CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security analyst observes repeated de-authentication packets targeting clients on a corporate Wi-Fi network. What is the MOST likely goal of the attacker?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To capture the WPA2 4-way handshake for offline password cracking
De-authentication attacks force clients to reconnect, allowing the attacker to capture the 4-way handshake for offline cracking of the PSK.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To perform a denial-of-service attack and disrupt all wireless connectivity
Why it's wrong here
While sending repeated deauthentication packets can indeed disrupt wireless connectivity and cause a denial-of-service condition, this is typically a secondary effect or not the primary objective for an attacker observed specifically targeting WPA2 networks. The immediate goal of such an attack is usually to force a legitimate client to disconnect and then reauthenticate, allowing the attacker to capture critical authentication frames rather than simply causing network disruption.
- ✓
To capture the WPA2 4-way handshake for offline password cracking
Why this is correct
The primary purpose of repeatedly sending deauthentication packets in a WPA2 environment is to force connected clients to disconnect from the access point and then reinitiate the authentication process. This forced reconnection allows an attacker, who is passively monitoring the wireless traffic with tools like airodump-ng, to capture the WPA2 4-way handshake. This handshake contains cryptographic material that can then be used for offline brute-force or dictionary attacks to recover the Pre-Shared Key (PSK).
- ✗
To install malware on the client devices
Why it's wrong here
Deauthentication packets operate at Layer 2 of the OSI model, specifically within the MAC sublayer, and are designed solely to terminate a wireless connection between a client and an access point. They do not contain any payload or mechanism for injecting malicious code, transferring files, or exploiting software vulnerabilities on client devices. Therefore, these packets cannot directly facilitate the installation of malware; they only disrupt connectivity.
- ✗
To exploit a vulnerability in the RADIUS server
Why it's wrong here
Deauthentication frames are part of the IEEE 802.11 standard and are exchanged directly between a wireless client and an access point within the local wireless segment. They do not traverse to or interact with backend authentication servers like RADIUS, which typically operate at higher network layers (Layer 3 and above) and handle centralized authentication, authorization, and accounting. Exploiting a RADIUS server would require different attack vectors, such as credential stuffing or protocol manipulation, not deauthentication floods.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.