A penetration tester is conducting a wireless assessment for a client. The client has a WPA2-Enterprise network with PEAP-MSCHAPv2. The tester wants to capture credentials from a legitimate user. Which attack technique is most likely to succeed?

Use Reaver to attack the WPS PIN

Use a deauthentication attack to force the user to reconnect and then capture the 4-way handshake

Set up an evil twin AP with the same SSID and use a rogue RADIUS server to capture the user's credentials

Use a jamming attack to disrupt the network and then sniff the traffic

A company is planning to deploy a wireless network for a public lobby area. They want to provide internet access to guests but isolate them from the corporate network. Which security measure is most important to implement?

Use WPA2-Personal with a shared passphrase

Place the guest network on a separate VLAN with no access to internal resources

A penetration tester is conducting a wireless penetration test. The tester has completed the reconnaissance phase and identified a target WPA2 network. The tester wants to capture a four-way handshake without causing noticeable disruption to the network. Which technique is most appropriate?

Passively wait for a client to authenticate naturally

Use a dictionary attack on the captured beacon frames

Send deauthentication frames to force a client to reconnect

A penetration tester is conducting a wireless penetration test. The tester has identified a WPA2 network and captured a four-way handshake. However, the dictionary attack fails to crack the passphrase. Which next step is most appropriate?

Perform a deauthentication attack to capture a new handshake

Switch to a different wireless tool

Perform a rule-based attack using a wordlist with mutations

EC-CouncilCertified Security Specialist

Domain 4Objective 3

Wireless Attacks and Countermeasures ECSS Practice Questions (Page 3)

Part of the Ethical Hacking Advanced Attacks and Penetration Testing domain, which makes up ~17% of our current practice bank.

39questions here

8free pages

6concepts

Questions 11–15

11foundation · easy
Which tool is a passive wireless network detector that can discover access points and clients without sending any probe frames?
Select an answer first
12expert · hard
A penetration tester is conducting a wireless assessment for a client. The client has a WPA2-Enterprise network with PEAP-MSCHAPv2. The tester wants to capture credentials from a legitimate user. Which attack technique is most likely to succeed?
Select an answer first
13application · easy
A company is planning to deploy a wireless network for a public lobby area. They want to provide internet access to guests but isolate them from the corporate network. Which security measure is most important to implement?
Select an answer first
14expert · hard
A penetration tester is conducting a wireless penetration test. The tester has completed the reconnaissance phase and identified a target WPA2 network. The tester wants to capture a four-way handshake without causing noticeable disruption to the network. Which technique is most appropriate?
Select an answer first
15expert · hard
A penetration tester is conducting a wireless penetration test. The tester has identified a WPA2 network and captured a four-way handshake. However, the dictionary attack fails to crack the passphrase. Which next step is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.