During a wireless penetration test, you need to identify all access points in a facility that spans two buildings. You run airodump-ng and capture a list of BSSIDs, but you notice that some access points appear to be broadcasting on channel 6 while others are on channel 11. You also see a client station associated with an access point that has a very weak signal. What is the most reliable way to determine whether the weak-signal access point is a rogue device or a legitimate access point that is simply far away?

Run a deauthentication attack against the client and observe whether the client reconnects to the same access point.

Increase the transmit power of your wireless adapter to force the access point to respond with a stronger signal.

Use airodump-ng to capture the access point's beacon frames and check the vendor OUI from the BSSID.

Perform a physical site survey with a directional antenna to triangulate the access point's location and compare it with the known floor plan.

You are testing a WEP network and have captured a large number of IVs. You run aircrack-ng, but it fails to crack the key. What is the most likely reason?

The wireless card does not support monitor mode.

The network uses WPA2, not WEP.

The IVs are weak and do not contain enough unique data.

EC-CouncilCertified Penetration Testing Professional

Domain 7Objective 1

Wireless Penetration Testing CPENT Practice Questions (Page 7)

Part of the Specialized Testing and Reporting domain, which makes up ~23% of our current practice bank.

50questions here

10free pages

10concepts

Questions 31–35

31application · medium
During a wireless penetration test, you need to identify all access points in a facility that spans two buildings. You run airodump-ng and capture a list of BSSIDs, but you notice that some access points appear to be broadcasting on channel 6 while others are on channel 11. You also see a client station associated with an access point that has a very weak signal. What is the most reliable way to determine whether the weak-signal access point is a rogue device or a legitimate access point that is simply far away?
Select an answer first
32application · medium
You are testing a WEP network and have captured a large number of IVs. You run aircrack-ng, but it fails to crack the key. What is the most likely reason?
Select an answer first
33application · easy
After cracking a WPA2 passphrase and connecting to the corporate wireless network, you want to identify the network's internal structure and potential targets. Which tool is most appropriate for this post-exploitation step?
Select an answer first
34foundation · easy
Which 802.11 standard operates in the 5 GHz band and provides a maximum theoretical data rate of 54 Mbps?
Select an answer first
35foundation · easy
Which tool is commonly used to create a rogue access point for an evil twin attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.

Wireless Penetration Testing CPENT Practice Questions (Page 7)

Questions 31–35

You are testing a WEP network and have captured a large number of IVs. You run aircrack-ng, but it fails to crack the key. What is the most likely reason?

After cracking a WPA2 passphrase and connecting to the corporate wireless network, you want to identify the network's internal structure and potential targets. Which tool is most appropriate for this post-exploitation step?

Which 802.11 standard operates in the 5 GHz band and provides a maximum theoretical data rate of 54 Mbps?

Which tool is commonly used to create a rogue access point for an evil twin attack?

Keep studying — Specialized Testing and Reporting