A penetration tester is assessing a small office that uses a WPA2-PSK network with WPS enabled. The tester wants to gain access to the network without performing a lengthy dictionary attack. Which attack should the tester prioritize?

Use a deauthentication attack to force a client to reconnect and capture the PSK directly.

Use an evil twin attack to capture the WPS PIN from the client.

Use aircrack-ng to capture a handshake and run a dictionary attack on the PSK.

Use Reaver or Bully to brute-force the WPS PIN and recover the PSK.

An attacker sends forged deauthentication frames to disconnect a client from a wireless network. What is the goal of this attack?

To force the client to reconnect and capture the handshake

To change the client's MAC address

To install malware on the client

To permanently disable the client's wireless card

A penetration tester is assessing a small office that uses WPA2-PSK. The tester captures a four-way handshake but is unable to crack the passphrase with a standard dictionary. Which approach should the tester try next to increase the chance of recovering the key?

Perform a deauthentication attack to capture a new handshake from a different client

Switch to a WEP-style attack because WPA2 uses the same RC4 cipher

Replay the captured handshake to the access point to force it to reveal the key

Run a rule-based attack with a larger wordlist and mutation rules

What is the primary vulnerability exploited in a WPS attack?

The access point uses WEP encryption

The WPS PIN is often short and can be brute-forced

The client does not verify the AP's certificate

EC-CouncilCertified Ethical Hacker

Domain 6Objective 2

Wireless Hacking Methodology CEH Practice Questions (Page 8)

Part of the Wireless Network Hacking domain, which makes up ~8% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~8–13 in this domain), expect 2–3 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

11concepts

Questions 36–40

36application · medium
A penetration tester is assessing a small office that uses a WPA2-PSK network with WPS enabled. The tester wants to gain access to the network without performing a lengthy dictionary attack. Which attack should the tester prioritize?
Select an answer first
37foundation · easy
An attacker sends forged deauthentication frames to disconnect a client from a wireless network. What is the goal of this attack?
Select an answer first
38application · medium
A penetration tester is assessing a small office that uses WPA2-PSK. The tester captures a four-way handshake but is unable to crack the passphrase with a standard dictionary. Which approach should the tester try next to increase the chance of recovering the key?
Select an answer first
39foundation · easy
An attacker gains unauthorized access to a victim's Bluetooth device and is able to read contacts, messages, and other data. Which Bluetooth attack is this?
Select an answer first
40foundation · easy
What is the primary vulnerability exploited in a WPS attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.