eJPT Wireless Network Security 2 — Questions and Answers
Question 1: Which tool in the aircrack-ng suite is used to place a wireless network adapter into monitor mode?
- airmon-ng (Correct answer)
- airodump-ng
- aireplay-ng
- aircrack-ng
Correct answer: airmon-ng
airmon-ng enables or disables monitor mode on wireless interfaces, creating a virtual monitor interface (e.g., wlan0mon) required for packet capture.
Question 2: Which aireplay-ng attack mode number sends deauthentication packets to disconnect wireless clients?
- Mode 1
- Mode 3
- Mode 0 (Correct answer)
- Mode 6
Correct answer: Mode 0
aireplay-ng -0 (deauthentication attack, mode 0) sends spoofed deauth frames to force clients off the network so their reconnection handshake can be captured.
Question 3: What does PMKID stand for in the context of WPA2 wireless attacks?
- Pre-Master Key Identifier
- Pairwise Master Key Identifier (Correct answer)
- Primary MAC Key Identifier
- Packet Master Key Index
Correct answer: Pairwise Master Key Identifier
PMKID (Pairwise Master Key Identifier) is a value derived from the PMK, AP MAC, and client MAC, allowing WPA2 cracking without a full client handshake.
Question 4: What is the primary advantage of a PMKID attack over a traditional WPA2 4-way handshake capture attack?
- It only requires physical access to the router
- It can crack the password without waiting for any client to connect (Correct answer)
- It only works against WPA1 networks with TKIP encryption
- It requires capturing traffic from at least 10 connected clients
Correct answer: It can crack the password without waiting for any client to connect
The PMKID attack retrieves a hash directly from the AP's first EAPOL frame, eliminating the need to wait for a legitimate client to connect and complete a handshake.
Question 5: What is a 'hidden SSID' and how is it most reliably uncovered during a wireless penetration test?
- An SSID encrypted with WPA3; uncovered by brute-forcing the encryption key
- An SSID omitted from beacon frames; uncovered by capturing probe responses when clients reconnect (Correct answer)
- An SSID only visible on the 5 GHz band; uncovered by switching to that frequency
- An SSID protected by MAC filtering; uncovered by spoofing an allowed MAC address
Correct answer: An SSID omitted from beacon frames; uncovered by capturing probe responses when clients reconnect
Hidden SSIDs suppress the network name in beacon frames, but the SSID is revealed in probe request/response frames when clients attempt to reconnect.
Question 6: Which correct airodump-ng command syntax captures only traffic from a specific access point with MAC aa:bb:cc:dd:ee:ff on channel 11?
- airodump-ng -c 11 --bssid aa:bb:cc:dd:ee:ff wlan0mon (Correct answer)
- airodump-ng --filter 11 --ap aa:bb:cc:dd:ee:ff wlan0
- airodump-ng -channel 11 -mac aa:bb:cc:dd:ee:ff wlan0mon
- airodump-ng --scan 11 --target aa:bb:cc:dd:ee:ff wlan0
Correct answer: airodump-ng -c 11 --bssid aa:bb:cc:dd:ee:ff wlan0mon
The -c flag sets the channel and --bssid filters by AP MAC address; wlan0mon is the monitor-mode interface created by airmon-ng.
Question 7: During wireless reconnaissance with airodump-ng, what information can you use to determine whether a captured network uses WPA2 Personal or WPA2 Enterprise authentication?
- The signal strength (PWR) column value
- The AUTH column showing PSK versus MGT (Correct answer)
- The number of data frames in the #Data column
- The ENC column showing AES versus TKIP
Correct answer: The AUTH column showing PSK versus MGT
The AUTH column in airodump-ng output shows PSK for WPA2-Personal (pre-shared key) and MGT for WPA2-Enterprise (802.1X/RADIUS authentication).
eJPT Wireless Network Security 2
Which tool in the aircrack-ng suite is used to place a wireless network adapter into monitor mode?