CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security analyst captures a WPA2 4-way handshake using airodump-ng. To crack the PSK, which tool would they MOST likely use next?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Aircrack-ng
The correct tool for cracking a WPA2 PSK from a captured handshake is aircrack-ng, which performs dictionary attacks against the handshake file.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Kismet
Why it's wrong here
Kismet is primarily a passive wireless network monitoring and discovery tool, designed for sniffing, mapping, and intrusion detection. It excels at identifying access points, client associations, and data traffic, providing valuable insights into network topology and activity. However, Kismet lacks the integrated cryptographic cracking engine necessary to actively perform dictionary attacks against captured WPA2 4-way handshakes to recover the Pre-Shared Key (PSK). Its function is observation, not active key derivation.
- ✓
Aircrack-ng
Why this is correct
Aircrack-ng is the definitive suite of tools for auditing wireless networks, specifically engineered for tasks like cracking WPA/WPA2-PSK keys. After capturing a complete 4-way handshake, the `aircrack-ng` component can efficiently perform dictionary attacks or brute-force attempts. It takes a wordlist and iteratively computes the Pairwise Master Key (PMK) for each candidate password, comparing the resulting Message Integrity Check (MIC) with the one contained within the captured handshake to validate the correct passphrase.
- ✗
John the Ripper
Why it's wrong here
John the Ripper is a powerful and versatile offline password cracking utility, primarily used for auditing various hash types such as Unix crypt, Windows NTLM, and database hashes. While it can be adapted to crack WPA2 handshakes, this typically requires converting the captured handshake file into a specific hash format that John can process, often with the aid of external utilities. It is not natively designed to parse and cryptographically verify WPA2 EAPOL frames directly, making Aircrack-ng the more specialized and efficient choice for this particular task.
- ✗
Reaver
Why it's wrong here
Reaver is a specialized tool specifically developed to exploit vulnerabilities within the Wi-Fi Protected Setup (WPS) protocol. Its primary function is to brute-force the WPS PIN, which, if successful, can reveal the network's WPA/WPA2 passphrase. Reaver does not directly perform dictionary attacks on captured WPA2 4-way handshakes; instead, it targets the WPS enrollment process, making it unsuitable for cracking a WPA2 PSK when WPS is either disabled or not the intended attack vector.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.