A penetration tester is assessing a wireless network that uses both MAC filtering and WPA2-PSK. The tester has successfully cracked the WPA2 passphrase. However, the tester cannot connect because the MAC address is not in the allowed list. Which additional step is required to gain access?

Perform a deauthentication attack against an authorized client to steal its session

Spoof the MAC address of an authorized client that is currently offline

Capture a new handshake from an authorized client to extract its MAC address

Use a WPS attack to retrieve the PIN and bypass MAC filtering

During a penetration test, an ethical hacker needs to crack a WPA2-PSK network. The hacker has captured a valid 4-way handshake but the password is not in the current wordlist. The client is still connected and actively using the network. Which technique should the hacker use to obtain a fresh handshake that might yield a different result?

Use a rogue AP with the same SSID to capture the client's credentials during the next login.

Use a WPS PIN brute-force attack to recover the PSK directly from the AP.

Send deauthentication frames to the client to force a reconnection and capture a new handshake.

Inject ARP packets into the network to generate more IVs for the handshake capture.

EC-CouncilCertified Ethical Hacker

Domain 6Objective 2

Wireless Hacking Methodology CEH Practice Questions (Page 9)

Part of the Wireless Network Hacking domain, which makes up ~8% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~8–13 in this domain), expect 2–3 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

11concepts

Questions 41–44

41application · medium
A penetration tester is sniffing wireless traffic on a WPA2 network. The tester wants to capture the four-way handshake for offline cracking. Which tool is specifically designed to capture and display wireless packets, including handshakes?
Select an answer first
42expert · hard
A penetration tester is assessing a wireless network that uses both MAC filtering and WPA2-PSK. The tester has successfully cracked the WPA2 passphrase. However, the tester cannot connect because the MAC address is not in the allowed list. Which additional step is required to gain access?
Select an answer first
43application · medium
During a penetration test, an ethical hacker needs to crack a WPA2-PSK network. The hacker has captured a valid 4-way handshake but the password is not in the current wordlist. The client is still connected and actively using the network. Which technique should the hacker use to obtain a fresh handshake that might yield a different result?
Select an answer first
44foundation · easy
Which tool is specifically designed to perform brute-force attacks against the WPS PIN?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Wireless Hacking Methodology CEH Practice Questions (Page 9)

Questions 41–44

A penetration tester is sniffing wireless traffic on a WPA2 network. The tester wants to capture the four-way handshake for offline cracking. Which tool is specifically designed to capture and display wireless packets, including handshakes?

A penetration tester is assessing a wireless network that uses both MAC filtering and WPA2-PSK. The tester has successfully cracked the WPA2 passphrase. However, the tester cannot connect because the MAC address is not in the allowed list. Which additional step is required to gain access?

Which tool is specifically designed to perform brute-force attacks against the WPS PIN?

Keep studying — Wireless Network Hacking