312-50 Question 83
Single answer▪ Enumeration ConceptsDuring an authorized internal assessment, you discover that a Windows server in the target network exposes TCP 139 and 445. Your objective is to enumerate valid domain user accounts without attempting password guessing or causing account lockouts. Which action is the MOST appropriate next step?
- A
Use SMB/NetBIOS enumeration techniques such as null session checks or RPC-based queries to gather user and group information from the server
- B
Launch a SYN flood against port 445 to force the server to reveal active sessions and logged-in usernames
- C
Perform SQL injection testing against the server because TCP 445 commonly indicates a database service with account metadata
- D
Run a brute-force attack against SMB using a common password list to identify valid usernames from authentication failures
Show answer and explanation
Correct answer: A
Explanation
This question focuses on applying enumeration concepts in a realistic CEH-style scenario. When a Windows host exposes ports 139 and 445, that strongly suggests SMB/NetBIOS services are available. In the enumeration phase, an ethical hacker should first use protocol-appropriate methods to identify users, groups, shares, and other accessible metadata. This is safer and more precise than moving immediately to credential attacks. Microsoft documents SMB as the protocol used for shared access to files, printers, and interprocess communication, and RPC mechanisms are commonly leveraged for administrative and directory-related queries when permissions allow. From a best-practice standpoint, enumeration should remain aligned to the service discovered during scanning, minimize operational impact, and follow the rules of engagement. Therefore, SMB/NetBIOS/RPC enumeration is the most appropriate next step.
- A. Correct.
Correct. Ports 139 and 445 commonly indicate NetBIOS Session Service and Microsoft-DS/SMB exposure on Windows systems. In an enumeration phase, the appropriate next step is to use SMB/NetBIOS and RPC enumeration methods to query available information such as users, groups, shares, policies, and other domain-related details. Historically, tools and techniques such as enum4linux, smbclient, rpcclient, and native Windows RPC/SMB queries have been used for this purpose where access controls permit it. This aligns with enumeration concepts because it seeks to extract naming and account information without password spraying or brute-force activity.
- B. Incorrect.
Incorrect. A SYN flood is a denial-of-service technique, not an enumeration technique. It is disruptive, outside the scope of normal enumeration, and would not be an appropriate method for identifying valid usernames. Choosing this option reflects confusion between service disruption and information gathering.
- C. Incorrect.
Incorrect. TCP 445 is associated with SMB over TCP, not a database service. SQL injection is a web application/database attack technique and is unrelated to enumerating users from an SMB-exposed Windows host. This distractor targets the misconception that any exposed service can be tested with unrelated attack methods.
- D. Incorrect.
Incorrect. Brute-forcing SMB credentials is not the best next step when the goal is specifically to enumerate valid users without risking account lockouts. Authentication attacks are more intrusive and can trigger alerts or lockout policies. Enumeration should begin with lower-impact information gathering through SMB/RPC queries before considering authenticated testing, and only if permitted by the rules of engagement.