Certified Ethical Hacker Wireless and IoT Security 2 — Questions and Answers
Question 1: Which attack forces a client to disconnect from an access point so the attacker can capture the WPA2 four-way handshake on reconnection?
- Deauthentication attack (Correct answer)
- Evil twin attack
- Bluejacking
- War driving
Correct answer: Deauthentication attack
Deauthentication frames knock a client off the AP, forcing a reconnect that reveals the handshake for offline cracking.
Question 2: What is the primary weakness of WEP that allows its encryption key to be recovered?
- Use of AES in CBC mode
- Short, reused initialization vectors (IVs) (Correct answer)
- Lack of any encryption
- Use of EAP-TLS
Correct answer: Short, reused initialization vectors (IVs)
WEP's 24-bit IVs are short and frequently reused, enabling statistical attacks like FMS to recover the key.
Question 3: An attacker sets up a rogue AP with the same SSID as a legitimate corporate network to lure clients. What is this called?
- Jamming
- Evil twin (Correct answer)
- MAC flooding
- Replay attack
Correct answer: Evil twin
An evil twin mimics a legitimate AP's SSID to trick users into connecting through the attacker.
Question 4: Which tool suite is commonly used to capture and crack WPA/WPA2 handshakes?
- Nmap
- Aircrack-ng (Correct answer)
- Metasploit
- Burp Suite
Correct answer: Aircrack-ng
Aircrack-ng captures wireless traffic and performs dictionary/brute-force attacks against captured handshakes.
Question 5: What WPS feature makes it vulnerable to brute-force attacks such as those performed by Reaver?
- The 802.1X authenticator
- The 8-digit PIN validated in two halves (Correct answer)
- The RADIUS server timeout
- The hidden SSID broadcast
Correct answer: The 8-digit PIN validated in two halves
WPS validates the PIN in two halves, drastically reducing the number of guesses needed to brute-force it.
Question 6: Which encryption protocol replaced TKIP in WPA2 to provide stronger confidentiality?
- RC4
- CCMP (AES) (Correct answer)
- DES
- MD5
Correct answer: CCMP (AES)
WPA2 uses CCMP based on AES, replacing the weaker RC4-based TKIP used in WPA.
Question 7: What does 'war driving' refer to in wireless security?
- Flooding an AP with deauth frames
- Driving around to locate and map wireless networks (Correct answer)
- Cracking a captured handshake offline
- Injecting malicious firmware into a router
Correct answer: Driving around to locate and map wireless networks
War driving is the practice of mapping and discovering wireless networks while moving through an area, often by car.
Certified Ethical Hacker Wireless and IoT Security 2
Which attack forces a client to disconnect from an access point so the attacker can capture the WPA2 four-way handshake on reconnection?