CEH Wireless Network Hacking 3

Question 1

WPA3's Simultaneous Authentication of Equals (SAE) replaces PSK to defend against which specific attack class?

Accepted Answer

Offline dictionary and brute-force attacks against captured handshakes

Answer

Deauthentication flooding attacks

Answer

ARP poisoning on wireless networks

Answer

WPS PIN brute-force attacks

Question 2

The PMKID attack on WPA2 is advantageous over traditional handshake capture because:

Accepted Answer

It requires only a single EAPOL frame from the AP and does not require a client to be present

Answer

It works against WEP networks that WPA2 replaced

Answer

It cracks the key faster by using GPU acceleration exclusively

Answer

It only works when the network uses WPS

Question 3

Which 802.11 standard introduced both the 2.4 GHz and 5 GHz dual-band capability and commonly achieves speeds up to 600 Mbps using MIMO technology?

Accepted Answer

802.11n

Answer

802.11a

Answer

802.11g

Answer

802.11ac

Question 4

A Bluesnarfing attack differs from Bluejacking in that Bluesnarfing:

Accepted Answer

Unauthorized access to information on a Bluetooth device such as contacts, calendar, and messages

Answer

Sends messages to a device without pairing

Answer

Exploits Bluetooth Low Energy (BLE) beacons

Answer

Jams Bluetooth signals to cause denial of service

Question 5

What is the purpose of configuring a wireless adapter in 'monitor mode' during a wireless assessment?

Accepted Answer

To allow the adapter to capture all 802.11 frames in range, including frames not addressed to it

Answer

To boost the adapter's transmission power beyond legal limits

Answer

To hide the adapter's MAC address from nearby access points

Answer

To enable the adapter to operate on both 2.4 GHz and 5 GHz simultaneously

Question 6

Which countermeasure is MOST effective at detecting and alerting on rogue access points in an enterprise environment?

Accepted Answer

Deploying a Wireless Intrusion Detection/Prevention System (WIDS/WIPS)

Answer

Enabling WPA2-Enterprise on all legitimate APs

Answer

Implementing MAC address filtering on all APs

Answer

Disabling SSID broadcast on all legitimate APs

Question 7

During a wireless penetration test, you use 'aireplay-ng -0 5 -a [BSSID] -c [client MAC]'. What does the '-0 5' parameter accomplish?

Accepted Answer

Sends 5 deauthentication frames to the specified client to force reauthentication

Answer

Sets the channel to 5 for monitoring

Answer

Injects 5 ARP replay packets per second

Answer

Reduces transmission power to 5 dBm to avoid detection