The correct answer is D, SMB enumeration. RID cycling is a Windows/SMB enumeration technique used to discover valid user and group accounts by cycling through Relative Identifiers, or RIDs, within Windows Security Identifiers, or SIDs. In Windows, a SID identifies a user, group, or computer account, while the RID is the final portion of the SID that identifies the specific account. CEH-related material explains that RIDs such as 500 identify the Administrator account, 501 identifies Guest, and normal user accounts commonly begin around 1000. During SMB or NetBIOS enumeration, attackers query SMB-accessible systems to retrieve users, groups, shares, machines, and SIDs. RID cycling uses this SID/RID structure to test sequential RID values and map them back to account names. It is not SQL injection, denial of service, or a DNS attack. Therefore, RID cycling belongs to SMB enumeration.
