312-50 Question 88
Single answer▪ SNMP EnumerationDuring an authorized internal assessment, you discover that a core switch at 10.10.20.5 responds on UDP 161. The client wants to know whether misconfigured SNMP could expose useful intelligence for lateral movement and network mapping, but they want you to minimize disruption to production systems. Which action is the most appropriate next step to validate SNMP enumeration with the least intrusive approach?
- A
Use snmpwalk with the default community string "public" against 10.10.20.5 to query standard MIB objects such as system and interface information
- B
Launch a UDP flood against port 161 to force the device to reveal SNMP version details in its error responses
- C
Attempt to brute-force SNMPv3 authentication credentials using a high-rate password attack against the switch
- D
Connect to the switch over TCP 161 with telnet and manually request the routing table
Show answer and explanation
Correct answer: A
Explanation
The safest and most effective next step is to perform a read-only SNMP query using a standard enumeration tool such as snmpwalk, starting with likely community strings only if permitted by scope and rules of engagement. In real environments, insecure SNMPv1/v2c configurations can expose valuable information including system names, interface metadata, ARP entries, routing information, and sometimes installed software or process details depending on the host and MIB support. Best practice from vendors and security guidance is to disable SNMP if unused, avoid default community strings such as "public" and "private," restrict source IPs with ACLs, and prefer SNMPv3 with authentication and privacy. Standard references include Net-SNMP documentation for snmpwalk usage and vendor hardening guidance from Cisco and others on securing SNMP deployments.
- A. Correct.
Correct. SNMP enumeration in a controlled assessment typically begins with a low-impact query using read-only community strings that are commonly left at insecure defaults, especially "public" for SNMPv1/v2c. Using a tool such as snmpwalk to retrieve standard OIDs from MIB-II, including system (.1.3.6.1.2.1.1) and interfaces (.1.3.6.1.2.1.2), is a practical and minimally disruptive way to confirm whether the device exposes hostnames, interface descriptions, IP addressing clues, uptime, contact/location values, and other useful reconnaissance data. This directly aligns with SNMP enumeration goals in CEH-style scenarios.
- B. Incorrect.
Incorrect. A UDP flood is disruptive and does not represent a legitimate enumeration technique for a minimally intrusive validation step. It risks degrading network services and would be inappropriate in a production environment unless explicitly authorized as denial-of-service testing. SNMP version details are not normally validated by flooding a service.
- C. Incorrect.
Incorrect. Brute-forcing SNMPv3 credentials is far more aggressive than necessary and conflicts with the requirement to minimize disruption. SNMPv3 is designed to improve security with authentication and optional privacy, so a high-rate password attack is both noisy and potentially impactful. A better first step is to test for insecure read-only exposure via SNMPv1/v2c defaults or known authorized strings.
- D. Incorrect.
Incorrect. SNMP uses UDP, typically on port 161 for queries and 162 for traps, not a telnet session over TCP 161. This option reflects a protocol misunderstanding. Routing and interface data, if exposed, would be queried via OIDs using SNMP tools rather than by opening an interactive TCP connection.