CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Changing the default SSID

  Why it's wrong here

  Deauthentication attacks operate at the MAC layer (Layer 2) by sending spoofed deauthentication frames to a client or access point. The SSID (Service Set Identifier) is merely a broadcast name for the network, and changing it does not alter the underlying MAC addresses or the protocol mechanisms used for deauthentication. Attackers can still discover the SSID or target clients directly, rendering this measure ineffective against such attacks.

• ✓

  Enabling 802.11w (Management Frame Protection)

  Why this is correct

  IEEE 802.11w introduces Management Frame Protection (MFP), which cryptographically protects certain 802.11 management frames, including deauthentication and disassociation frames. This protection ensures that only legitimate, authenticated devices can send these frames, preventing an attacker from spoofing a deauthentication request. By validating the source and integrity of these critical frames, 802.11w effectively mitigates deauthentication attacks.

• ✗

  Implementing MAC address filtering

  Why it's wrong here

  MAC address filtering attempts to restrict network access based on a device's hardware address. However, deauthentication attacks rely on spoofing the MAC address of either the legitimate client or the access point in the deauthentication frame. An attacker can easily bypass MAC filtering by simply changing their own MAC address to mimic an authorized device, or by spoofing the AP's MAC address to disconnect clients, making this defense ineffective.

• ✓

  Using WPA3 instead of WPA2

  Why this is correct

  WPA3 (Wi-Fi Protected Access 3) significantly enhances wireless security by mandating the use of Protected Management Frames (PMF), which is based on the 802.11w standard. This means that all WPA3-certified devices must implement cryptographic protection for management frames, including deauthentication frames. Consequently, WPA3 inherently provides robust protection against deauthentication and disassociation attacks, unlike WPA2 where PMF was optional.

• ✗

  Disabling SSID broadcast

  Why it's wrong here

  Disabling SSID broadcast (hiding the network name) is a weak security measure that does not prevent deauthentication attacks. Attackers can still discover hidden SSIDs through passive listening to probe requests or by analyzing network traffic. Once the SSID is known or a client is connected, deauthentication frames can still be sent to disconnect clients or disrupt the network, as the attack does not rely on the SSID being publicly advertised.

Go deeper

Related to this question