CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  WEP IV attack

  Why it's wrong here

  A WEP IV (Initialization Vector) attack exploits the cryptographic weaknesses inherent in the WEP protocol by collecting a sufficient number of unique IVs from network traffic. These IVs, when combined with the statistical properties of RC4 stream cipher, allow tools like aircrack-ng to deduce the WEP key. Reaver, however, is not designed for packet capture and cryptographic analysis of WEP, but rather targets a completely different vulnerability in WPS.

• ✗

  Evil twin attack

  Why it's wrong here

  An evil twin attack involves an attacker setting up a rogue access point (AP) that masquerades as a legitimate Wi-Fi network, often with an identical SSID. The goal is to trick unsuspecting users into connecting to the fake AP, allowing the attacker to intercept their traffic, credentials, or inject malicious content. This type of attack typically utilizes tools such as airbase-ng to create the rogue AP, a functionality entirely outside the scope of Reaver's WPS-focused capabilities.

• ✗

  De-authentication attack

  Why it's wrong here

  A de-authentication attack is a denial-of-service technique where an attacker sends forged de-authentication frames to one or more clients, forcing them to disconnect from an access point. This is frequently employed to capture a WPA/WPA2 four-way handshake when a client attempts to reconnect, or to disrupt network services. Tools like aireplay-ng are specifically engineered for injecting these types of management frames, a function distinct from Reaver's WPS PIN brute-forcing purpose.

• ✓

  WPS PIN brute-force attack

  Why this is correct

  Reaver is purpose-built to execute a brute-force attack against the Wi-Fi Protected Setup (WPS) PIN, exploiting a significant design flaw in the protocol. This vulnerability allows an attacker to test the first four digits and the subsequent three digits of the 8-digit PIN independently, drastically reducing the number of attempts required. Upon successfully guessing the correct PIN, Reaver can then extract the network's Pre-Shared Key (PSK), thereby compromising the Wi-Fi network's security.

Go deeper

Related to this question