nerdexam
EC-Council

312-50V12 · Question #20

Allen, a professional pen tester, was hired by XpertTech Solutions to perform an attack simulation on the organization's network resources. To perform the attack, he took advantage of the NetBIOS…

The correct answer is C. <03>. This question tests knowledge of NetBIOS name service codes used during enumeration to identify specific services running on a target system.

Submitted by weili_xi· Mar 4, 2026System Hacking Phases and Attack Techniques

Question

Allen, a professional pen tester, was hired by XpertTech Solutions to perform an attack simulation on the organization's network resources. To perform the attack, he took advantage of the NetBIOS API and targeted the NetBIOS service. By enumerating NetBIOS, he found that port 139 was open and could see the resources that could be accessed or viewed on a remote system. He came across many NetBIOS codes during enumeration. Identify the NetBIOS code used for obtaining the messenger service running for the logged-in user?

Options

  • A<00>
  • B<20>
  • C<03>
  • D<1B>

How the community answered

(19 responses)
  • C
    95% (18)
  • D
    5% (1)

Why each option

This question tests knowledge of NetBIOS name service codes used during enumeration to identify specific services running on a target system.

A<00>

NetBIOS code <00> is associated with the Workstation Service (for hostnames) or Domain Name (for domain entries), not the Messenger service.

B<20>

NetBIOS code <20> represents the File Server Service (Server service), which indicates that the system is sharing files and resources, not the Messenger service.

C<03>Correct

NetBIOS code <03> is the suffix code associated with the Messenger Service, which is registered for the logged-in username on a Windows system. During NetBIOS enumeration, this code appearing next to a username indicates the Messenger service is active for that user, making it a valuable target for identifying active sessions and logged-in users on a remote host.

D<1B>

NetBIOS code <1B> is used to identify the Domain Master Browser, which is the system responsible for maintaining the browse list for a domain, not the Messenger service.

Concept tested: NetBIOS name suffix codes and service identification

Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/netbios-suffix-15th-character-of-netbios-name

Topics

#NetBIOS enumeration#messenger service#port 139

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice