SSCP Network and Communications Security Practice Question
Which attack exploits the lack of IV (Initialization Vector) randomness in the RC4 algorithm to recover the Wi-Fi password, and is considered completely broken?
⚠ Common exam trap
SSCP often tests the distinction between WEP IV attacks (RC4/IV reuse), PMKID (WPA2 handshake capture), and KRACK (WPA2 key reinstallation) — candidates confuse the underlying cryptographic flaw with the attack name.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WEP IV attack
The WEP IV attack exploits WEP's 24-bit IV, which is too short and reused frequently, allowing an attacker to collect enough packets to recover the RC4 keystream and derive the WEP key. WEP is considered completely broken and deprecated, and this attack (often implemented via tools like Aircrack-ng) is the classic demonstration of its weakness.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
WEP IV attack
Why this is correct
WEP's RC4 implementation uses a short, non-random 24-bit IV, and its reuse enables the FMS and PTW statistical attacks to recover the keystream and derive the WEP key. This directly exploits the absent IV randomness named in the stem, making WEP completely broken.
- ✗
PMKID attack
Why it's wrong here
The PMKID attack captures a single EAPOL frame from the access point's RSN information element and cracks the PSK offline; it does not touch RC4's IV. It is tempting as another Wi-Fi password recovery method, but it works against WPA2-PSK regardless of cipher.
- ✗
Evil twin attack
Why it's wrong here
An evil twin impersonates a legitimate access point to harvest credentials via a rogue portal, relying on user deception rather than cryptanalysis of RC4's IV. It is tempting because it also yields Wi-Fi passwords, but it needs a rogue AP, not keystream statistical bias.
- ✗
KRACK attack
Why it's wrong here
KRACK targets the WPA2 four-way handshake, replaying message 3 to force nonce reuse, so it exploits protocol state rather than RC4's IV weaknesses. It is tempting because it also breaks Wi-Fi encryption, but it applies to AES-CCMP networks too, not the RC4 keystream flaw.
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.