CEH Wireless, IoT and Cloud Security Practice Question

Exhibit

Refer to the exhibit.

```
Wireless Capture: Beacon Frame
SSID: CorpNet
Security: WPA2-PSK
BSSID: 00:11:22:33:44:55
Channel: 6
RSN Information:
  Pairwise Ciphers: CCMP
  Group Cipher: TKIP
```

Refer to the exhibit. During a wireless audit, you capture a beacon frame from a corporate access point. What is the most significant security concern based on this information?

⚠ Common exam trap

It's easy for candidates to assume WPA2-PSK is inherently insecure (Option B) or that revealing the BSSID is a risk (Option C), but the real security flaw in this scenario is the use of TKIP as the group cipher, which is deprecated and known to be broken.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The group cipher is TKIP, which is deprecated and vulnerable.

TKIP (Temporal Key Integrity Protocol) is a deprecated encryption protocol that was part of the original WPA standard. It is vulnerable to several attacks, including the Michael attack and the Beck-Tews attack, which can allow an attacker to decrypt traffic or inject packets. In a modern WPA2 network, TKIP should never be used as the group cipher; only CCMP (AES) is considered secure.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The pairwise cipher is CCMP, which is outdated.
Why it's wrong here
The statement that CCMP is outdated is incorrect. Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) is the mandatory and robust encryption protocol for WPA2, leveraging the Advanced Encryption Standard (AES) for strong confidentiality and integrity. It remains the industry standard for secure wireless communication and is not considered outdated or insecure for WPA2 networks.
✗
The network uses WPA2-PSK, which is easily cracked.
Why it's wrong here
The assertion that WPA2-PSK is easily cracked is misleading. WPA2-PSK (Pre-Shared Key) provides strong cryptographic protection when a sufficiently complex passphrase is used. While it can be vulnerable to offline dictionary attacks if the passphrase is weak or common, this vulnerability lies with poor passphrase choice, not an inherent flaw in the WPA2 protocol's cryptographic design itself, which remains secure.
✗
The beacon frame reveals the BSSID, which is a security risk.
Why it's wrong here
Broadcasting the Basic Service Set Identifier (BSSID) in beacon frames is a fundamental and necessary aspect of Wi-Fi network operation, not a security risk. The BSSID is simply the MAC address of the Access Point (AP) and is essential for client devices to identify and connect to a specific wireless network. It is publicly advertised by design to enable network discovery and communication.
✓
The group cipher is TKIP, which is deprecated and vulnerable.
Why this is correct
The presence of TKIP (Temporal Key Integrity Protocol) as the group cipher is indeed a significant security vulnerability. TKIP was designed as a transitional solution for WPA to bridge the gap from WEP, but it incorporates known weaknesses, including a flawed Message Integrity Code (MIC) and vulnerabilities in its key mixing function. Consequently, it has been deprecated by the IEEE 802.11i standard and should not be used in secure wireless networks.

Quick reference

Symmetric Encryption Algorithm Comparison

Algorithm	Key Size	Block Size	Status	Notes
AES-128	128-bit	128-bit	Current standard	NIST approved; WPA3, TLS
AES-256	256-bit	128-bit	Current standard	Preferred for sensitive / govt data
3DES	112-bit effective	64-bit	Deprecated (2023)	Replaced by AES
DES	56-bit	64-bit	Broken	Cracked in < 24 h; never deploy
ChaCha20	256-bit	Stream cipher	Current	TLS 1.3, WireGuard

Go deeper

CEH Wireless, IoT and Cloud Security Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Symmetric Encryption Algorithm Comparison

Related to this question