CEH Fast Track Module 16 Quiz Level 3 – Exam Simulation

A wireless analyst named Priya Venkatesan supports a hospitality chain in Lisbon, Portugal, and is documenting the wireless environment across three guest lounges. Her capture logs list a friendly network name that appears on guest phones, a public area where visitors connect their devices to the Internet, and a forty-eight-bit hardware value that uniquely identifies the radio of the access point that established the basic service set. Priya wants to label that forty-eight-bit hardware value correctly in her report so colleagues can match captured frames to the exact radio that originated them. Which term names that value?

A network engineer named Tobias Kessler is asked to design a Wi-Fi authentication scheme in which every employee holds a distinct login tied to their own identity. His notes mention a directional antenna mounted on the roof, a small guest lounge near the reception desk, and a plan to place a centralized RADIUS server that verifies each user’s credentials independently before granting network access. Tobias must name the authentication mode built around that centralized RADIUS server and its independent per-user verification so the procurement request he submits is completely unambiguous. Which mode fits his description?

A field technician is planning a long-range wireless link between two warehouses on the outskirts of Denver, Colorado. The span is roughly eight kilometers with clear line of sight, and interference from a nearby industrial park is a real concern for the project. The technician needs the antenna built from a semi-dish grid of aluminum wires resembling a satellite dish, one that achieves very-long-distance Wi-Fi transmission by concentrating its output into a single, highly focused radio beam. He wants to specify exactly that antenna on the purchase order. Which antenna meets the description?

An RF consultant named Dr. Helena Fischer is advising a municipal broadband pilot in which a single directional link must reach a distant hilltop relay across a valley. Her design brief calls for a unidirectional, high-gain antenna that operates at frequencies from ten megahertz up through the VHF and UHF ranges and develops what engineers call an end-fire radiation pattern along its boom. The client also asked about plaza coverage, but this particular purchase is only for the point-to-point hilltop link. Which antenna matches the unidirectional, end-fire description set out in her brief?

A security auditor is reviewing wireless documentation for a regional retail group and finds several network identifiers described inconsistently across the store binders. One entry refers to a thirty-two-alphanumeric-character unique value assigned to a wireless local area network that functions as the human-facing name identifying that network to client devices scanning for it. The auditor wants to standardize the terminology so that every store’s paperwork uses one correct word for that thirty-two-character network name, ending the confusion among the branch technicians. Which term correctly names that identifier?

A network engineer is hardening a legacy wireless deployment for a manufacturing plant where older client radios cannot yet be replaced. He needs to describe, in a memo, the WPA-era protocol that changes the unicast encryption key for every packet and replaces WEP through per-packet key mixing, a message integrity check, extended initialization vectors, and a re-keying mechanism. He has also captured a four-way handshake and reviewed the plant’s antenna placement, but the memo he is drafting concerns only that per-packet keying protocol and nothing else. Which protocol is he describing?

A penetration tester named Ingrid Lammers is assessing a corporate WLAN and is explaining her capture strategy to the client’s security team. She describes the specific message exchange through which WPA and WPA2 derive the temporal encryption keys that protect a session, noting that capturing it is the prerequisite for any later offline password attempt. Her report also mentions the pairwise master key and an ANonce value seen in the trace, but the section she is writing now must name the exchange itself that yields those temporal keys. Which exchange is Ingrid describing?

A threat researcher named Sofia Marchetti is cataloging attacks against WPA2 for a briefing in Milan, Italy. One entry describes a key reinstallation attack that exploits a flaw in the WPA2 four-way handshake and can let an adversary sniff packets, hijack connections, inject malware into traffic, and decrypt data protected by the network. The affected network uses AES-CCMP with a strong passphrase, yet this reinstallation weakness remains exploitable regardless of how strong that passphrase is. Sofia wants the slide to carry the precise, widely recognized name for this attack. Which attack is she describing?

A wireless architect is designing a WPA3 rollout for a large university campus and is documenting why the new design resists password guessing. He focuses on the modern key establishment protocol, also known as Dragonfly Key Exchange, that replaces the older pre-shared key concept and is specifically engineered to resist offline dictionary attacks against captured material. His notes also mention the campus plan to disable transition mode and to turn off WPS, but the paragraph he is writing must name that key establishment protocol itself. Which protocol is the architect describing?

A SOC analyst named Grace Abara is investigating an incident at a shipping company where a laptop inside the building was quietly compromised. Telemetry shows the laptop associated with an access point that does not belong to the company’s legitimate network, and through that outside association the attacker gained a foothold from which to launch further access-control attacks. Grace must classify the root behavior in her report, focusing precisely on the client’s act of connecting to an access point outside the legitimate network. Which wireless threat best names that behavior?

A wireless engineer is analyzing an availability incident at a conference center in Valencia, Spain, where attendees kept losing Wi-Fi during the keynote sessions. His captures show frames that sever the established association between one specific client and its access point while that client stays authenticated to the AP, so it is dropped without being forced into a fresh authentication handshake, leaving that single client unable to reach the network while other devices nearby stayed comfortably online. The engineer needs to classify the attack by its defining effect, the destruction of the association between one access point and one client. Which attack best fits that description?

A privacy investigator is reviewing a data-exposure complaint at a cafe chain where customer information reportedly leaked over the open guest Wi-Fi. Packet captures show an attacker passively collecting and decoding unprotected application traffic that carried sensitive customer details in the clear as it crossed the guest network. The investigator must categorize this as a confidentiality attack and give a precise name to the specific technique of capturing and decoding that unprotected application traffic. Which technique best describes what the attacker did on the network?

A network researcher named Diego Fuentes is studying attacks against a wireless mesh used by a city’s environmental sensors. In one scenario an adversary secretly tunnels traffic between two distant nodes and then advertises that tunnel as the shortest route, causing the dynamic routing protocol to funnel data through the attacker so the flow can be quietly observed and controlled. Diego needs to name this routing-layer attack precisely for his findings, focusing on the tunnel-and-shortest-route behavior he reproduced in the lab. Which attack is he describing?

A consultant is teaching a wireless discovery workshop and is describing the earliest reconnaissance techniques an attacker might use before touching a target. She recounts an approach in which someone drives slowly around a neighborhood with a Wi-Fi-enabled laptop and a wireless discovery tool, mapping out the open wireless networks that fall within range along the route. The workshop also covers antenna selection and traffic capture later in the day, but this early module is only about the discovery phase itself. The consultant wants the trainees to attach the correct one-word name to that drive-and-map discovery activity for their notes. Which term names it?

A security lead named Oliver Grant is investigating credential theft at a coworking space in Dublin, Ireland. Members reported connecting to what looked like the usual network, but their logins were later captured. Analysis shows an attacker-operated access point that imitated the legitimate network’s SSID exactly, luring members into connecting to it so that their traffic passed through the attacker’s equipment. Oliver must name the specific access-point attack defined by imitating a legitimate SSID to lure users into associating. Which term applies to what he found?

A forensic analyst is reconstructing a breach in which an attacker obtained a home-office Wi-Fi password without ever capturing or cracking a wireless handshake. The evidence shows the attacker retrieved the Wi-Fi credentials that had been saved inside the victim’s web browser, then used those stored credentials to join the network directly and move on to the internal hosts. The analyst needs to name this attack, which succeeds by harvesting browser-saved Wi-Fi credentials and relies on no cracking mechanism at all. Which attack does the evidence describe?

A mobile security engineer named Elena Popova is analyzing an interception incident affecting LTE devices for an operator in Sofia, Bulgaria. The attacker exploited the way LTE relies on AES counter mode encryption and placed a fake cell tower between the subscriber and the real network, using that position to hijack active sessions and redirect victims to attacker-chosen destinations. Elena must record the named attack characterized by abusing LTE’s AES counter mode together with a fake tower to hijack and redirect traffic. Which attack is she documenting?

A penetration tester is documenting her toolchain during an authorized wireless assessment of a client’s office network. She notes that after enabling monitor mode she needed a utility that sends deauthentication packets to a device already connected to the target access point, forcing that device to reconnect so that the resulting WPA handshake could be captured for later offline analysis. The tester wants to name the specific tool that generated those deauthentication packets to trigger the reconnection. Which tool did she use for that step?

A red-team operator named Mateo Alvarez is assessing home-office routers for a client headquartered in Bogota, Colombia, where many devices still have Wi-Fi Protected Setup enabled. The routers vary widely in firmware and manufacturer, and several have never had their default passphrases changed by the tenants. He selects a practical, well-known attack tool that targets the WPS registrar PIN on an access point and, by working through that PIN, recovers the WPA or WPA2 passphrase across a wide range of routers and WPS implementations. Mateo needs to name the tool built specifically for attacking WPS registrar PINs. Which tool is it?

A cracking specialist is finishing an offline analysis for an authorized engagement against a client’s wireless network. The rules of engagement permit only offline work against material that was already captured earlier in the week, with no further transmissions on site. Earlier in the process a separate toolset converted the captured raw wireless packets into a hash format, and now she needs the password-cracking tool that takes that WPA or WPA3 handshake in hash format and tests it against a very large wordlist to recover the passphrase. She wants to name the tool that actually performs this hash-based cracking step. Which tool performs the cracking?

A network administrator is tightening a small-office wireless configuration and reviewing settings that reduce casual discovery of the network by outsiders. The office has a dozen laptops, a shared printer, and a steady mix of visitor and staff devices, and management has asked for a low-effort change first. One setting he considers stops the access point from broadcasting the network name in its beacon frames, keeping the SSID in a hidden mode so it does not appear automatically in the list of nearby networks on a passerby’s phone. The administrator wants to label this specific configuration correctly in the hardening checklist he maintains. Which countermeasure is he describing?

A wireless engineer named Sven Eriksson is remediating findings on a corporate WLAN after an audit flagged legacy cipher support on the access points. The access points already use a strong pre-shared key and MAC address filtering, yet the auditor specifically required removing support for the older temporal key protocol. The recommended change turns that protocol off in the router settings so the network negotiates only AES-based encryption from that point on. Sven wants to record this step with its precise name in the ticket. Which countermeasure is he applying?

A security architect named Beatriz Santos is selecting a monitoring platform for a data center in Sao Paulo, Brazil, and is comparing two radio-spectrum products. The one she favors both monitors the spectrum to detect unauthorized access points and automatically acts to shut those rogue devices down on its own. Beatriz needs to name the class of device defined by both monitoring the spectrum and automatically implementing countermeasures against rogue APs. Which system is she describing?

A CISO is designing defenses for a hospital network so that a breach in one area cannot easily spread to the rest of the environment. The site spans imaging systems, electronic patient records, and a busy public waiting area, and regulators expect documented containment measures. Her plan separates the critical clinical systems from general staff and visitor access, placing the most sensitive resources where a compromise elsewhere cannot readily reach them and limiting the blast radius of any single successful attack. The CISO wants to name this architectural countermeasure precisely in the written security policy. Which countermeasure is she applying?

A wireless administrator named Amara Nwosu is finalizing a hardening standard for branch routers, focusing on features with known brute-force exposure across the fleet. The branches run a mix of consumer and business routers, and several models still ship with the feature enabled by default out of the box. One required change turns off the setup feature whose personal identification number can be brute-forced, because leaving that feature enabled lets an attacker work methodically through its PIN to recover the network passphrase. Amara wants to enter this specific step under its correct name in the standard she is publishing. Which countermeasure is she mandating?