Wireless Penetration Testing CPENT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   You are performing wireless reconnaissance in an area with multiple access points. You want to identify which access points are using WPA3 and which are using WPA2. Using airodump-ng, which field in the output will help you determine the security protocol?

   • AThe 'ENC' column, which shows the encryption algorithm (e.g., CCMP, GCMP).
   • BThe 'CIPHER' column, which shows the cipher suite (e.g., TKIP, CCMP).
   • CThe 'AUTH' column, which shows the authentication protocol (e.g., PSK, SAE).
   • DThe 'ESSID' column, which shows the network name.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which tool is commonly used to crack a WEP key from a captured packet capture file containing IVs?

   • Ahashcat
   • Baircrack-ng
   • Ckismet
   • Djohn
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   You are testing a network that uses WPS. The AP has WPS enabled, but you are unsure if it is vulnerable to the PIN brute-force attack. You want to test this without causing a permanent lockout. What is the best approach?

   • AUse a dictionary attack against the WPS PIN.
   • BSkip WPS and attack the WPA2 handshake instead.
   • CRun a fast brute-force attack to quickly test all PINs.
   • DUse reaver with the --no-associate option and a slow timing to avoid triggering lockout.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which wireless security protocol is considered cryptographically broken because it uses the RC4 cipher with a weak key scheduling algorithm and can be cracked by capturing enough initialization vectors?

   • AWPA
   • BWPA2
   • CWPA3
   • DWEP
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   You are planning a wireless penetration test for a client that has multiple office locations. The client wants to test the security of their wireless networks, but they have a limited budget and want to prioritize the most critical locations. They also want to minimize disruption to their operations. Which approach would be the most effective for scoping the test?

   • AConduct a passive site survey at all locations to identify rogue access points and weak encryption.
   • BTest all locations with active attacks during off-hours to minimize disruption.
   • CUse a risk-based approach to select locations based on the sensitivity of data and the number of users, and perform a combination of passive and active tests.
   • DPerform active attacks only at the headquarters location, as it is the most critical.
   Reveal Solution Discussion Select an answer first