CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security analyst captures WPA2 handshake packets using airodump-ng and then runs aircrack-ng with a wordlist. After several minutes, aircrack-ng reports 'KEY FOUND!' followed by a hex string. Which attack was successfully performed?
⚠ Common exam trap
CEH often tests the distinction between dictionary and brute-force attacks — candidates see 'wordlist' and may still pick brute-force, but a wordlist-based attempt is definitionally a dictionary attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dictionary attack on the 4-way handshake
Running aircrack-ng with a wordlist against a captured WPA2 4-way handshake is a dictionary attack: aircrack-ng computes the PMK/PTK for each candidate passphrase and compares the resulting MIC to the captured handshake. When it reports 'KEY FOUND!', it has matched a passphrase from the wordlist. This is the classic WPA2 PSK cracking workflow.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Dictionary attack on the 4-way handshake
Why this is correct
A dictionary attack is the most practical method for cracking WPA2-PSK when a 4-way handshake has been captured. Tools like Aircrack-ng take a wordlist and for each entry, derive the Pairwise Master Key (PMK) using PBKDF2 with the SSID as a salt. This derived PMK is then used to reconstruct the Message Integrity Code (MIC) from the captured handshake. If the calculated MIC matches the one in the captured handshake, the wordlist entry is confirmed as the correct Pre-Shared Key (PSK).
- ✗
Hash length extension attack on the MIC
Why it's wrong here
A hash length extension attack exploits cryptographic hash functions built on the Merkle-Damgård construction, allowing an attacker to append data to a hashed message and compute a valid hash for the new, longer message without knowing the original secret. However, the Message Integrity Code (MIC) in WPA2 is computed using HMAC-SHA1, which is a keyed-hash message authentication code. HMAC constructions are specifically designed to prevent length extension attacks by using an outer and inner hash with a secret key, making them robust against this particular vulnerability.
- ✗
Rainbow table attack on the WPA2 handshake
Why it's wrong here
Rainbow tables precompute hash chains for a large set of possible inputs, allowing for rapid lookup of pre-image values. While effective against unsalted hashes, WPA2-PSK key derivation uses PBKDF2 (Password-Based Key Derivation Function 2) which incorporates a salt – specifically, the network's SSID. This salting means that the hash output is unique for each SSID, rendering generic rainbow tables useless. An attacker would need to generate a unique rainbow table for every target SSID, which is computationally prohibitive and impractical.
- ✗
Brute-force attack against the PSK
Why it's wrong here
A true brute-force attack involves systematically trying every possible character combination within a defined character set and length until the correct Pre-Shared Key (PSK) is found. While theoretically possible, the immense computational power required to test all permutations for a reasonably long WPA2 PSK (e.g., 8-63 characters) makes it practically infeasible within a realistic timeframe. Dictionary attacks, in contrast, leverage common passwords and phrases, significantly reducing the search space to a manageable size.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 913-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.