Wireless Penetration Testing CPENT Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   You are performing a wireless penetration test and need to capture a WPA2 handshake from a client that is already associated with the target AP. The client is on channel 11, but your adapter is currently on channel 6. You run a deauthentication attack, but you do not capture a handshake. What is the most likely reason?

   • AThe client is using a WPA3 connection, which is immune to deauthentication attacks.
   • BYour adapter is not on the same channel as the client, so you cannot send deauthentication frames to it.
   • CThe client is not associated with the target AP.
   • DYou need to use a different deauthentication tool, such as mdk4.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   You are conducting a red-team exercise where the goal is to capture domain credentials from employees using the corporate Wi-Fi. The corporate network uses WPA2-Enterprise with PEAP-MSCHAPv2 and certificates. You set up an evil twin AP with a captive portal. However, employees are not connecting to your rogue AP even after deauthentication. What is the most likely reason?

   • AThe clients are configured to validate the server certificate, so they reject your rogue AP.
   • BThe rogue AP is not broadcasting the correct SSID.
   • CThe rogue AP is on a different channel than the legitimate AP.
   • DThe deauthentication attack is not working because the clients are using 802.11w.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   You are performing a wireless penetration test against a WPA2-PSK network. You have captured a four-way handshake, but your dictionary attack has not cracked the passphrase. The network is used by a small company, and you suspect the passphrase is based on the company name. Which technique would be most effective to improve your chances?

   • AUse a rainbow table attack on the PMKID.
   • BUse a rule-based attack with a wordlist that includes the company name and common variations.
   • CRun a brute-force attack that tries every possible combination of characters up to 8 characters.
   • DPerform a deauthentication attack to capture a new handshake, hoping for a different passphrase.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   You are conducting an evil twin attack against a WPA2-Enterprise network. You have set up a rogue AP with the same SSID and a fake RADIUS server. However, clients are not connecting even after deauthentication. You suspect the issue is with the client configuration. What is the most likely client-side setting that prevents the attack?

   • AThe client has WPS disabled.
   • BThe client is using a VPN.
   • CThe client is using a static IP address.
   • DThe client is configured to validate the server certificate.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   You have successfully cracked the WPA2-PSK passphrase of a corporate wireless network and connected your laptop to the network. You now need to enumerate the internal network to identify live hosts and services. Which tool would you use to perform active host discovery on the wireless subnet?

   • Aaircrack-ng -b 00:11:22:33:44:55 capture.cap
   • Bnmap -sn 192.168.1.0/24
   • Cairodump-ng wlan0mon
   • Dtcpdump -i wlan0
   Reveal Solution Discussion Select an answer first