CEH Fast Track Module 16 Quiz Level 2 – Blueprint Application

A wireless client scanning the airspace displays a list of network names it can join, each a short human-readable label of up to 32 alphanumeric characters that identifies one wireless LAN and lets the user pick which network to associate with, and the same value can appear on several access points that all serve one wireless LAN. Which element is being shown in that list?

An engineer is documenting a wireless deployment and needs to record, for each access point, the value that equals the media access control address of the access point that established a basic service set, so she can tell two APs apart even when they advertise the same network name. Which value is she recording?

A mid-size firm is replacing its guest style wireless login and wants every employee to authenticate to the corporate network with individual credentials that a centralized RADIUS server verifies independently for each user, giving the security team per-user accountability and the ability to revoke one person without changing everyone’s access. Which authentication approach best fits this requirement?

An attacker needs to reach a target Wi-Fi network from a great distance and chooses hardware built like a semi-dish grid of aluminum wires resembling a satellite dish, which concentrates the radio energy into a highly focused beam to achieve very-long-distance transmission toward a rooftop several kilometers away. Which antenna did the attacker choose?

An access point needs to cover an open office equally in every direction, radiating electromagnetic energy in a 360 degree horizontal pattern. Which antenna suits this?

During an audit, Priya finds a legacy access point still running the original security protocol defined by the 802.11b standard, the one designed to give a wireless LAN privacy comparable to a wired LAN but long since considered broken and trivially crackable with modern statistical tools. Which encryption protocol is the access point using?

A wireless protocol changes the unicast encryption key for every packet and was introduced to replace WEP without new hardware, adding per-packet key mixing, a message integrity check, extended initialization vectors, and a re-keying mechanism on top of the RC4 cipher. It was standardized as part of WPA so that existing access points could gain stronger protection through a firmware update alone, and its message integrity check was designed to defeat the forgery and replay tricks that had broken WEP, though it still relies on the aging RC4 stream cipher underneath. Which protocol is described?

An attacker wants to capture the exchange by which WPA and WPA2 clients and access points derive the temporal encryption keys that protect the session, because recording this exchange offline is the prerequisite for a later dictionary or brute-force attempt against the passphrase, and no live interaction with the target is needed once it is recorded. Which exchange must the attacker capture?

Security researcher Tomas demonstrates an attack against WPA2 in which the victim is tricked into reinstalling an already-in-use key during the handshake, resetting associated packet counters and nonces so the attacker can sniff traffic, hijack connections, inject malware, and in some cases decrypt packets, all without recovering the actual passphrase. The affected devices were missing the vendor patch that addresses the nonce reuse flaw, and the attack succeeds against the client side of the handshake while the network passphrase itself stays unknown to the attacker. Which named WPA2 attack is Tomas demonstrating?

On a target WLAN, an attacker sends frames that destroy the connectivity between a specific client and its access point so that the client becomes unavailable to other wireless devices and loses its established session. This is an availability attack that targets one victim’s link to the AP. Which availability attack best describes this behavior?

An analyst captures and decodes unprotected application traffic on a wireless network to obtain sensitive information, without altering frames or disrupting service. Which confidentiality attack is this?

In a wireless network that relies on a dynamic routing protocol, an attacker tunnels captured traffic between two colluding nodes and advertises this tunnel as the shortest route, so that a large share of the network’s traffic flows through the attacker’s controlled path. Which routing-focused attack best describes this behavior?

Rahul reviews an incident where a corporate laptop connected to an access point outside the organization’s legitimate network, and that association outside the sanctioned infrastructure opened the door to further access-control attacks against the device. Which wireless threat describes the laptop connecting to an AP outside the legitimate network?

An attacker drives slowly through a business district with a Wi-Fi-enabled laptop and a wireless discovery tool running, logging the open and vulnerable wireless networks encountered along the route so they can be mapped for a later attack. Which discovery technique is the attacker performing?

An attacker sets up an access point that imitates the SSID of a legitimate coffee-shop network so that nearby users’ devices connect to it believing it is the genuine network, letting the attacker intercept their traffic. Which unauthorized access point is described?

Karim is studying an attack that targets LTE devices which use AES in counter mode. The attacker positions a fake cellular tower between the victim and the real network, then leverages the malleability of counter-mode encryption to redirect the victim to malicious destinations and hijack the session, all while the victim believes the connection is normal. The attack relies purely on the predictable bit manipulation that counter mode permits, letting the attacker alter the ciphertext in transit. Which named attack is Karim studying?

An attacker joins a victim’s wireless network by retrieving Wi-Fi credentials saved in the victim’s browser, needing no handshake capture or cracking. Which named attack is this?

Elena has already captured a WPA2 authentication handshake from a target network and now wants to attempt to recover the passphrase offline. She turns to a well-known tool that takes the captured handshake and compares it against a wordlist of candidate passwords, testing each until one reproduces the handshake or the list is exhausted. The strength of this approach depends entirely on whether the correct password appears in the wordlist she supplies, since the tool only tests candidates that are already on the list. Which tool is she using?

To force a connected client to reconnect so that its WPA handshake can be captured, an attacker uses a tool that transmits deauthentication packets at the target device, prompting it to re-authenticate with the access point, which is a prerequisite step before any offline cracking can begin. Which tool sends the deauthentication packets for this purpose?

Marcus targets a home router that has Wi-Fi Protected Setup enabled. He runs a practical attack tool designed to work against the WPS registrar PIN across many access points and WPS implementations, and once it recovers the PIN it discloses the WPA or WPA2 passphrase. Which tool is Marcus using?

A security team wants a system that continuously analyzes and monitors the RF spectrum and raises alarms whenever an unauthorized wireless device violates the organization’s security policy, so that analysts receive a notification and can investigate the violation before it escalates into a breach. Which defensive system best fills this detection and alerting role?

A router administrator learns that the network’s Wi-Fi Protected Setup feature is vulnerable to a brute-force attack that scans through possible PIN values until it finds the one that unlocks the passphrase. The administrator is unable to upgrade the hardware and wants to close off this specific PIN-guessing avenue directly at its source, while leaving normal WPA2 passphrase authentication working for existing clients. This vulnerability is well documented because the PIN space is small enough that an automated tool can exhaust it in hours, and the attacker can begin without any valid credentials. Which countermeasure best addresses this particular vulnerability?

To make the wireless network less obvious to casual scanners, an administrator configures the access point to stop broadcasting its network name in beacon frames, keeping the identifier hidden so it stays out of the list of available networks that client devices display automatically when they scan the surrounding airspace. Which countermeasure has the administrator applied?

After a tabletop exercise, Fatima recommends a design in which the most sensitive parts of the corporate network are separated from general user and guest access, so that if an attacker compromises a device on the ordinary user network the attacker remains confined to that segment and is kept away from the critical systems. Her goal is to contain the impact of any single compromise by limiting where a foothold can spread. Which countermeasure is Fatima recommending?

An organization upgrading its wireless security wants a WPA3 mechanism that protects against offline dictionary attacks and provides forward secrecy for each session. Which mechanism best meets these two goals?