312-50 Question 84
Single answer▪ Enumeration ConceptsDuring an authorized internal assessment, you identify a legacy Windows file server with TCP 139 and 445 open. The client wants to know whether null sessions are still enabled so you can enumerate user and share information without credentials. Which action would be the most appropriate first step to confirm this enumeration weakness?
- A
Attempt an anonymous SMB/IPC$ connection and then query available shares or users using SMB/RPC-based enumeration tools
- B
Run a full TCP SYN port scan against all hosts in the subnet to identify additional SMB services before testing the server
- C
Perform a UDP scan of ports 137 and 161 to determine whether SNMP community strings can reveal Windows account details
- D
Launch a password-spraying attack against the server's SMB service to see whether weak credentials allow share enumeration
Show answer and explanation
Correct answer: A
Explanation
Enumeration focuses on actively extracting useful details such as users, shares, groups, hostnames, and services after initial discovery. In Windows environments, SMB/NetBIOS-based enumeration has historically included null session testing, where anonymous connections to IPC$ could permit unauthenticated access to limited RPC or share information. The most appropriate approach is to test anonymous SMB/IPC$ access directly and then attempt controlled enumeration of shares or account information. This aligns with common penetration testing methodology: validate the suspected exposure with the most specific and minimally invasive technique first. Relevant technical background comes from Microsoft SMB/NetBIOS behavior and long-standing security guidance around restricting anonymous access, null sessions, and anonymous SID/share enumeration. In practice, modern Windows systems usually restrict this by default, but legacy systems or misconfigurations may still allow it.
- A. Correct.
Correct. In Windows/SMB enumeration, the practical way to verify a null session issue is to attempt an anonymous connection to IPC$ or SMB and then query shares, users, groups, or related RPC information. This directly tests whether unauthenticated enumeration is possible, which is the weakness the client asked you to validate. In CEH-style scenarios, this is the most targeted and least intrusive first step when 139/445 are open and null session exposure is suspected.
- B. Incorrect.
Incorrect. A broader SYN scan may identify other hosts, but it does not confirm whether this specific server permits anonymous SMB enumeration. The scenario already provides the relevant finding: the target server has 139 and 445 open. Continuing with broad discovery delays validation of the actual suspected weakness and is not the best first step for enumeration confirmation.
- C. Incorrect.
Incorrect. UDP 137 can be useful for NetBIOS name-related information, and UDP 161 may expose data through SNMP if misconfigured, but those checks do not directly confirm whether SMB null sessions are enabled on this server. This option reflects a common misconception that any Windows information leak is interchangeable with SMB null session validation. It is not the most direct or appropriate test for the stated objective.
- D. Incorrect.
Incorrect. Password spraying is an authentication attack, not a null-session enumeration check. It is also noisier, riskier, and unnecessary when the goal is specifically to determine whether information can be gathered without credentials. In a professional assessment, you should first use the least intrusive method that directly answers the client's question.