Certified Ethical Hacker Wireless and IoT Security 1 — Questions and Answers
Question 1: What is the difference between WPA2 and WPA3 security protocols?
- WPA3 uses SAE (Simultaneous Authentication of Equals) replacing WPA2's PSK, providing better protection against offline attacks (Correct answer)
- WPA3 uses the same encryption as WPA2
- WPA2 is more secure than WPA3
- They use identical authentication methods
Correct answer: WPA3 uses SAE (Simultaneous Authentication of Equals) replacing WPA2's PSK, providing better protection against offline attacks
WPA3 replaces WPA2's Pre-Shared Key (PSK) with Simultaneous Authentication of Equals (SAE/Dragonfly), providing forward secrecy, protection against offline dictionary attacks, and stronger encryption (192-bit in Enterprise mode).
Question 2: What is an evil twin attack in wireless security?
- Creating a rogue access point mimicking a legitimate network to intercept traffic (Correct answer)
- Having two identical routers on the same network
- A twin firewall configuration
- Cloning a legitimate user's device
Correct answer: Creating a rogue access point mimicking a legitimate network to intercept traffic
An evil twin creates a rogue Wi-Fi access point with the same SSID and appearance as a legitimate network, tricking users into connecting to it, allowing the attacker to intercept all transmitted data.
Question 3: What is WPS (Wi-Fi Protected Setup) and why is it considered a security risk?
- A simplified connection method using PINs that is vulnerable to brute-force attacks due to the PIN's design flaw (Correct answer)
- A wireless power supply system
- A premium Wi-Fi subscription service
- A firewall feature for wireless networks
Correct answer: A simplified connection method using PINs that is vulnerable to brute-force attacks due to the PIN's design flaw
WPS allows easy device connection via an 8-digit PIN, but a design flaw allows the PIN to be brute-forced in two halves (10,000 + 1,000 attempts) rather than 100 million combinations, making it crackable in hours.
Question 4: What security risks are specific to IoT devices?
- Default credentials, lack of encryption, no update mechanism, and large attack surface (Correct answer)
- IoT devices have no security risks
- Only physical theft is a concern
- IoT devices are more secure than traditional computers
Correct answer: Default credentials, lack of encryption, no update mechanism, and large attack surface
IoT devices commonly have default/hardcoded passwords, lack encryption for communications, have no mechanism for firmware updates, run minimal security software, and create a massive attack surface when deployed at scale.
Question 5: What is a deauthentication attack in wireless hacking?
- Sending forged deauth frames to disconnect clients from a legitimate AP, enabling further attacks (Correct answer)
- Logging out of a wireless network normally
- Disabling authentication on a router
- A method for securely disconnecting from Wi-Fi
Correct answer: Sending forged deauth frames to disconnect clients from a legitimate AP, enabling further attacks
Deauthentication attacks send spoofed deauthentication management frames (which are not encrypted in WPA2) to disconnect clients, enabling capture of the WPA handshake for offline cracking or forcing clients to connect to an evil twin.
Question 6: What is Bluetooth sniffing and what tool is commonly used?
- Intercepting Bluetooth communications using tools like Ubertooth to capture and analyze packets (Correct answer)
- Using Bluetooth headphones to listen to music
- Scanning for Bluetooth devices with a phone
- Testing Bluetooth range with a signal meter
Correct answer: Intercepting Bluetooth communications using tools like Ubertooth to capture and analyze packets
Bluetooth sniffing captures Bluetooth communications to analyze device pairing, data transfer, and potentially extract sensitive information using specialized tools like Ubertooth One that can monitor all Bluetooth channels.
Certified Ethical Hacker Wireless and IoT Security 1
What is the difference between WPA2 and WPA3 security protocols?