A security consultant is testing a company's wireless security by setting up a rogue access point with the same SSID as the corporate network. The goal is to capture employee credentials when they connect. Which additional action is essential for the attack to succeed?

Place the rogue AP on a different channel and increase its transmit power

Configure the rogue AP to use WPA2-Enterprise with a fake RADIUS server to capture credentials

Disable encryption on the rogue AP to make it appear as an open network

Enable MAC filtering on the rogue AP to only allow authorized employee devices

A penetration tester is assessing a wireless network that uses MAC filtering to allow only specific devices. The tester has captured the MAC address of an authorized device that is currently offline. The tester also knows the WPA2-PSK. Which technique should the tester use to connect to the network?

Use a WPS attack to recover the PIN and then connect without MAC spoofing.

Use a deauthentication attack to kick the authorized device off and then connect with a random MAC.

Spoof the wireless NIC's MAC address to the authorized device's MAC and connect using the known PSK.

Use a rogue AP with the same SSID to bypass MAC filtering.

A network administrator has implemented MAC filtering on a corporate Wi-Fi network to allow only specific devices. During a security assessment, the tester needs to connect to the network to test internal vulnerabilities. The tester has captured the MAC address of an authorized device that is currently offline. Which technique should the tester use to gain access?

Change the wireless NIC's MAC address to the authorized device's MAC and connect.

Use a WPS attack to retrieve the network PIN and then connect without MAC spoofing.

Use a rogue AP with the same SSID to bypass MAC filtering.

Use a deauthentication attack to kick the authorized device off and then connect with a random MAC.

Why would an attacker spoof a MAC address that is on an access point's allowed list?

To avoid detection by antivirus software

To encrypt the wireless traffic

To bypass MAC address filtering

EC-CouncilCertified Ethical Hacker

Domain 6Objective 2

Wireless Hacking Methodology CEH Practice Questions (Page 3)

Part of the Wireless Network Hacking domain, which makes up ~8% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~8–13 in this domain), expect 2–3 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

11concepts

Questions 11–15

11application · medium
A security consultant is testing a company's wireless security by setting up a rogue access point with the same SSID as the corporate network. The goal is to capture employee credentials when they connect. Which additional action is essential for the attack to succeed?
Select an answer first
12expert · hard
A penetration tester is assessing a wireless network that uses MAC filtering to allow only specific devices. The tester has captured the MAC address of an authorized device that is currently offline. The tester also knows the WPA2-PSK. Which technique should the tester use to connect to the network?
Select an answer first
13application · medium
A network administrator has implemented MAC filtering on a corporate Wi-Fi network to allow only specific devices. During a security assessment, the tester needs to connect to the network to test internal vulnerabilities. The tester has captured the MAC address of an authorized device that is currently offline. Which technique should the tester use to gain access?
Select an answer first
14foundation · easy
Why would an attacker spoof a MAC address that is on an access point's allowed list?
Select an answer first
15foundation · easy
An attacker sets up a rogue access point with the same SSID as a legitimate network to trick users into connecting. What is this attack called?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Wireless Hacking Methodology CEH Practice Questions (Page 3)

Questions 11–15

A security consultant is testing a company's wireless security by setting up a rogue access point with the same SSID as the corporate network. The goal is to capture employee credentials when they connect. Which additional action is essential for the attack to succeed?

Why would an attacker spoof a MAC address that is on an access point's allowed list?

An attacker sets up a rogue access point with the same SSID as a legitimate network to trick users into connecting. What is this attack called?

Keep studying — Wireless Network Hacking