CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security analyst captures a large number of weak initialization vectors (IVs) using airodump-ng. Which attack does this preparation indicate?
⚠ Common exam trap
EC-Council often tests the distinction between WEP and WPA/WPA2 by having candidates confuse weak IVs (a WEP-specific vulnerability) with the 4-way handshake (required for WPA/WPA2 cracking), leading them to incorrectly select the WPA2 dictionary attack option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WEP key cracking
WEP (Wired Equivalent Privacy) uses the RC4 stream cipher with a 24-bit initialization vector (IV) that is transmitted in plaintext. Weak IVs, such as those identified by tools like airodump-ng, are predictable or repeatable, allowing an attacker to capture enough packets to recover the WEP key using statistical attacks like the FMS (Fluhrer, Mantin, Shamir) or KoreK attacks. This preparation directly indicates an attempt to crack the WEP key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
WPS PIN brute force
Why it's wrong here
WPS PIN brute force attacks target the 8-digit PIN used for easy device connection, typically exploiting a design flaw that allows the PIN to be verified in two halves, significantly reducing the brute-force search space. This attack does not involve capturing or exploiting Initialization Vectors (IVs) from network traffic, as IVs are primarily associated with the encryption process itself, not the WPS authentication mechanism.
- ✗
WPA2 dictionary attack
Why it's wrong here
WPA2 cracking, specifically dictionary attacks, relies on capturing the four-way handshake between a client and an Access Point (AP). This handshake contains the Pairwise Master Key (PMK) derived from the Pre-Shared Key (PSK), which can then be brute-forced offline against a dictionary. WPA2 uses robust encryption protocols (like CCMP based on AES) that do not suffer from the weak Initialization Vector (IV) issues prevalent in older standards, making IV capture ineffective for WPA2 key recovery.
- ✓
WEP key cracking
Why this is correct
WEP (Wired Equivalent Privacy) encryption is notoriously vulnerable due to its use of a 24-bit Initialization Vector (IV) concatenated with the static WEP key to form the RC4 cipher key. The small IV space leads to frequent IV reuse, especially with weak IVs that reveal information about the key stream. By capturing a sufficient number of these weak IVs and their corresponding encrypted packets, tools like aircrack-ng can statistically analyze the patterns to deduce the WEP key, often within minutes.
- ✗
Evil twin attack
Why it's wrong here
An Evil Twin attack involves an attacker setting up a rogue Access Point (AP) that mimics a legitimate one, often with the same SSID, to trick users into connecting to it. The primary goal is to intercept user traffic, capture credentials, or inject malicious content, not to crack the underlying Wi-Fi encryption key by analyzing IVs. While the rogue AP might use WEP, WPA, or WPA2, the attack itself is a man-in-the-middle technique focused on client deception rather than cryptographic exploitation of IVs.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.