Question 819 of 870
CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security analyst captures a large number of unique initialization vectors (IVs) from a wireless network using airodump-ng. Which attack are they MOST likely preparing to execute?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WEP key recovery using aircrack-ng
WEP encryption is vulnerable to statistical attacks that require capturing many unique IVs to recover the WEP key. The large number of unique IVs indicates preparation for a WEP cracking attack using a tool like aircrack-ng.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
WPS PIN brute-force attack
Why it's wrong here
A WPS PIN brute-force attack targets the Wi-Fi Protected Setup (WPS) protocol's 8-digit PIN authentication mechanism. This attack exploits a design flaw allowing the PIN to be validated in two halves, significantly reducing the number of attempts needed to guess the correct PIN. It involves systematically trying various PIN combinations, often by sending authentication requests, rather than passively collecting a large number of unique Initialization Vectors (IVs) from network traffic for cryptographic analysis.
- ✗
Evil twin AP deployment
Why it's wrong here
An evil twin access point (AP) deployment involves setting up a rogue AP that mimics a legitimate one by using the same Service Set Identifier (SSID). The primary objective is to trick unsuspecting users into connecting to the malicious AP, allowing the attacker to intercept their network traffic, capture credentials through phishing, or inject malware. This attack relies on impersonation and user deception, and it does not involve the collection of numerous unique Initialization Vectors (IVs) as a core mechanism for its operation.
- ✓
WEP key recovery using aircrack-ng
Why this is correct
WEP key recovery using tools like aircrack-ng is the correct answer because WEP's fundamental cryptographic weakness stems from its inefficient use of Initialization Vectors (IVs) with the RC4 stream cipher. Attackers exploit the small 24-bit IV space and the plaintext transmission of IVs, leading to frequent IV reuse with the same WEP key. By collecting a large number of unique IVs, often hundreds of thousands to millions, statistical analysis can be performed to deduce the WEP key by observing patterns in the keystream generated from the IV and the key.
- ✗
WPA handshake capture
Why it's wrong here
WPA/WPA2 cracking primarily focuses on capturing the 4-way handshake that occurs when a client authenticates with an access point. This handshake contains cryptographic material derived from the Pre-Shared Key (PSK) or EAP credentials, which can then be subjected to offline dictionary or brute-force attacks. Unlike WEP, WPA's robust key derivation functions and larger IVs mean that simply collecting a large number of unique Initialization Vectors (IVs) is not a viable method for recovering the WPA key.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst captures a large number of weak initialization vectors (IVs) using airodump-ng. Which attack does this preparation indicate?
easy- A.WPS PIN brute force
- B.WPA2 dictionary attack
- ✓ C.WEP key cracking
- D.Evil twin attack
Why C: WEP (Wired Equivalent Privacy) uses the RC4 stream cipher with a 24-bit initialization vector (IV) that is transmitted in plaintext. Weak IVs, such as those identified by tools like airodump-ng, are predictable or repeatable, allowing an attacker to capture enough packets to recover the WEP key using statistical attacks like the FMS (Fluhrer, Mantin, Shamir) or KoreK attacks. This preparation directly indicates an attempt to crack the WEP key.
Last reviewed: Jun 21, 2026
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.