nerdexam
EC-Council

312-50V12 · Question #229

As a certified ethical hacker, you are tasked with gaining information about an enterprise's internal network. You are permitted to test the network's security using enumeration techniques. You…

The correct answer is B. Exploit the NetBIOS Session Service on TCP port 139 to gain unauthorized access to the file. Given identified open ports 25 (SMTP) and 139 (NetBIOS), the most logical enumeration next step is to exploit the NetBIOS Session Service on port 139 to enumerate shared resources, usernames, and system information.

Submitted by ricky.ec· Mar 4, 2026Reconnaissance Techniques

Question

As a certified ethical hacker, you are tasked with gaining information about an enterprise's internal network. You are permitted to test the network's security using enumeration techniques. You successfully obtain a list of usernames using email IDs and execute a DNS Zone Transfer. Which enumeration technique would be most effective for your next move given that you have identified open TCP ports 25 (SMTP) and 139 (NetBIOS Session Service)?

Options

  • APerform a brute force attack on Microsoft Active Directory to extract valid usernames
  • BExploit the NetBIOS Session Service on TCP port 139 to gain unauthorized access to the file
  • CUse SNMP to extract usernames given the community strings
  • DExploit the NFS protocol on TCP port 2049 to gain control over a remote system

How the community answered

(37 responses)
  • A
    3% (1)
  • B
    78% (29)
  • C
    14% (5)
  • D
    5% (2)

Why each option

Given identified open ports 25 (SMTP) and 139 (NetBIOS), the most logical enumeration next step is to exploit the NetBIOS Session Service on port 139 to enumerate shared resources, usernames, and system information.

APerform a brute force attack on Microsoft Active Directory to extract valid usernames

A brute force attack on Active Directory is an attack technique rather than an enumeration technique, and it is not directly tied to the identified open ports 25 or 139, making it a less targeted and less appropriate next move in this context.

BExploit the NetBIOS Session Service on TCP port 139 to gain unauthorized access to the fileCorrect

TCP port 139 (NetBIOS Session Service) is a well-known enumeration target that allows attackers to query shared resources, user accounts, group memberships, and system details using tools like NBTScan, enum4linux, or net use commands. Since the port is confirmed open and the tester already has a username list, NetBIOS enumeration is the most direct and contextually relevant next step. This technique is a core part of CEH enumeration methodology specifically because it leverages an identified open port to extract actionable internal network intelligence.

CUse SNMP to extract usernames given the community strings

SNMP enumeration requires open UDP port 161 and knowledge of community strings, neither of which has been identified as available in this scenario, making it an unsupported choice given the discovered open ports.

DExploit the NFS protocol on TCP port 2049 to gain control over a remote system

NFS enumeration operates on TCP port 2049, which has not been identified as open in this scenario, so exploiting NFS would not be a logical next step based on the available port information.

Concept tested: NetBIOS enumeration using identified open TCP ports

Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/direct-hosting-of-smb-over-tcpip

Topics

#Network enumeration#NetBIOS exploitation#Open ports#SMTP enumeration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice