Wireless Penetration Testing CPENT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   You are performing wireless reconnaissance and need to identify hidden networks. You have captured beacon frames, but some networks are not visible because they have SSID broadcasting disabled. What should you do to discover these hidden networks?

   • AUse hashcat to crack the hidden SSID.
   • BUse nmap to scan for wireless networks.
   • CUse airodump-ng to capture probe requests and responses from clients.
   • DUse reaver to brute-force the SSID.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   After successfully cracking the WPA2 passphrase of a corporate wireless network, you connect your laptop to the network. What is the next logical step in the wireless penetration testing methodology?

   • AImmediately launch a deauthentication attack against all clients.
   • BCapture more handshakes to verify the passphrase.
   • CPerform network enumeration to identify hosts, services, and potential targets.
   • DRun a WPS attack to find the PIN.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   You are testing a WPA2-PSK network. You capture a handshake and run aircrack-ng with a large dictionary, but it fails. You suspect the passphrase is not in the dictionary. You have limited time and need to maximize your chance of success. Which approach is the most efficient?

   • ARun a brute-force attack with all printable characters up to 12 characters.
   • BUse hashcat with a mask attack targeting 8-character lowercase passwords.
   • CCapture a new handshake from a different client.
   • DUse a WPS attack to recover the passphrase.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In a WEP cracking attack, what is the primary purpose of performing packet injection, for example using aireplay-ng?

   • ATo deauthenticate clients so they reconnect and reveal the PSK
   • BTo brute-force the WEP key by trying all possible passphrases
   • CTo capture the 4-way handshake between the client and AP
   • DTo generate a large number of initialization vectors (IVs) quickly
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   You are leading a wireless penetration test for a client. The scope includes both WPA2-PSK and WPA2-Enterprise networks. You have limited time and must prioritize attacks. Which approach best balances effectiveness and efficiency?

   • AUse a brute-force attack on all networks simultaneously.
   • BStart with passive reconnaissance to identify all networks, then prioritize based on the weakest encryption and client activity.
   • CImmediately attack the WPA2-Enterprise network with an evil twin.
   • DFocus only on WPA2-PSK networks because they are easier to crack.
   Reveal Solution Discussion Select an answer first