Wi-Fi Encryption Cracking CEH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which characteristic of WEP encryption is a primary reason it is vulnerable to cracking?

   • AIt employs a dynamic key that changes with each packet
   • BIt uses a 64-bit key that is derived from the MAC address
   • CIt uses a 128-bit key that is derived from the SSID
   • DIt reuses the initialization vector (IV) in multiple packets
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A security analyst is investigating a potential KRACK attack on a WPA2 network. Which of the following is a key indicator that a KRACK attack may have occurred?

   • AThe client's PMKID is captured and cracked.
   • BThe client's deauthentication frame is captured.
   • CThe client's encryption key is reset to an all-zero key, allowing the attacker to decrypt traffic.
   • DThe client's WPS PIN is brute-forced.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   You are testing a home router that has WPS enabled. The WPS PIN is 8 digits. Which tool and approach would most efficiently recover the Wi-Fi password?

   • AUse aircrack-ng to capture the 4-way handshake and run a dictionary attack.
   • BUse kismet to passively sniff the WPS PIN from beacon frames.
   • CUse reaver to brute-force the WPS PIN, then use the revealed PIN to derive the WPA2 password.
   • DUse hashcat to brute-force the 8-digit PIN directly against the captured handshake.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During a penetration test, you find a network using WEP with a very weak key. You have captured a large number of IVs, but aircrack-ng is not cracking the key. Which action would most likely improve your chances?

   • AUse a deauthentication attack to force clients to reconnect and generate more traffic.
   • BCapture the 4-way handshake and crack it with aircrack-ng.
   • CUse an ARP request replay attack to inject packets and generate fresh IVs.
   • DSwitch to a dictionary attack with hashcat on the captured IVs.
   Reveal Solution Discussion Select an answer first
6. 5expert · easy

   You are performing a wireless penetration test and have captured a WPA2 handshake. You have a wordlist of 10 million passwords. Your GPU can test 100,000 passwords per second with hashcat. How long will it take to exhaust the wordlist?

   • A100 seconds
   • B1000 seconds
   • C100,000 seconds
   • D10,000 seconds
   Reveal Solution Discussion Select an answer first