CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  WPA3

  Why this is correct

  WPA3, introduced in 2018, significantly enhances wireless security by implementing Simultaneous Authentication of Equals (SAE), also known as the Dragonfly handshake. This robust key exchange protocol provides strong protection against offline dictionary attacks by making it computationally infeasible to guess passwords without an active connection. Furthermore, SAE ensures forward secrecy, meaning that even if the long-term key is compromised, past session data remains encrypted and secure.

• ✗

  802.1X/EAP

  Why it's wrong here

  802.1X is an IEEE standard for port-based network access control, acting as an authentication framework rather than a complete wireless security standard like WPA3. It leverages the Extensible Authentication Protocol (EAP) to support various authentication methods, commonly used in enterprise environments with WPA2-Enterprise. While crucial for authenticating users or devices to a network, it does not define the encryption or key management protocols for the wireless link itself.

• ✗

  WEP

  Why it's wrong here

  Wired Equivalent Privacy (WEP) is an outdated and fundamentally broken wireless security protocol, primarily due to its reliance on a static, shared secret key and a small 24-bit Initialization Vector (IV) with the RC4 stream cipher. This design flaw leads to frequent IV reuse, making it highly susceptible to statistical attacks and IV collision attacks that can quickly recover the WEP key. WEP offers no forward secrecy and is easily compromised, rendering it unsuitable for any secure communication.

• ✗

  WPA2

  Why it's wrong here

  Wi-Fi Protected Access II (WPA2) utilizes the Advanced Encryption Standard (AES) with Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) for robust data encryption. However, in its widely deployed Pre-Shared Key (PSK) mode, WPA2 remains vulnerable to offline dictionary attacks. Attackers can capture the 4-way handshake and then brute-force or dictionary-attack the PSK offline, without detection, to discover the network password. Additionally, WPA2-PSK lacks forward secrecy, meaning a compromised PSK can decrypt past traffic.

Go deeper

Related to this question