Match each wireless attack to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Exploiting weak encryption in older Wi-Fi
Rogue access point mimicking a legitimate one
Forcing clients to disconnect from AP
Intercepting the 4-way handshake for cracking
Unauthorized access to Bluetooth devices
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Evil Twin: A rogue access point that mimics a legitimate one to capture credentials
Correct matches: Evil Twin (A), Rogue AP (C), War Driving (F) are correctly paired. WEP Cracking (D is swapped with War Driving; B and E are misidentified).
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Evil Twin: A rogue access point that mimics a legitimate one to capture credentials
Why this is correct
An Evil Twin attack involves a malicious actor setting up a fraudulent access point (AP) that precisely mimics the SSID and other characteristics of a legitimate, trusted Wi-Fi network. This deception lures unsuspecting users to connect to the fake AP, allowing the attacker to intercept their network traffic, capture login credentials, and potentially inject malicious content. The primary goal is data interception through impersonation, not merely unauthorized network access.
War Driving: Exploiting weaknesses in WEP encryption to gain access
Why it's wrong here
This description incorrectly defines War Driving. Exploiting weaknesses in WEP encryption to gain access is precisely what WEP Cracking entails, a process that involves capturing sufficient initialization vectors (IVs) from WEP-encrypted traffic and then using tools like Aircrack-ng to computationally derive the WEP key. War Driving, in contrast, is the reconnaissance phase of locating networks, not the exploitation of their encryption.
Rogue AP: An unauthorized access point installed on a network without permission
Why this is correct
A Rogue AP is an unauthorized wireless access point or router physically connected to a legitimate wired network without the administrator's knowledge or permission. This device creates an unmanaged wireless backdoor, bypassing existing security controls and potentially exposing internal network resources to external attackers. Its installation often stems from employees seeking convenience or from malicious actors aiming to establish persistent access.
WEP Cracking: Driving around to detect wireless networks and gather information
Why it's wrong here
This statement inaccurately describes WEP Cracking. Driving around to detect wireless networks and gather information, such as SSIDs, MAC addresses, and security types, is the definition of War Driving, a reconnaissance activity. WEP Cracking, conversely, is the active process of exploiting cryptographic vulnerabilities in the Wired Equivalent Privacy (WEP) protocol to recover the encryption key, typically through statistical analysis of captured packets.
Evil Twin: An unauthorized access point installed on a network without permission
Why it's wrong here
This description is incorrect for an Evil Twin attack. An Evil Twin specifically involves an attacker creating a *mimic* of a legitimate access point to deceive users into connecting, focusing on impersonation and data interception. The definition provided, 'An unauthorized access point installed on a network without permission,' accurately describes a Rogue AP, which is a physical device directly connected to the internal network, creating an unauthorized backdoor.
War Driving: Driving around to detect wireless networks and gather information
Why this is correct
War Driving is a reconnaissance technique where an individual physically travels through an area, typically in a vehicle, using a wireless-enabled device to discover and map Wi-Fi networks. The objective is to identify active wireless access points, gather information such as SSIDs, MAC addresses, and security configurations (e.g., WEP, WPA2), and sometimes pinpoint their physical locations. This activity helps attackers identify potential targets for further exploitation.
Go deeper
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.