Certified Ethical Hacker Wireless and IoT Security 3 — Questions and Answers
Question 1: The KRACK attack against WPA2 exploits a flaw in which part of the protocol?
- The DHCP lease renewal
- The four-way handshake key reinstallation (Correct answer)
- The SSID beacon interval
- The RADIUS shared secret
Correct answer: The four-way handshake key reinstallation
KRACK forces nonce reuse by replaying message 3 of the four-way handshake, reinstalling an already-in-use key.
Question 2: Which improvement does WPA3 introduce to resist offline dictionary attacks on the password?
- Simultaneous Authentication of Equals (SAE) (Correct answer)
- Pre-Shared Key with RC4
- Open authentication
- WEP fallback
Correct answer: Simultaneous Authentication of Equals (SAE)
WPA3 uses SAE (Dragonfly handshake), which prevents offline dictionary attacks even with weak passwords.
Question 3: An IoT device ships with the default credentials admin/admin and exposes Telnet. Which botnet famously exploited this pattern?
- Conficker
- Mirai (Correct answer)
- Stuxnet
- WannaCry
Correct answer: Mirai
The Mirai botnet scanned for IoT devices with default Telnet credentials to build a massive DDoS network.
Question 4: Which short-range wireless protocol is commonly targeted in IoT attacks and operates in the 2.4 GHz band using 16 channels?
- Zigbee (Correct answer)
- LoRaWAN
- NFC
- Cellular LTE
Correct answer: Zigbee
Zigbee operates in the 2.4 GHz band with 16 channels and is widely used in smart-home IoT devices.
Question 5: What is 'bluesnarfing'?
- Sending unsolicited messages over Bluetooth
- Unauthorized access to data on a Bluetooth device (Correct answer)
- Jamming a Bluetooth signal
- Pairing two devices automatically
Correct answer: Unauthorized access to data on a Bluetooth device
Bluesnarfing is the unauthorized access and theft of information from a Bluetooth-enabled device.
Question 6: Which OWASP IoT Top 10 issue does using hardcoded passwords in firmware represent?
- Insecure data transfer
- Weak, guessable, or hardcoded passwords (Correct answer)
- Lack of physical hardening
- Insufficient privacy protection
Correct answer: Weak, guessable, or hardcoded passwords
Hardcoded credentials fall under the OWASP IoT category of weak, guessable, or hardcoded passwords.
Question 7: Which tool would a tester most likely use to perform a software-defined radio (SDR) analysis of IoT RF signals?
- Wireshark
- HackRF with GNU Radio (Correct answer)
- John the Ripper
- sqlmap
Correct answer: HackRF with GNU Radio
HackRF paired with GNU Radio is a common SDR platform for capturing and analyzing IoT radio signals.
Certified Ethical Hacker Wireless and IoT Security 3
The KRACK attack against WPA2 exploits a flaw in which part of the protocol?