A security analyst is investigating a potential KRACK attack on a WPA2 network. Which behavior would indicate that the attack is being exploited?

An attacker captures the PMKID and cracks it offline.

An attacker uses a rogue AP to capture the MSCHAPv2 challenge-response.

An attacker repeatedly sends deauthentication frames to a client, causing it to reconnect and reinstall the same session key.

An attacker uses a WPS PIN brute-force to recover the PSK.

A security auditor is testing a WPA2-PSK network. The auditor has captured a PMKID from the AP and wants to crack the PSK offline. Which of the following statements about the PMKID attack is correct?

The PMKID attack requires the AP to have WPS enabled.

The PMKID attack captures the PMKID from the AP's RSN IE and can be cracked offline using tools like hashcat.

The PMKID attack requires a client to be connected to the AP.

The PMKID attack is only effective against WPA3 networks.

What is a common attack against WPA/WPA2 Enterprise networks?

Capturing the 4-way handshake and cracking the PSK

Exploiting the WPS PIN to recover the network password

Using a deauthentication attack to force a handshake capture

Setting up a rogue RADIUS server to capture credentials

During a wireless penetration test, you capture packets from a legacy network that uses WEP. You notice that the access point is transmitting many packets with the same initialization vector (IV). Which attack would be most efficient to recover the WEP key in this situation?

Use reaver to brute-force the WPS PIN and retrieve the WEP key.

Deauthenticate a client and capture the EAPOL frames during reconnection.

Use aircrack-ng to perform an ARP request replay attack to generate new IVs and then crack the key.

Capture the 4-way handshake and run it through hashcat with a dictionary.

What must an attacker capture to perform an offline dictionary attack against a WPA2 PSK network?

The 4-way handshake between the client and access point

The authentication request from the client

The association response from the access point

The beacon frames broadcast by the access point

EC-CouncilCertified Ethical Hacker

Domain 6Objective 3

Wi-Fi Encryption Cracking CEH Practice Questions (Page 5)

Part of the Wireless Network Hacking domain, which makes up ~8% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~8–13 in this domain), expect 2–3 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

10concepts

Questions 21–25

21application · medium
A security analyst is investigating a potential KRACK attack on a WPA2 network. Which behavior would indicate that the attack is being exploited?
Select an answer first
22expert · medium
A security auditor is testing a WPA2-PSK network. The auditor has captured a PMKID from the AP and wants to crack the PSK offline. Which of the following statements about the PMKID attack is correct?
Select an answer first
23foundation · easy
What is a common attack against WPA/WPA2 Enterprise networks?
Select an answer first
24application · medium
During a wireless penetration test, you capture packets from a legacy network that uses WEP. You notice that the access point is transmitting many packets with the same initialization vector (IV). Which attack would be most efficient to recover the WEP key in this situation?
Select an answer first
25foundation · easy
What must an attacker capture to perform an offline dictionary attack against a WPA2 PSK network?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.