CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography Practice Test 4 — 15 Questions

Question 1

A security analyst captures a large number of initialization vectors (IVs) on a WEP-protected network. Which tool is most commonly used to crack the WEP key using IVs?

Accepted Answer

Aircrack-ng. Aircrack-ng is the standard tool for cracking WEP keys by capturing IVs. Reaver is for WPS, Kismet is a sniffer, and John the Ripper is a general password cracker.

Answer

Reaver

Answer

Kismet

Answer

John the Ripper

Question 2

What is the primary purpose of the 4-way handshake in WPA/WPA2-Personal?

Accepted Answer

To establish encryption keys without transmitting the pre-shared key. The 4-way handshake confirms that both client and AP possess the pre-shared key (PSK) without exposing it, and generates temporal keys for encryption.

Answer

To authenticate the user with a username and password

Answer

To synchronize the beacon intervals between client and AP

Answer

To exchange digital certificates between client and AP

Question 3

During a penetration test, a tester captures the WPA2 4-way handshake with airodump-ng and then uses aircrack-ng with a wordlist. However, the PSK is not found. Which of the following is the MOST likely reason?

Accepted Answer

The wordlist does not contain the PSK. If the PSK is not in the wordlist, dictionary attacks will fail. Other steps (capture, cracking) were done correctly.

Answer

Aircrack-ng does not support WPA2 cracking

Answer

The handshake was not captured correctly

Answer

The network uses WPA3 instead of WPA2

Question 4

An attacker sets up a rogue access point with the same SSID as a legitimate corporate network and broadcasts a stronger signal. Clients connect to the rogue AP. What type of attack is this?

Accepted Answer

Evil twin attack. An evil twin attack involves a rogue AP mimicking a legitimate SSID to intercept traffic.

Answer

WPS PIN attack

Answer

De-authentication attack

Answer

MAC spoofing attack

Question 5

In the cloud shared responsibility model, which of the following is typically the responsibility of the customer when using AWS EC2 (IaaS)?

Accepted Answer

Configuring security groups and firewall rules. AWS is responsible for the physical host and network infrastructure; the customer manages the guest OS, applications, and security groups.

Answer

Patching the hypervisor

Answer

Network infrastructure redundancy

Answer

Physical security of data centers

Question 6

A security team discovers that an S3 bucket configured for static website hosting is exposing sensitive documents. The bucket policy allows public read access. Which AWS misconfiguration is MOST likely present?

Accepted Answer

The bucket policy allows s3:GetObject for all principals. Public read access to the bucket and objects is the direct cause. Blocking public access would prevent this.

Answer

The bucket versioning is disabled

Answer

The bucket is not using server-side encryption

Answer

The bucket ACL grants write access to authenticated users

Question 7

Which cloud security assessment tool is specifically designed to audit AWS environments against best practices and CIS benchmarks?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source tool that audits cloud environments (AWS, Azure, GCP) for security misconfigurations.

Answer

Pacu

Answer

Nessus

Answer

Metasploit

Question 8

An IoT device uses the MQTT protocol without TLS. An attacker on the same network subscribes to all topics and captures messages. What is the MOST significant security risk?

Accepted Answer

Loss of message confidentiality. Without TLS, MQTT traffic is sent in cleartext, allowing interception and reading of sensitive data.

Answer

Firmware corruption

Answer

Denial of service

Answer

Replay attacks

Question 9

A penetration tester performs a container escape by exploiting a misconfigured capability and mounts the host filesystem. Which cloud service model is MOST directly affected?

Accepted Answer

Infrastructure as a Service (IaaS). Container escape compromises the host, affecting the underlying infrastructure in IaaS. In PaaS/SaaS, the provider may manage containers differently.

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Question 10

Which cryptographic algorithm is vulnerable to a birthday attack on its hash output size of 128 bits, reducing the effective security to 64 bits against collision resistance?

Accepted Answer

MD5. MD5 produces 128-bit hashes. Birthday attack complexity for collision is 2^(n/2) = 2^64 for n=128. SHA-1 is 160-bit, SHA-256 is 256-bit, RC4 is a stream cipher not a hash.

Answer

SHA-256

Answer

SHA-1

Answer

RC4

Question 11

In PKI, what is the primary role of a Certificate Authority (CA)?

Accepted Answer

To issue and digitally sign certificates. A CA issues and signs digital certificates, validating the identity of certificate requestors.

Answer

To revoke user passwords

Answer

To generate random session keys

Answer

To encrypt data between client and server

Question 12

An analyst sees the following in a log: Client sends a request to https://victim.com/api?url=http://169.254.169.254/latest/meta-data/. This is MOST indicative of which attack?

Accepted Answer

Server-side request forgery (SSRF). The IP 169.254.169.254 is the AWS metadata endpoint. SSRF attacks target internal services by manipulating the url parameter.

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Answer

SQL injection

Question 13

Which TWO of the following are common defense measures against wireless de-authentication attacks? (Select 2)

Accepted Answer

Enabling 802.11w (Management Frame Protection). Using WPA3 (SAE) mitigates de-auth because management frame protection is mandatory. 802.11w (MFP) also protects de-auth frames. Changing default SSID and disabling SSID broadcast do not prevent de-auth.

Answer

Changing the default SSID

Answer

Implementing MAC address filtering

Answer

Disabling SSID broadcast

Question 14

Which THREE of the following are valid methods for exploiting cloud misconfigurations? (Select 3)

Accepted Answer

Using a container escape to access the host OS. S3 bucket public read access, overly permissive IAM roles, and container escape are all cloud misconfiguration exploitation vectors. SQL injection is a web app vulnerability, not cloud-specific. DDoS is an attack type, not a misconfiguration.

Answer

Performing a SQL injection on a web application

Answer

Launching a DDoS attack from a botnet

Question 15

Which TWO of the following are examples of asymmetric cryptography? (Select 2)

Accepted Answer

RSA. RSA and ECC are asymmetric algorithms. AES and 3DES are symmetric. MD5 is a hash function.

Answer

3DES

Answer

MD5

Answer

AES