CEH Fast Track Module 16 Quiz Level 1 – Keyword Recall

A network engineer installs a device that bridges wireless clients into the existing wired LAN, acting as a switch or hub between the two. Which device is described?

While capturing frames, an analyst records the MAC address of the access point that established a basic service set so nearby cells can be told apart. What is the analyst reading?

At an airport, travellers switch on Wi-Fi and reach the Internet through wireless service the venue offers to the general public. What does this location represent?

A laptop completes the exchange that links it to a chosen access point before any data flows. Name the step underway.

An administrator assigns the WLAN a 32 alphanumeric character name that clients must match to reach the intended network. Identify the value being set.

A legacy adapter runs in the 5 GHz band at up to 54 Mbps using OFDM and belongs to the first amendment layered on the original standard. Which amendment fits?

An old sensor connects in the 2.4 GHz ISM band at a ceiling of 11 Mbps using direct-sequence spread spectrum modulation. Which standard is in use?

A router advertises 54 Mbps in the 2.4 GHz band using OFDM while still serving older 802.11b clients on the same AP. Which standard does this describe?

An upgrade adds multiple-input multiple-output antennas over the previous generation and lets the radio work in both the 2.4 GHz and 5 GHz bands. Pinpoint the revision responsible.

A modern deployment delivers Gigabit throughput at 5 GHz and proves faster and more reliable than the MIMO generation before it. Classify the standard.

On a home network, one shared password entered on the router and each device authenticates everyone that joins, with no per-user accounts. Which authentication mode is in place?

A corporate WLAN gives every employee a unique username and password checked independently by a centralized RADIUS server, also called 802.1X operation. What mode has been deployed?

A technician mounts an antenna aimed to send and receive along a single line, deliberately working in only a few directions to cut interference. What type of antenna is this?

A broadcaster needs even coverage so any receiver picks up the signal wherever it sits, radiating energy in every direction with a 360 degree horizontal pattern. Which antenna suits the job?

For a point-to-point link spanning about ten miles, an attacker rigs an antenna built from a semi-dish grid of aluminum wires resembling a satellite dish to focus a tight beam. Name the antenna.

An installer selects a unidirectional antenna with high gain rated from 10 MHz through VHF and UHF that produces an end-fire radiation pattern. Which antenna is described?

A design calls for a straight conductor measuring half a wavelength end to end, fed at its center on the RF line, a balanced form also called a doublet. Identify the antenna.

An engineer chooses an antenna that gathers radiated or received energy onto a focal point, is generally parabolic, and delivers higher gain as its surface grows larger. What is being used?

An auditor finds a legacy access point still running the original 802.11b security scheme built to make a wireless LAN as private as a wired one, and notes it can be cracked in minutes. Which protocol is described?

In WEP the RC4 keystream depends on a 24-bit arbitrary number joined to the key, the two together forming the WEP seed. What is this 24-bit field?

Upgrading from WEP without replacing hardware, an administrator deploys the 802.11i protocol that keeps the RC4 stream cipher but adds TKIP and a Message Integrity Check for stronger encryption. Name the protocol.

Within WPA a component changes the unicast encryption key for every packet and replaces WEP through per-packet mixing functions, message integrity checks, extended IVs, and re-keying. Which protocol is at work?

During an EAP authentication session a key is created that is later used to derive the temporal encryption keys for the link. What is this key?

A capture shows an access point and client exchanging an ANonce, an SNonce, and confirmation messages so that both sides obtain the temporal keys securing the session. Which exchange is this?

During the four-way handshake the access point sends an ANonce, and from that value the client constructs a key that will protect the unicast traffic. What has the client constructed?

A network is reconfigured to encrypt with the AES algorithm and CCMP, replacing the older TKIP-and-RC4 scheme for stronger data protection and access control. Which protocol matches?

Inside WPA2 an AES-based protocol supplies both strong encryption and authentication for each frame. Which encryption protocol is meant?

A vendor advertises a third-generation Wi-Fi security protocol that builds on WPA2 and encrypts with the AES-GCMP-256 algorithm. Which standard is deployed?

WPA3 replaces the shared passphrase concept with a modern key establishment protocol, also called Dragonfly Key Exchange, that resists offline dictionary attacks. What is this protocol?

An attacker collects many WEP frames whose IVs repeat and applies statistical analysis to RC4 key scheduling weaknesses, quickly recovering the WEP key. Which attack is this?

On a WPA2-PSK network an attacker who captures the pre-shared key is then able to decrypt every packet ever protected with that key. Which weakness does this illustrate?

A WPA2 flaw lets an insider abuse the shared group temporal key to mount man-in-the-middle and denial-of-service attacks against other clients. Which vulnerability is described?

Researchers demonstrate a WPA2 handshake exploit that lets an attacker sniff packets, hijack connections, inject malware, and decrypt traffic. How should the analyst classify it?

Without cracking the passphrase, an attacker determines the Wi-Fi Protected Setup personal identification number and from it discloses the WPA2 key. What made the disclosure possible?

A WPA3 deployment is found where certain handshake implementations leak measurable timing differences, letting an attacker potentially recover the password. What kind of attack is this?

For compatibility an access point enables both WPA3 and WPA2 at once, and an attacker forces clients onto the weaker WPA2 path to exploit its known flaws. What condition created the exposure?

A penetration tester bypasses a WLAN’s AP MAC filters and Wi-Fi port access controls to slip onto the network without touching any data in transit. Which family of wireless threat is this?

An attacker reconfigures a network card so its address matches an authorized AP and a host on the trusted network accepts it as legitimate. Name the access-control technique.

A well-secured network is left exposed because an administrator changed a critical security setting on an access point, yet the device keeps working normally and triggers no intrusion alerts. What is the flaw?

To reach a client that shares files without an access point, an attacker pushes the target network into a peer-to-peer mode that offers no strong authentication or encryption. Identify the threat.

A corporate laptop associates with an access point belonging to a neighbouring network because the signal carried through the office wall, and that stray link then enables access-control attacks. What has occurred?

An attacker runs a soft AP on a laptop so its NIC poses as a legitimate access point, then uses it to gain entry to the enterprise network in either accidental or malicious form. Which access-control threat does this describe?

During an assessment, forged control and management frames are sent across the WLAN to misdirect devices and set up a follow-on DoS. Which threat family is at work?

An analyst sees an attacker building brand-new, forged 802.11 frames and pushing them onto the wireless network. Which integrity technique matches this behaviour?

Captured EAP, data, and RADIUS messages are stored and retransmitted onto the network some time after they were first seen. How is this best classified?

An attacker’s whole aim is to read information crossing the WLAN, and she is willing to break encryption if the data is not already in cleartext. Which family does her goal define?

Using a protocol analyzer, an attacker captures and decodes unprotected application traffic to pull out potentially sensitive information. What is the technique called?

A campaign is designed to keep legitimate users off the wireless network by crippling WLAN resources and denying access to them. Which threat family describes it?

An attacker destroys the connectivity between an AP and a single client so that target becomes unavailable to other wireless devices. Pick the availability technique.

By abusing the CSMA/CA clear channel assessment mechanism, an attacker makes a wireless channel appear busy without pause so no one else can transmit. Which availability method fits?

An operation focuses on stealing the identities, personal details, and login credentials of Wi-Fi clients in order to reach network resources. Under which family does this fall?

Against a dynamic routing protocol, an attacker tunnels traffic between two nodes and advertises that its link is the shortest route so it can control the data flow. Which attack is this?

A penetration tester documents her plan as an ordered set of steps for compromising a client’s Wi-Fi and reaching its network resources, beginning with discovery and ending with encryption cracking. What is this overall plan called?

An attacker has selected a target building and now works to locate and footprint any wireless network within range before doing anything else. Which methodology phase is being carried out?

An investigator watches someone slowly circle a business park in a car with a laptop and a wireless discovery tool running, quietly recording every open network passed. This behaviour is best classified as what?

Before committing to an attack, an operator captures and studies a discovered network’s frames to learn which encryption is in use, what vulnerabilities exist, and who the susceptible victims are. Which phase does this describe?

To collect the packets needed for later study, an attacker tunes a receiver to the target’s transmission frequency and silently intercepts the ongoing wireless communication. What is this eavesdropping technique?

An operator has finished discovery, mapping, and traffic analysis of a target WLAN and now begins actively attacking it. Which methodology phase has just started?

Users across a WLAN are suddenly and repeatedly dropped because the attacker is broadcasting de-authenticate commands that force every client to disconnect from the access point. Which attack is this?

A monitoring tool shows a station buried under a stream of forged de-authenticate and disassociate frames until it can no longer stay connected to its access point. Which specific attack matches this pattern?

During an active operation, the adversary positions himself between two communicating computers so he can intercept, read, and even alter the information flowing across the link. Which attack fits?

An access point is configured to admit only a fixed list of hardware addresses, yet an attacker gets on the network by presenting the address of an already-authenticated user. Which attack achieved this?

Traffic meant for one access point starts flowing to the attacker after he sends forged reply packets that fill the cache with wrong hardware addresses, abusing a protocol that never checks its responses. Which attack is in play?

A staffer plugs a small unauthorized access point into a corporate Ethernet port, and with no administrator managing it, the device quietly offers backdoor entry to the internal wireless network. What has been introduced?

Near a coffee shop, an attacker stands up an access point advertising the same SSID as the venue’s real hotspot so that patrons connect to it by mistake. Which attack does this describe?

An attacker parks nearby with a high-gain amplifier that floods the channel with an overpowering signal, abusing the 802.11 collision-avoidance rules until nobody can transmit. Which attack is being performed?

Against LTE handsets that encrypt data in AES counter mode, an attacker slots a fake tower between the device and the real base station to hijack the session and steer the victim to chosen sites. Which attack is described?

An attacker gains entry to a wireless network by pulling the Wi-Fi credentials that a victim’s browser has stored, using no cracking mechanism at all. Which attack accomplishes this?

An attacker reads the data off a legitimate badge tag and burns a duplicate onto a fresh chip so the copy behaves like the original. Which attack has been carried out?

Having already gained access to the target WLAN, the attacker now works to break the WPA2 protection that still secures its traffic. Which methodology phase is this?

An attacker has captured a WPA handshake and now runs a wordlist of common passwords against it, hoping one matches the key. What technique is this?

Before an attacker can capture the four-way handshake, the wireless adapter must be switched into a state that records all nearby Wi-Fi traffic, not only the frames sent to it. Which mode is that?

During an offline WPA2 cracking attempt, the one item an attacker must obtain from the air is the authentication exchange between the client and the access point. What is this exchange called?

With a captured handshake in hand, an analyst wants the classic command-line tool that takes the handshake and a wordlist and reports a found key when a password matches. Name the tool.

A target network is idle, so no handshake has been seen. The attacker wants to knock a connected device off so it reconnects and the handshake can be captured. Which utility sends the deauthentication packets?

An examiner prefers a point-and-click auditing program built in Python that scans for networks, deauthenticates clients, captures the handshake, and can also recover WPS keys. Which tool is described?

Researchers disclosed a group of weaknesses in WPA3 that let attackers recover keys, weaken protections, and steal information. By what name is this set of vulnerabilities known?

A client and access point both support WPA3 and WPA2. An attacker stands up a rogue AP that offers only WPA2, pushing the client onto the older method so it can be cracked. How is this attack classified?

After capturing raw wireless packets for a WPA3 target, an attacker needs to turn them into a hash format that a GPU cracker can load. Which toolset performs the conversion?

Once a handshake has been converted to hash format, an attacker loads it into a fast GPU-driven password cracker and runs it against a wordlist. Name the cracker in use.

A router feature meant to simplify connecting devices exposes registrar PINs that an attacker can exploit to recover the WPA2 passphrase. What is this feature?

An attacker cycles through every possible PIN that a router will accept until one is validated, after which exploitation begins. Which attack is this?

An operator needs a proven tool that attacks WPS registrar PINs to recover WPA and WPA2 passphrases and has been tested across many access points and WPS implementations. Which tool should they choose?

A researcher documents an attack that exploits the underlying vulnerabilities in wireless chips handling Bluetooth and Wi-Fi, then uses a foothold on one chip to raise privileges beyond that chip’s boundary. Which term names this attack?

While the two functions share resources on a combined device, a Bluetooth chip directly captures credentials from the Wi-Fi chip and manipulates the traffic passing through it, causing escalation at the chip boundary. What is this called?

A single wireless chip on a phone is built to handle both Bluetooth and Wi-Fi communications, and attackers exploit that shared component to steal data crossing from one radio to the other. Which piece of hardware makes this possible?

A security team installs a system that analyzes and monitors the RF spectrum and raises alarms whenever an unauthorized wireless device violates policy, leaving any response to the administrators. Which system have they installed?

An administrator sets a WiFi password that is long, complex, and hard to guess specifically to blunt WPA cracking attempts. What is this password practice called?

In the router settings, an engineer turns off the weaker cipher option so that connections rely only on AES encryption. Which countermeasure is described?

An access point is configured to admit only a fixed set of hardware addresses, so any device whose address is not on the list is refused a connection. Name the control in effect.

To stop attackers from reaching the router’s administrative interface across the internet, an administrator turns off the feature that would let the device be configured from outside the local network. Which best practice does this describe?

Because the PIN-based setup feature carries flaws that let attackers brute-force it, an administrator switches that feature off in the router settings. Identify the measure.

An administrator checks the manufacturer website on a regular schedule and applies each released patch to the router to close known vulnerabilities. What is this called?

To keep the network from being usable in the parking lot, an administrator lowers the router’s transmission power and places it centrally within the building. Which defence has been applied?

A network is upgraded to a WPA3 handshake that resists offline dictionary attacks and provides forward secrecy for each session. Pick the mechanism responsible.

Once every client on a network supports WPA3, an administrator turns off the WPA2 and WPA3 mixed mode to remove the risk it introduces. Which protocol setting is this?

An architect separates the critical parts of a network from general user access, so that a device compromised on the user side cannot reach the sensitive systems. What does this describe?

On a mobile-facing link, a design requires that the user equipment and the network each prove their identity to the other before traffic flows. Which technique is at work?

A wireless team uses RF scanning, comparison against an authorized device list, and signal strength analysis to find unauthorized access points near the premises. Which control closes this gap?

An organization deploys a network device that watches the radio spectrum for unauthorized access points and, on finding one, can take blocking action on its own. Identify the countermeasure.

An administrator uses VLANs and separate SSIDs to keep different types of network traffic apart from one another. Which segmentation approach is this?

So that the network name does not appear in the list of broadcast wireless messages, an administrator keeps it hidden instead of advertising it. Which control is this?

A cafe stands up a separate SSID with restricted access for customers, keeping them away from the resources on the main business network. Name the practice.

An enterprise ties wireless access to a RADIUS server so that every user signs in with individual credentials rather than a shared passphrase. Which authentication method is being used?

To make a stolen password insufficient on its own, an administrator requires each user to present more than one credential factor when connecting. What has the team enabled?

Within a wireless prevention deployment, one access point is dedicated to constant channel scanning with attack detection and packet capture rather than serving clients. Which of these is described?

A security team wants a single class of products that provides wireless network threat detection and mitigation and lets analysts detect, analyze, and identify wireless threats and security vulnerabilities. Which category are they describing?

A team needs a WIPS that offers dedicated monitoring and detection of wireless anomalies, unauthorized access, and RF attacks while delivering integrated visibility and control across the network with no separate overlay solution. Which product matches this profile?

A vendor markets its cloud service as defending against unauthorized devices and rogue APs, preventing evil twins, and shutting down malicious attacks such as DoS with close to zero false positives. Which product is being described?