CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
An attacker uses Reaver against a Wi-Fi network. What vulnerability is the attacker primarily exploiting?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WPS PIN vulnerability
Reaver is designed to exploit the WPS PIN brute-force vulnerability, where an attacker can recover the WPS PIN and then derive the WPA/WPA2 PSK.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Weak WPA2 passphrase
Why it's wrong here
Reaver specifically exploits a design flaw in the Wi-Fi Protected Setup (WPS) protocol, which involves brute-forcing the 8-digit WPS PIN. This attack bypasses the need to guess the WPA2 passphrase entirely, as a successful WPS PIN crack reveals the network's pre-shared key (PSK). Therefore, the strength of the WPA2 passphrase is irrelevant to a Reaver attack's success, as it targets a separate authentication mechanism.
- ✓
WPS PIN vulnerability
Why this is correct
Reaver exploits a critical design flaw within the Wi-Fi Protected Setup (WPS) protocol, specifically its PIN authentication mechanism. The 8-digit WPS PIN is validated in two halves, allowing an attacker to brute-force the first four digits and then the last three (the eighth digit is a checksum) independently. This significantly reduces the total number of attempts required from 10^8 to approximately 10^4 + 10^3, making the PIN susceptible to a practical brute-force attack that reveals the WPA2 PSK.
- ✗
Deauthentication attack
Why it's wrong here
A deauthentication attack is a denial-of-service technique that sends forged deauthentication frames to disconnect clients from an access point, often used to capture WPA/WPA2 handshakes. While it can be a precursor to other attacks, it is not the primary mechanism Reaver uses to compromise a network. Reaver's core functionality relies on interacting directly with the WPS protocol's PIN exchange, not on forcibly disconnecting clients.
- ✗
IV weakness in WEP
Why it's wrong here
The IV (Initialization Vector) weakness is a well-known cryptographic vulnerability specific to the outdated Wired Equivalent Privacy (WEP) protocol. WEP's small IV space and predictable IV reuse allowed attackers to collect enough packets to derive the WEP key through statistical analysis. This vulnerability is entirely unrelated to Wi-Fi Protected Setup (WPS) or the Reaver tool, which targets the WPS PIN brute-force vulnerability, not WEP's cryptographic flaws.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.