CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security analyst captures WPA2 handshake packets using airodump-ng and then runs aircrack-ng with a wordlist. After several minutes, aircrack-ng reports 'KEY FOUND!' followed by a hex string. Which attack was successfully performed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dictionary attack on the 4-way handshake
The analyst captured the 4-way handshake and used a dictionary attack (wordlist) to recover the PSK. This is a dictionary attack, not brute force (which tries all combinations), rainbow table, or hash length extension (which is for hash-based MACs).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Dictionary attack on the 4-way handshake
Why this is correct
A dictionary attack is the most practical method for cracking WPA2-PSK when a 4-way handshake has been captured. Tools like Aircrack-ng take a wordlist and for each entry, derive the Pairwise Master Key (PMK) using PBKDF2 with the SSID as a salt. This derived PMK is then used to reconstruct the Message Integrity Code (MIC) from the captured handshake. If the calculated MIC matches the one in the captured handshake, the wordlist entry is confirmed as the correct Pre-Shared Key (PSK).
- ✗
Hash length extension attack on the MIC
Why it's wrong here
A hash length extension attack exploits cryptographic hash functions built on the Merkle-Damgård construction, allowing an attacker to append data to a hashed message and compute a valid hash for the new, longer message without knowing the original secret. However, the Message Integrity Code (MIC) in WPA2 is computed using HMAC-SHA1, which is a keyed-hash message authentication code. HMAC constructions are specifically designed to prevent length extension attacks by using an outer and inner hash with a secret key, making them robust against this particular vulnerability.
- ✗
Rainbow table attack on the WPA2 handshake
Why it's wrong here
Rainbow tables precompute hash chains for a large set of possible inputs, allowing for rapid lookup of pre-image values. While effective against unsalted hashes, WPA2-PSK key derivation uses PBKDF2 (Password-Based Key Derivation Function 2) which incorporates a salt – specifically, the network's SSID. This salting means that the hash output is unique for each SSID, rendering generic rainbow tables useless. An attacker would need to generate a unique rainbow table for every target SSID, which is computationally prohibitive and impractical.
- ✗
Brute-force attack against the PSK
Why it's wrong here
A true brute-force attack involves systematically trying every possible character combination within a defined character set and length until the correct Pre-Shared Key (PSK) is found. While theoretically possible, the immense computational power required to test all permutations for a reasonably long WPA2 PSK (e.g., 8-63 characters) makes it practically infeasible within a realistic timeframe. Dictionary attacks, in contrast, leverage common passwords and phrases, significantly reducing the search space to a manageable size.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.