A small business uses WPA2-PSK with a pre-shared key that is a 10-character lowercase word from the dictionary. As part of a security assessment, you need to demonstrate the risk. Which attack workflow is most appropriate?

Run a brute-force attack directly against the access point's management interface to guess the PSK.

Use a rogue access point with the same SSID to capture the PSK as clients connect.

Use aireplay-ng to replay ARP requests to collect IVs, then run aircrack-ng to recover the PSK.

Capture a four-way handshake by deauthenticating a client, then run aircrack-ng with a dictionary file against the handshake.

You are testing a WPA2-PSK network. You have captured a four-way handshake, but your dictionary attack fails. You suspect the passphrase is not in your dictionary. Which approach is the most efficient next step to attempt to recover the key?

Run a brute-force attack with a mask that includes lowercase letters, numbers, and symbols up to a reasonable length.

Capture a new handshake and try the same dictionary again.

Try to guess the passphrase by sending authentication requests to the access point.

Use a WEP attack to recover the PSK from the captured handshake.

GIAC Assessing and Auditing Wireless Networks

Domain 2Objective 1

Attacking Weak Encryption GAWN Practice Questions (Page 6)

Part of the Wireless Encryption and Authentication domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 26–30

26application · medium
A small business uses WPA2-PSK with a pre-shared key that is a 10-character lowercase word from the dictionary. As part of a security assessment, you need to demonstrate the risk. Which attack workflow is most appropriate?
Select an answer first
27foundation · easy
Which encryption protocol is considered cryptographically weak and can be broken in minutes using readily available tools?
Select an answer first
28application · medium
You are testing a WPA2-PSK network. You have captured a four-way handshake, but your dictionary attack fails. You suspect the passphrase is not in your dictionary. Which approach is the most efficient next step to attempt to recover the key?
Select an answer first
29foundation · easy
Which of the following is an example of an early WPA implementation that is now considered weak?
Select an answer first
30application · easy
A security consultant is testing a legacy WEP network. The consultant has captured packets but needs to speed up the collection of IVs. Which tool is specifically designed to inject ARP requests to generate IVs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

Attacking Weak Encryption GAWN Practice Questions (Page 6)

Questions 26–30

A small business uses WPA2-PSK with a pre-shared key that is a 10-character lowercase word from the dictionary. As part of a security assessment, you need to demonstrate the risk. Which attack workflow is most appropriate?

Which encryption protocol is considered cryptographically weak and can be broken in minutes using readily available tools?

You are testing a WPA2-PSK network. You have captured a four-way handshake, but your dictionary attack fails. You suspect the passphrase is not in your dictionary. Which approach is the most efficient next step to attempt to recover the key?

Which of the following is an example of an early WPA implementation that is now considered weak?

A security consultant is testing a legacy WEP network. The consultant has captured packets but needs to speed up the collection of IVs. Which tool is specifically designed to inject ARP requests to generate IVs?

Keep studying — Wireless Encryption and Authentication