to capture Kerberos tickets and extract usernames from decrypted traffic
Show answer and explanation
Correct answer: A
Explanation
The scenario is about enumeration, not exploitation or denial of service. Once a tester identifies a Windows domain controller exposing SMB/NetBIOS/RPC-related services, a logical next step is to query those services for account and group information using enumeration tools such as rpcclient, enum4linux-ng, or similar SMB/RPC-aware utilities. In CEH, enumeration focuses on extracting information from services like SMB, LDAP, SNMP, and DNS after scanning identifies reachable targets. Microsoft Active Directory environments commonly expose useful account metadata through SMB/RPC and LDAP depending on configuration and permissions. Best practice in professional assessments is to use the least disruptive technique that directly answers the objective. Documentation and operational guidance from Microsoft on SMB/RPC, LDAP, and Active Directory administration support the fact that these services are central sources of directory and account information, while DoS and broad aggressive scans are not appropriate enumeration-first choices.
- A. Correct.
Correct. In a Windows domain environment, enumeration commonly leverages SMB, NetBIOS, and RPC services exposed on ports such as 139 and 445. Tools like rpcclient and enum4linux-ng can enumerate users, groups, shares, password policy, and other domain information when the target configuration permits it. This is aligned with CEH-style enumeration concepts: using available services to gather account information prior to password attacks. It is also quieter and more targeted than broad scanning or disruptive techniques.
- B. Incorrect.
Incorrect. A SYN flood is a denial-of-service technique, not an enumeration method. It does not help enumerate domain users and would violate the goal of being quiet and minimally disruptive. This option reflects a common misconception that any interaction with a service can produce useful identity data; in reality, flooding traffic degrades availability rather than extracting directory information.
- C. Incorrect.
Incorrect. An aggressive vulnerability scan across the subnet is much noisier than necessary and is not the most appropriate next step when the specific goal is to enumerate valid domain accounts from a known domain controller. Vulnerability scanning may identify weaknesses, but it is not a focused enumeration technique for retrieving domain user lists and may trigger detections early.
- D. Incorrect.
Incorrect. ARP spoofing is a man-in-the-middle technique used to intercept local network traffic, but it is not the best initial step for quiet user enumeration from a known domain controller. Additionally, Kerberos traffic is not something you can simply decrypt in transit to obtain usernames and credentials without the appropriate keys. While usernames may appear in some authentication exchanges, this method is more complex, riskier, and less appropriate than directly querying exposed enumeration services.