Wireless Penetration Testing CPENT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which tool is commonly used to send deauthentication frames to wireless clients?

   • Aaireplay-ng
   • Baircrack-ng
   • Ctcpdump
   • Dairodump-ng
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   You are conducting a wireless penetration test for a client that uses WPA2-Enterprise with PEAP-MSCHAPv2. The client's security team has deployed a RADIUS server that validates client certificates. You have set up a rogue access point with the same SSID and a fake RADIUS server that presents a self-signed certificate. However, clients are not connecting to your rogue AP; they remain connected to the legitimate AP. You have verified that your rogue AP is broadcasting and that your deauthentication attack is working. What is the most likely reason clients are not connecting?

   • AThe legitimate AP is using a stronger signal than your rogue AP.
   • BYou did not disable the legitimate AP's SSID broadcast.
   • CYour rogue AP is not broadcasting on the same channel as the legitimate AP.
   • DClients are configured to validate the RADIUS server certificate and reject self-signed certificates.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   You are testing a wireless network that uses WPA2-PSK with WPS enabled. The access point is vulnerable to the pixie dust attack. What is the primary advantage of using the pixie dust attack over a traditional online WPS brute-force attack?

   • AIt is faster because it uses a dictionary of common PINs.
   • BIt does not trigger the access point's lockout mechanism.
   • CIt does not require a wireless adapter in monitor mode.
   • DIt works against all access points regardless of the chipset.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   You are conducting a wireless penetration test and need to capture credentials from users who connect to a corporate Wi-Fi network. The network uses WPA2-Enterprise with PEAP. You have set up a rogue access point with the same SSID as the corporate network. Which additional configuration is necessary to successfully capture usernames and passwords?

   • AConfigure the rogue AP to use WPA2-PSK with the same passphrase as the corporate network.
   • BDisable encryption on the rogue AP to force clients to send credentials in plaintext.
   • CSet up a RADIUS server that accepts any certificate and captures the MSCHAPv2 challenge-response.
   • DUse a deauthentication attack to force clients to reconnect to the rogue AP.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   You are testing a legacy wireless network that still uses WEP. Your airodump-ng capture shows a low number of IVs, and you need to crack the WEP key quickly. The access point is in a busy office with many clients. Which approach is most likely to speed up the capture of enough IVs?

   • ASwitch to a different channel and hope for more traffic.
   • BUse aireplay-ng to inject ARP request packets to generate new IVs.
   • CRun a dictionary attack with a wordlist against the captured IVs.
   • DWait for the office to close so that fewer clients are using the network.
   Reveal Solution Discussion Select an answer first