Certified Ethical Hacker Wireless and IoT Security 2

Question 1

Which attack forces a client to disconnect from an access point so the attacker can capture the WPA2 four-way handshake on reconnection?

Accepted Answer

Deauthentication attack

Answer

Deauthentication frames knock a client off the AP, forcing a reconnect that reveals the handshake for offline cracking.

Question 2

What is the primary weakness of WEP that allows its encryption key to be recovered?

Accepted Answer

Short, reused initialization vectors (IVs)

Answer

WEP's 24-bit IVs are short and frequently reused, enabling statistical attacks like FMS to recover the key.

Question 3

An attacker sets up a rogue AP with the same SSID as a legitimate corporate network to lure clients. What is this called?

Accepted Answer

Evil twin

Answer

An evil twin mimics a legitimate AP's SSID to trick users into connecting through the attacker.

Question 4

Which tool suite is commonly used to capture and crack WPA/WPA2 handshakes?

Accepted Answer

Aircrack-ng

Answer

Aircrack-ng captures wireless traffic and performs dictionary/brute-force attacks against captured handshakes.

Question 5

What WPS feature makes it vulnerable to brute-force attacks such as those performed by Reaver?

Accepted Answer

The 8-digit PIN validated in two halves

Answer

WPS validates the PIN in two halves, drastically reducing the number of guesses needed to brute-force it.

Certified Ethical Hacker Practice Test