Wireless Hacking Methodology CEH Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A penetration tester is assessing a corporate wireless network that uses WPA2-Enterprise with PEAP-MSCHAPv2. The tester has discovered that the network is protected by a strong PSK and uses 802.1X authentication. The goal is to capture domain credentials from a user who is currently connected. The tester has a wireless adapter that supports monitor mode and packet injection. Which attack sequence is most effective?

   • AUse a deauthentication attack to force the user to reconnect and capture the MSCHAPv2 challenge-response from the legitimate AP.
   • BUse a WPS attack to recover the PIN and then connect to the network.
   • CSet up a rogue AP with the same SSID, deauthenticate the user, and capture the MSCHAPv2 challenge-response to crack offline.
   • DUse aircrack-ng to capture the 4-way handshake and crack the PSK.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A network engineer is troubleshooting a wireless network that is experiencing intermittent connectivity. The engineer suspects that a nearby rogue AP is causing interference. To confirm this, the engineer needs to capture and analyze wireless traffic to identify the rogue AP's channel and signal strength. Which tool should the engineer use?

   • AUse a Bluetooth scanner to detect the rogue AP's presence.
   • BUse Wireshark in monitor mode to capture 802.11 frames and analyze the beacon frames.
   • CUse NetStumbler to actively scan for rogue APs and display their channel and signal strength.
   • DUse aircrack-ng to crack the rogue AP's encryption and then connect to it.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   To crack a WPA2 network using a dictionary attack, an attacker first captures the four-way handshake. Which tool is commonly used to capture this handshake?

   • Akismet
   • Baircrack-ng
   • Cjohn
   • Dairodump-ng
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A penetration tester is conducting a social engineering assessment for a client. The goal is to capture corporate Wi-Fi credentials from employees who connect to the guest network. The tester has set up a laptop with a wireless card that supports monitor mode and packet injection. Which steps should the tester take to execute an evil twin attack?

   • AUse a Bluetooth device to pair with employees' phones and extract saved Wi-Fi passwords.
   • BCreate a rogue AP with the same SSID as the legitimate guest network, deauthenticate clients, and run a captive portal to capture credentials.
   • CUse aircrack-ng to crack the guest network's WPA2 key, then connect and sniff traffic.
   • DUse Wireshark to capture handshakes and then perform an offline dictionary attack on the PSK.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A penetration tester is assessing a legacy network that uses WEP encryption. The tester has captured a large number of IVs but the key has not been cracked. The tester needs to speed up the cracking process. Which technique should the tester use?

   • AInject ARP packets to generate more IVs and then run aircrack-ng with the captured IVs.
   • BUse a WPS attack to recover the WEP key directly.
   • CUse a deauthentication attack to force clients to reconnect and capture more handshakes.
   • DUse a rogue AP to capture the WEP key during the client's authentication.
   Reveal Solution Discussion Select an answer first