CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
During a wireless penetration test, the tester runs `airodump-ng wlan0mon` and sees numerous beacon frames from a network. The tester then sends deauthentication packets using `aireplay-ng -0 5 -a <BSSID> wlan0mon`. What is the PRIMARY purpose of this deauthentication attack?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To force a client to reconnect and capture the WPA/WPA2 handshake
Deauthentication attacks force clients to reconnect, allowing capture of the WPA/WPA2 4-way handshake during reconnection, which is needed for offline cracking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To crash the access point and cause a denial of service
Why it's wrong here
The deauthentication attack, often performed with `aireplay-ng` in conjunction with `airodump-ng`, sends forged deauthentication frames to disconnect clients. While this temporarily disrupts client connectivity, its primary intent in a penetration test is not to crash the access point or cause a sustained denial of service. The effect is typically transient, designed to trigger reauthentication rather than induce system instability or a lasting DoS condition.
- ✓
To force a client to reconnect and capture the WPA/WPA2 handshake
Why this is correct
Correct: `airodump-ng` is utilized to monitor wireless traffic and capture the WPA/WPA2 4-way handshake, which is essential for offline password cracking. To expedite this process, a deauthentication attack (typically executed with `aireplay-ng` alongside `airodump-ng`) is employed. This attack forces an authenticated client to disconnect and then immediately reconnect to the access point, thereby generating the necessary handshake frames for `airodump-ng` to record.
- ✗
To obtain the WPS PIN of the access point
Why it's wrong here
Obtaining the Wi-Fi Protected Setup (WPS) PIN involves exploiting vulnerabilities in the WPS protocol's authentication process, often through brute-forcing the PIN. This specific attack requires specialized tools such as Reaver or Bully, which systematically test PIN combinations. `airodump-ng` is a passive packet capture tool and does not possess the functionality to perform WPS PIN cracking or interact with the WPS protocol in this manner.
- ✗
To perform a rogue AP attack by spoofing the BSSID
Why it's wrong here
A rogue access point (AP) attack involves an attacker setting up a malicious AP that mimics a legitimate one, often with the same SSID and BSSID, to trick clients into connecting. This allows the attacker to intercept traffic or perform man-in-the-middle attacks. `airodump-ng` is a passive sniffing tool designed for capturing wireless frames and does not have the capability to create, broadcast, or manage a fake access point.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.