Wi-Fi Encryption Cracking CEH Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A penetration tester is assessing a small office that uses WPA2-PSK. The tester wants to capture the 4-way handshake to attempt an offline dictionary attack. No clients are currently associated with the target AP. Which approach should the tester use to obtain a handshake?

   • AWait for a legitimate client to connect or reconnect, and capture the 4-way handshake passively during that association.
   • BRun a rogue AP with the same SSID to capture the handshake when a client attempts to connect to it.
   • CSend deauthentication frames to the AP's broadcast address to force any client to reconnect, then capture the handshake when it reassociates.
   • DUse a tool like Reaver to brute-force the WPS PIN and retrieve the PSK directly from the AP.
   Reveal Solution Discussion Select an answer first
2. 27expert · medium

   You are testing a WPA2-PSK network that has no clients connected. You have captured the PMKID from the AP. Which statement about cracking the PMKID is accurate?

   • AThe PMKID attack requires at least one connected client to capture the handshake.
   • BThe PMKID is encrypted and cannot be cracked without the AP's private key.
   • CThe PMKID attack only works if the AP uses WPS.
   • DThe PMKID can be cracked offline using hashcat with a dictionary or brute-force attack, and it does not require a client.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the PMKID attack and what does it exploit?

   • AIt uses a rogue access point to capture credentials
   • BIt sends deauthentication frames to force a handshake capture
   • CIt captures the PMKID from a WPA2 access point to crack the PSK offline without needing a client
   • DIt exploits a vulnerability in WPS to recover the PIN
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the impact of a successful KRACK attack on a WPA2 network?

   • AThe attacker can disable the network permanently
   • BThe attacker can decrypt network traffic without knowing the pre-shared key
   • CThe attacker can recover the pre-shared key directly
   • DThe attacker can change the network's SSID
   Reveal Solution Discussion Select an answer first
6. 30expert · medium

   A company is considering upgrading its wireless network from WPA2-PSK to WPA3-Personal. The security team is concerned about the risk of offline dictionary attacks. Which of the following is the primary reason WPA3-Personal mitigates offline dictionary attacks?

   • ASAE uses a password-authenticated key exchange that prevents an attacker from verifying password guesses offline.
   • BWPA3 uses a static key that is not transmitted over the air.
   • CWPA3 uses a longer pre-shared key that is harder to guess.
   • DWPA3 disables deauthentication frames, preventing handshake capture.
   Reveal Solution Discussion Select an answer first