Wireless Penetration Testing CPENT Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   You are testing a wireless network that uses WPA2-PSK with WPS enabled. The access point has a lockout policy that locks WPS after 3 failed PIN attempts for 5 minutes. You have identified that the access point is vulnerable to the pixie dust attack. However, your initial pixie dust attempt fails. What is the most likely reason for the failure?

   • AYou used the wrong PIN length; the pixie dust attack requires an 8-digit PIN.
   • BThe access point's firmware has been patched to fix the RNG vulnerability.
   • CThe access point is using WPA3 instead of WPA2.
   • DYou did not wait for the lockout period to expire before attempting the pixie dust attack.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a common post-exploitation attack after gaining access to a wireless network and identifying a vulnerable host?

   • ACapturing WPA handshakes from other clients
   • BExploiting a known vulnerability on the host to gain further access
   • CPerforming a WPS PIN attack
   • DSending deauthentication frames to the target host
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A client wants to upgrade their wireless security from WPA2 to WPA3. They have a mix of older and newer devices. During the transition, they want to maintain compatibility with older devices while still providing strong security. What should you recommend?

   • AKeep WPA2 and enable WPS for easier onboarding.
   • BDisable WPA2 and use only WPA3 to force all devices to upgrade.
   • CEnable WPA3/WPA2 mixed mode on the access points.
   • DUse WPA2 with a longer passphrase to improve security.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary target data that an attacker must capture to perform an offline dictionary attack against a WPA/WPA2 network?

   • AThe probe request frames sent by clients
   • BA large number of initialization vectors (IVs)
   • CThe 4-way handshake between the client and the access point
   • DThe beacon frames broadcast by the access point
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the purpose of sending deauthentication frames to a wireless client?

   • ATo encrypt the client's traffic
   • BTo prevent the client from sending probe requests
   • CTo change the client's MAC address
   • DTo force the client to disconnect and reconnect, potentially allowing the attacker to capture the WPA handshake
   Reveal Solution Discussion Select an answer first