CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Disable WPS

  Why this is correct

  Wi-Fi Protected Setup (WPS) is a feature designed for easy network setup but introduces a significant vulnerability. Its PIN-based authentication mechanism is susceptible to brute-force attacks due to its 8-digit PIN being validated in two halves, effectively reducing the search space. Disabling WPS eliminates this critical attack vector, preventing an attacker from easily discovering the WPA2 pre-shared key (PSK) by exploiting the WPS vulnerability.

• ✓

  Implement 802.1X/EAP with RADIUS

  Why this is correct

  Implementing 802.1X/EAP with a RADIUS server transitions WPA2 from Personal (PSK) mode to Enterprise mode. This robust authentication framework requires each user to authenticate with unique credentials (e.g., username/password or digital certificates) against a central RADIUS server. Unlike a shared PSK, individual user credentials can be revoked, providing granular access control and significantly enhancing security by preventing a single compromised key from affecting the entire network.

• ✗

  Use WEP instead of WPA2

  Why it's wrong here

  Using WEP (Wired Equivalent Privacy) instead of WPA2 is a severe downgrade in security, not a defense. WEP suffers from fundamental cryptographic flaws, including a small 24-bit Initialization Vector (IV) that is often reused, making it highly susceptible to statistical attacks like the FMS attack. An attacker can typically crack a WEP key within minutes by capturing sufficient network traffic, rendering it completely ineffective against modern threats.

• ✗

  Enable WPA2-Mixed mode

  Why it's wrong here

  Enabling WPA2-Mixed mode, also known as WPA2/WPA-Mixed or WPA2/WPA-Personal, allows older WPA (TKIP) clients to connect alongside WPA2 (AES) clients. While it offers backward compatibility, it introduces the weaker Temporal Key Integrity Protocol (TKIP) into the network. TKIP is known to be vulnerable to certain key recovery and denial-of-service attacks, compromising the overall security posture of the network by allowing the weakest link to dictate the effective security level.

• ✓

  Use a strong, complex pre-shared key

  Why this is correct

  Employing a strong, complex pre-shared key (PSK) is a fundamental defense for WPA2-Personal networks. A robust PSK should be long (at least 20 characters), include a mix of uppercase and lowercase letters, numbers, and symbols, and be entirely random to maximize entropy. This significantly increases the computational effort required for dictionary attacks and brute-force attempts against the WPA2 4-way handshake, making it impractical for attackers to guess or crack the key.

Go deeper

Related to this question