CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A penetration tester uses the tool Reaver to target a Wi-Fi network. What vulnerability is the tester attempting to exploit?
⚠ Common exam trap
EC-Council often tests the distinction between WPS PIN brute-force (Reaver) and WPA2 handshake capture (aircrack-ng), so candidates mistakenly associate any wireless attack with handshake capture rather than recognizing the specific tool-to-vulnerability mapping.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WPS PIN brute-force weakness
Reaver is a tool specifically designed to exploit the WPS (Wi-Fi Protected Setup) PIN brute-force vulnerability. It targets the WPS registrar's lack of rate-limiting and the fact that the PIN is split into two halves (first half 4 digits, second half 3 digits with a checksum), allowing an attacker to recover the WPS PIN and subsequently the WPA2 pre-shared key in a matter of hours.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
WPA2 4-way handshake capture
Why it's wrong here
Reaver's primary function is to exploit the WPS vulnerability, not to capture WPA2 4-way handshakes. While capturing a handshake is crucial for offline brute-force or dictionary attacks against WPA/WPA2 PSKs, tools like airodump-ng are specifically designed for packet sniffing and capturing these authentication frames. Reaver operates by directly interacting with the Access Point's WPS functionality, attempting to guess the PIN.
- ✓
WPS PIN brute-force weakness
Why this is correct
Reaver is specifically designed to exploit the design flaw in Wi-Fi Protected Setup (WPS) by performing a brute-force attack against the WPS PIN. This 8-digit PIN, often split into two smaller, independently verifiable sections, significantly reduces the number of attempts required to guess it. Successful exploitation allows Reaver to recover the WPA/WPA2 Pre-Shared Key (PSK), granting unauthorized access to the network.
- ✗
Weak WEP encryption keys
Why it's wrong here
Reaver is not designed to exploit weaknesses in WEP encryption keys. WEP cracking typically involves collecting a large number of Initialization Vectors (IVs) by injecting packets and then using statistical analysis tools like aircrack-ng to deduce the WEP key. Reaver's functionality is exclusively focused on the WPS protocol, which is a separate and distinct security mechanism from WEP's encryption scheme.
- ✗
RADIUS authentication bypass
Why it's wrong here
Reaver does not facilitate RADIUS authentication bypass. RADIUS (Remote Authentication Dial-In User Service) is a centralized authentication, authorization, and accounting (AAA) protocol often used in enterprise environments with WPA2-Enterprise. Bypassing RADIUS typically involves exploiting vulnerabilities in the RADIUS server itself, its configuration, or the client authentication process, which is entirely separate from the WPS PIN brute-force attack performed by Reaver.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.