Which statement best describes enumeration in security testing?

• A. The process of exploiting a known vulnerability.
• B. The process of encrypting data for secure transmission.
• C. The process of listing and detailing information about a target's system, accounts, and services.
• D. The process of archiving system logs.

Answer: (C)

Enumeration in security testing is the phase where you move from general discovery to collecting specific, actionable details about the target. This means listing and detailing information such as user accounts, group memberships, network shares, machine names, open ports, service names and versions, and other identifiable data about the system. The goal is to build a precise map of what exists on the target so you can plan further steps like vulnerability assessment or potential exploitation.

This approach is different from simply identifying that a service exists (scanning) or from actively exploiting a vulnerability. It’s also not about encrypting data or archiving logs. By compiling a detailed picture of users, services, configurations, and access points, enumeration reveals the attack surface and helps prioritize where to look next.