CCNA Ceh Advanced Topics Questions

RSA (Rivest–Shamir–Adleman) is a public-key cryptosystem that uses a pair of keys (public and private) for encryption and digital signatures, making it an asymmetric algorithm. Unlike symmetric ciphers, RSA relies on the mathematical difficulty of factoring large prime numbers to secure communications.

Default credentials, insecure protocols, and firmware reversing are common IoT attack vectors.

Using a strong passphrase makes dictionary attacks harder. 802.1X/EAP provides enterprise authentication. Disabling WPS removes PIN brute-force vector. WPA2-Mixed mode still allows TKIP clients, reducing security.

WPA3 is the latest Wi-Fi security standard, offering stronger encryption with SAE (Simultaneous Authentication of Equals) and replacing WPA2.

The use of default credentials and lack of encryption (no TLS) are the vulnerabilities. MQTT itself is not insecure when properly configured; the issues are weak authentication and cleartext communication.

WPA3 is the latest Wi-Fi security standard, providing stronger encryption (GCMP-256) and protection against dictionary attacks via SAE.

The correct answer is aircrack-ng, which is the standard tool for cracking WPA2 PSK from a captured handshake using a dictionary file.

The attack is an evil twin attack, where a rogue AP mimics a legitimate one to capture credentials or perform man-in-the-middle.

MQTT without encryption allows anyone to subscribe to topics. Subscribing to '#' captures all messages, leading to interception of sensitive data. This is a passive eavesdropping attack, not active manipulation like replay or injection.

Reaver is a tool used for brute-forcing WPS PINs to recover the WPA/WPA2 pre-shared key. The command specifies the interface and BSSID, indicating a WPS attack.

Default credentials and insecure protocols (e.g., MQTT without TLS) are common IoT attack vectors; firmware extraction is a technique, not a vector; SQL injection is more common in web apps; replay attacks can occur but are not specific to IoT.

A birthday attack exploits the birthday paradox to find two different inputs that produce the same hash output (collision).

Asymmetric encryption uses two keys (public/private), provides key exchange, and supports digital signatures.

After capturing the handshake, the tester must perform a dictionary attack against the handshake file. Tools like aircrack-ng or hashcat can compare the handshake against a wordlist of potential passphrases.

The -0 flag sends deauthentication packets to force a client to reconnect, enabling capture of the WPA handshake.

MQTT over plain TCP allows message interception and injection (man-in-the-middle) because no encryption or authentication is enforced.

The 4-way handshake confirms that both client and AP possess the pre-shared key (PSK) without exposing it, and generates temporal keys for encryption.

IoT devices often have default credentials that are not changed, and they use insecure protocols like MQTT without encryption. These are common entry points for attackers.

Restricting the application from making requests to internal IP ranges (e.g., 169.254.169.254 is the AWS metadata endpoint) is a key defense against SSRF.

De-authentication attacks force clients to reconnect, allowing the attacker to capture the 4-way handshake for offline cracking of the PSK.

S3 bucket misconfiguration is a cloud-specific threat because it involves improper access control settings on Amazon S3 storage, such as public read/write permissions, which can lead to data exposure or unauthorized access. This threat is unique to cloud environments where object storage is managed via APIs and IAM policies, unlike traditional on-premises storage.

Aircrack-ng is the standard tool for cracking WEP/WPA keys from captured packets, including WPA2 handshakes using a dictionary attack.

De-authentication packets force clients to disconnect from the legitimate AP, after which they may automatically reconnect to a rogue AP with the same SSID. Evil twin is the fake AP, but the mechanism to disconnect clients is de-authentication.

ScoutSuite is an open-source multi-cloud security auditing tool that checks for misconfigurations across AWS, Azure, and GCP. Pacu is an AWS exploitation framework; Aircrack-ng is for wireless; Reaver is for WPS.

A CA issues and signs digital certificates, validating the identity of certificate requestors.

WPA3 uses SAE (Dragonfly handshake) to provide forward secrecy and protect against offline dictionary attacks. WPA2 used PSK which is vulnerable to dictionary attacks. WEP and 802.1X are older or different.

RSA is an asymmetric algorithm using a public/private key pair. AES, 3DES, and RC4 are symmetric algorithms.

ScoutSuite is an open-source multi-cloud security-auditing tool that assesses the security posture of AWS, Azure, and GCP environments by checking for misconfigurations, excessive permissions, and compliance violations. Pacu is an AWS exploitation framework designed for offensive security testing, allowing penetration testers to enumerate resources, escalate privileges, and execute post-exploitation modules against cloud accounts. Both tools are purpose-built for cloud security auditing and exploitation, making them the correct choices.

The TCP handshake shown is for the 4-way handshake messages: first two messages (AP nonce and supplicant nonce) are exchanged, then the third message is the encrypted GTK, followed by ACK. The encrypted payload indicates the handshake is complete.

AWS is responsible for the physical host and network infrastructure; the customer manages the guest OS, applications, and security groups.

Default credentials, insecure protocols like MQTT, and firmware reversing are all common IoT attack vectors. SQL injection is more typical for web applications.

Asymmetric cryptography uses key pairs (public and private). RSA is a well-known asymmetric algorithm. AES, 3DES, and RC4 are symmetric algorithms.

If the PSK is not in the wordlist, dictionary attacks will fail. Other steps (capture, cracking) were done correctly.

RSA and ECC are asymmetric algorithms. AES and 3DES are symmetric. SHA-256 is a hash function.

An evil twin attack involves setting up a rogue access point that mimics a legitimate SSID to intercept traffic and capture credentials.

Reaver is designed to exploit the WPS PIN brute-force vulnerability, where an attacker can recover the WPS PIN and then derive the WPA/WPA2 PSK.

Birthday attack exploits hash collisions, preimage attack finds an input that hashes to a given output, and collision attack finds two inputs with same hash. Man-in-the-middle is not specific to hash functions, and dictionary attack is a password cracking technique, not pure cryptanalysis.

The customer is responsible for security IN the cloud, including configuring IAM policies, encryption, and access controls.

Default credentials (e.g., admin/admin) and insecure protocols (e.g., MQTT without TLS) are frequently exploited in IoT.

A rogue AP often has a higher signal strength than expected, especially if it's placed closer to users. Additionally, a mismatch between the BSSID and the known legitimate AP can indicate spoofing.

The birthday attack exploits the birthday paradox in probability theory to find two different inputs that produce the same MD5 hash value (a collision) with significantly less effort than a brute-force preimage attack. For an n-bit hash, the birthday attack requires only about 2^(n/2) operations, making MD5's 128-bit output vulnerable to collisions in roughly 2^64 attempts, which is computationally feasible today.

ScoutSuite is an open-source multi-cloud security auditing tool that checks for common misconfigurations.

An S3 bucket with public listing enabled allows anyone to list objects via HTTP GET requests.

MD5 is vulnerable to collision attacks, where two different inputs produce the same hash. This undermines the integrity and non-repudiation properties required for digital signatures.

Downgrade attacks exploit the fallback mechanism in TLS where, if a handshake fails, the client retries with a lower version or weaker suite. The attacker forces failure to degrade security.

Pacu is an open-source AWS exploitation framework that allows security professionals to test the security of AWS environments. It can perform various attacks, such as IAM privilege escalation, S3 bucket enumeration, and metadata service exploitation.

Default credentials, insecure protocols (e.g., MQTT without TLS), and firmware reversing (to find hardcoded secrets) are common IoT attack vectors. TLS stripping is a network attack, and container escape is a cloud/container attack.

Disabling older TLS versions, enforcing TLS 1.2+, and using TLS_FALLBACK_SCSV prevent downgrade; disabling cipher suites does not prevent downgrade directly; using self-signed certificates increases risk.

MD5 produces 128-bit hashes. Birthday attack complexity for collision is 2^(n/2) = 2^64 for n=128. SHA-1 is 160-bit, SHA-256 is 256-bit, RC4 is a stream cipher not a hash.

The correct action is to use the discovered credentials to enumerate permissions via the AWS CLI, as they may grant further access.

SSRF (Server-Side Request Forgery) occurs when an application fetches a user-controlled URL. By supplying the metadata endpoint, an attacker can retrieve IAM credentials, making this the most likely attack.

Symmetric encryption uses a single shared key for both encryption and decryption, and is generally faster than asymmetric.

Mounting the Docker socket inside a container allows the container to communicate with the Docker daemon on the host, potentially allowing the attacker to create new containers, escape the container, and execute commands on the host.

A downgrade attack tricks the communicating parties into negotiating a less secure version of TLS or a weaker cipher suite, making it easier for the attacker to break the encryption.

ScoutSuite is an open-source multi-cloud security auditing tool that assesses cloud environments (AWS, Azure, GCP) by scanning for misconfigurations and compliance violations. It does not perform exploitation or penetration testing; instead, it checks for issues like overly permissive security groups, unencrypted S3 buckets, or unused IAM roles, aligning with option D's description of auditing cloud infrastructure for misconfigurations and compliance.

Evil twin attacks involve a rogue AP impersonating a legitimate one. Countermeasures include using WPA3-Enterprise with 802.1X for mutual authentication, implementing client-side certificate validation, and using VPNs to encrypt traffic even over rogue APs.

Uploading malicious content to an S3 bucket with public write access enables storage of attacker-controlled files. When users access these files, a client-side attack (like XSS) can occur. This is a classic example of a storage-based attack via misconfigured S3 bucket.

An evil twin attack involves a rogue AP impersonating a legitimate one, but it does not typically cause ARP packets with varied IPs. ARP spoofing involves an attacker sending forged ARP replies to associate their MAC with another IP, causing traffic to be misdirected. The described behavior matches ARP spoofing, where the attacker's MAC appears with multiple IPs.

IAM misuse involves exploiting misconfigured IAM roles or policies to escalate privileges. Assuming a role with higher privileges is a form of privilege escalation via IAM abuse.

AES is a symmetric block cipher that supports key sizes of 128, 192, and 256 bits, and is widely used for encryption.

MD5 is known to be vulnerable to collision attacks, making it unsuitable for security applications like digital signatures.

Hardcoded credentials in firmware represent a vulnerability in the device itself. This is part of the exploitation phase, where attackers use discovered credentials to gain unauthorized access to backend systems.

Certificate Authority, digital certificates, and private/public key pairs are core PKI components.

KRACK attacks exploit vulnerabilities in the WPA2 4-way handshake key reinstallation. The primary fix is to install security patches on clients and APs that implement the IEEE 802.11 standard update. Disabling WPS does not prevent KRACK, and switching to WEP is less secure.

TLS (Transport Layer Security) provides encryption for data in transit, and CoAP can use DTLS (a variant of TLS) for secure communication.

An evil twin attack involves a rogue AP mimicking a legitimate SSID to intercept traffic.

A man-in-the-middle (MITM) attack involves the attacker positioning themselves between the client and server to intercept and modify traffic.

Birthday attack exploits hash collisions; replay attack reuses captured data. Downgrade attack forces weaker protocol (not cryptanalytic per se, but relevant). SQL injection and XSS are web application attacks, not cryptanalytic.

The customer is responsible for data classification and account management, while the provider secures the physical infrastructure.

The analyst captured the 4-way handshake and used a dictionary attack (wordlist) to recover the PSK. This is a dictionary attack, not brute force (which tries all combinations), rainbow table, or hash length extension (which is for hash-based MACs).

RSA and ECC are asymmetric algorithms. AES and 3DES are symmetric. MD5 is a hash function.

Aircrack-ng is the standard tool for cracking WEP keys by capturing IVs. Reaver is for WPS, Kismet is a sniffer, and John the Ripper is a general password cracker.

Without TLS, MQTT traffic is sent in cleartext, allowing interception and reading of sensitive data.

Using a self-signed or untrusted CA certificate can allow an attacker to perform a man-in-the-middle attack by presenting their own certificate that the browser may accept with user warning.

Without authentication on MQTT, an attacker can publish malicious commands (e.g., change temperature) and subscribe to all topics to eavesdrop on sensor data.