A user connects to a Wi-Fi network named 'Free_Airport_WiFi' and is prompted to 'accept terms' on a captive portal. After accepting, the user notices that their browser shows a certificate warning for their bank's website. What is the most likely attack in progress?

A phishing email that tricked the user into installing malware

A denial-of-service attack on the bank's website

A man-in-the-middle attack using a rogue access point and SSL stripping

The bank's website has an expired SSL certificate

A sales team frequently connects to public Wi-Fi at coffee shops and airports. The security team wants to reduce the risk of credential theft and man-in-the-middle attacks without changing the users' workflow. Which control should be implemented?

Deploy a mobile device management (MDM) profile that enforces a VPN for all network traffic

Disable the device's Wi-Fi adapter when not in use

Install a personal firewall app on each device

Require users to connect only to WPA2-Enterprise networks

A company is rolling out a BYOD program. The security team is concerned about the risk of a lost device being used to access corporate email. They are considering two options: (1) requiring a complex password on the device, or (2) using an MDM that can remotely lock and wipe the device. Which approach provides the best defense-in-depth?

Implement both a strong device password and MDM remote lock/wipe capabilities.

Rely solely on MDM remote wipe, as it can erase data even if the password is weak.

Rely solely on a strong device password, as it is the most effective control.

Use a containerized app that encrypts corporate data, and do not enforce a device password.

A company is implementing a BYOD policy. The security team wants to protect corporate data on personal devices while respecting employee privacy. Which approach best balances these concerns?

Require full-device management and allow the company to wipe the entire device remotely

Use a containerization solution that separates corporate and personal data

Require employees to use only company-issued devices

Do not enforce any security controls on personal devices

EC-CouncilEthical Hacking Essentials

Domain 7Objective 3

Mobile Attack Vectors and Vulnerabilities EHE Practice Questions (Page 9)

Part of the Wireless, Mobile, IoT, and OT Attacks domain, which makes up ~15% of our current practice bank.

47questions here

10free pages

8concepts

Questions 41–45

41application · medium
A user connects to a Wi-Fi network named 'Free_Airport_WiFi' and is prompted to 'accept terms' on a captive portal. After accepting, the user notices that their browser shows a certificate warning for their bank's website. What is the most likely attack in progress?
Select an answer first
42application · medium
A sales team frequently connects to public Wi-Fi at coffee shops and airports. The security team wants to reduce the risk of credential theft and man-in-the-middle attacks without changing the users' workflow. Which control should be implemented?
Select an answer first
43foundation · easy
Which mobile OS security feature protects data on a device by converting it into an unreadable format that can only be accessed with the correct key?
Select an answer first
44expert · medium
A company is rolling out a BYOD program. The security team is concerned about the risk of a lost device being used to access corporate email. They are considering two options: (1) requiring a complex password on the device, or (2) using an MDM that can remotely lock and wipe the device. Which approach provides the best defense-in-depth?
Select an answer first
45application · medium
A company is implementing a BYOD policy. The security team wants to protect corporate data on personal devices while respecting employee privacy. Which approach best balances these concerns?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.

Mobile Attack Vectors and Vulnerabilities EHE Practice Questions (Page 9)

Questions 41–45

A user connects to a Wi-Fi network named 'Free_Airport_WiFi' and is prompted to 'accept terms' on a captive portal. After accepting, the user notices that their browser shows a certificate warning for their bank's website. What is the most likely attack in progress?

A sales team frequently connects to public Wi-Fi at coffee shops and airports. The security team wants to reduce the risk of credential theft and man-in-the-middle attacks without changing the users' workflow. Which control should be implemented?

Which mobile OS security feature protects data on a device by converting it into an unreadable format that can only be accessed with the correct key?

A company is implementing a BYOD policy. The security team wants to protect corporate data on personal devices while respecting employee privacy. Which approach best balances these concerns?

Keep studying — Wireless, Mobile, IoT, and OT Attacks