A penetration tester is assessing a WPA2-PSK network. The tester has captured a handshake but does not have a wordlist. Which approach is most appropriate to attempt to recover the passphrase?

Use a brute-force attack with a tool like Hashcat, trying all possible passphrases up to a certain length.

Use a WEP key recovery attack on the same network to get the passphrase.

Replay the handshake to the AP to see if it responds with an error for wrong passwords.

Use aircrack-ng with the default wordlist that is included with the tool.

Which attack method is used to recover a WPA/WPA2 PSK from a captured handshake?

Dictionary or brute-force attack

A security analyst is examining a wireless capture and sees that the AP is broadcasting a beacon with the encryption field set to 'WEP'. The analyst also notices that some clients are using WPA2. Which conclusion is most accurate?

The clients using WPA2 are safe because they are not using WEP.

The AP is using WPA2, but the beacon is misconfigured to advertise WEP.

The network is secure because WPA2 clients are protected.

The AP is configured to allow both WEP and WPA2 clients, which is insecure because WEP is weak.

GIAC Assessing and Auditing Wireless Networks

Domain 2Objective 1

Attacking Weak Encryption GAWN Practice Questions (Page 8)

Part of the Wireless Encryption and Authentication domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 36–40

36foundation · easy
What must be captured to perform an offline dictionary attack against a WPA/WPA2 PSK?
Select an answer first
37application · medium
A penetration tester is assessing a WPA2-PSK network. The tester has captured a handshake but does not have a wordlist. Which approach is most appropriate to attempt to recover the passphrase?
Select an answer first
38application · easy
You are testing a network that uses WPA-TKIP. You want to demonstrate the risk of TKIP by performing a packet injection attack. Which tool is commonly used to inject packets into a wireless network?
Select an answer first
39foundation · easy
Which attack method is used to recover a WPA/WPA2 PSK from a captured handshake?
Select an answer first
40application · medium
A security analyst is examining a wireless capture and sees that the AP is broadcasting a beacon with the encryption field set to 'WEP'. The analyst also notices that some clients are using WPA2. Which conclusion is most accurate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

Attacking Weak Encryption GAWN Practice Questions (Page 8)

Questions 36–40

What must be captured to perform an offline dictionary attack against a WPA/WPA2 PSK?

A penetration tester is assessing a WPA2-PSK network. The tester has captured a handshake but does not have a wordlist. Which approach is most appropriate to attempt to recover the passphrase?

You are testing a network that uses WPA-TKIP. You want to demonstrate the risk of TKIP by performing a packet injection attack. Which tool is commonly used to inject packets into a wireless network?

Which attack method is used to recover a WPA/WPA2 PSK from a captured handshake?

A security analyst is examining a wireless capture and sees that the AP is broadcasting a beacon with the encryption field set to 'WEP'. The analyst also notices that some clients are using WPA2. Which conclusion is most accurate?

Keep studying — Wireless Encryption and Authentication