Detailed Explanations for Questions 451-500
Q451, Q460, Q469, Q478, Q487, Q496. Your security team notifies you that they are seeing the same SSID being advertised in your vicinity, but the BSSID is different from ones they are aware of. What type of attack is this?
- A. Deauthentication attack
- B. Wardriving
- C. MAC spoofing
- D. Evil twin ✓
Why D is correct: An evil twin attack involves an attacker setting up a rogue wireless access point that broadcasts the same SSID (network name) as a legitimate network but with a different BSSID (Basic Service Set Identifier, which is the MAC address of the access point). Users may inadvertently connect to the rogue AP, allowing the attacker to intercept credentials, monitor traffic, or launch man-in-the-middle attacks. The key indicator is the same SSID with a different BSSID.
Why others are incorrect:
- A: A deauthentication attack sends deauth frames to disconnect clients from a legitimate AP, but doesn’t involve creating a fake AP with the same SSID
- B: Wardriving is the act of searching for wireless networks while driving, not creating fake access points
- C: MAC spoofing involves changing a device’s MAC address to impersonate another device, but doesn’t specifically involve creating a rogue AP with a legitimate SSID
Q452, Q461, Q470, Q479, Q488, Q497. Which encryption standard is used in WEP?
- A. AES
- B. RC5
- C. MD5
- D. RC4 ✓
Why D is correct: WEP (Wired Equivalent Privacy) uses the RC4 stream cipher for encryption. RC4 was chosen for its speed and simplicity, but WEP’s implementation has critical flaws: the 24-bit initialization vector (IV) is too short and transmitted in cleartext, allowing attackers to collect enough packets to crack the encryption key. This is why WEP is considered broken and should never be used.
Why others are incorrect:
- A: AES (Advanced Encryption Standard) is used in WPA2 and WPA3, not WEP
- B: RC5 is a different block cipher designed by Ron Rivest, not used in WEP
- C: MD5 is a hashing algorithm, not an encryption cipher; it’s used for integrity checking, not confidentiality
Q453, Q462, Q471, Q480, Q489, Q498. You are sitting inside of your office, and you notice a strange person in the parking lot with what appears to be a tall antenna connected to a laptop. What is the stranger most likely doing?
- A. Brute-forcing their personal electronic device
- B. Wardriving ✓
- C. Warflying
- D. Bluesnarfing
Why B is correct: Wardriving is the act of searching for wireless networks while moving through a geographic area (typically by vehicle, but also on foot). Attackers use high-gain antennas connected to laptops or mobile devices with tools like Kismet, Aircrack-ng, or NetStumbler to detect, catalog, and potentially exploit wireless networks. The tall antenna is a key indicator of wardriving equipment designed to extend wireless reception range.
Why others are incorrect:
- A: Brute-forcing a personal device would typically be done in private and wouldn’t require a tall external antenna
- C: Warflying uses drones or aircraft to detect wireless networks from the air, not ground-level observation from a parking lot
- D: Bluesnarfing is a Bluetooth-specific attack that steals data from paired devices; it doesn’t require tall antennas or parking lot surveillance
Q454, Q463, Q472, Q481, Q490, Q499. What type of authentication is used in WPA2 to ensure the validity of both the client and the access point?
- A. Two-way handshake
- B. Three-way handshake
- C. Four-way handshake ✓
- D. Five-way handshake
Why C is correct: WPA2 uses a four-way handshake to establish mutual authentication between the client (supplicant) and the access point (authenticator). The handshake:
- AP sends a nonce (ANonce) to the client
- Client generates its nonce (SNonce), derives the PTK (Pairwise Transient Key), and sends SNonce + MIC to AP
- AP verifies MIC, derives PTK, sends GTK (Group Temporal Key) + MIC to client
- Client verifies MIC and sends acknowledgment
This process ensures both parties possess the correct pre-shared key (PSK) or credentials without transmitting the key itself.
Why others are incorrect:
- A: Two-way handshake is not a standard authentication mechanism in wireless security
- B: Three-way handshake is used in TCP connection establishment, not WPA2 authentication
- D: Five-way handshake is not used in WPA2 or standard wireless authentication protocols
Q455, Q464, Q473, Q482, Q491, Q500. What is the value of using the four-way handshake in WPA2?
- A. Encrypts traffic
- B. Prevents replay attacks ✓
- C. Ensures multifactor authentication is in use
- D. Performs host checking
Why B is correct: The four-way handshake in WPA2 includes nonces (random numbers used once) and message integrity codes (MICs) that prevent replay attacks. Each handshake uses fresh nonces, so captured handshake messages cannot be replayed later to gain unauthorized access. The MIC ensures messages haven’t been tampered with during transmission.
Why others are incorrect:
- A: While the handshake derives encryption keys (PTK/GTK), its primary security value isn’t encryption itself but secure key establishment
- C: The four-way handshake doesn’t implement multifactor authentication; it authenticates based on a pre-shared key or 802.1X credentials
- D: Host checking is not a function of the WPA2 four-way handshake
Q456, Q465, Q474, Q483, Q492. What are the two types of wireless network?
- A. Passive, active
- B. Point-to-point, multicast
- C. Infrastructure, active
- D. Ad hoc, infrastructure ✓
Why D is correct: Wireless networks operate in two primary modes:
- Infrastructure mode: Devices connect through a central access point (AP) that manages the network and provides connectivity to wired networks
- Ad hoc mode: Devices connect directly to each other in a peer-to-peer fashion without an access point (also called IBSS – Independent Basic Service Set)
These are the two fundamental architectural modes defined in the 802.11 standard.
Why others are incorrect:
- A: Passive/active refers to scanning methods or reconnaissance techniques, not network types
- B: Point-to-point and multicast describe communication patterns, not wireless network architectures
- C: “Infrastructure, active” mixes a network type with a scanning mode; active isn’t a wireless network type
Q457, Q466, Q475, Q484, Q493. Which authentication protocol is used in WPA2?
- A. CCMP ✓
- B. 3DES
- C. AES
- D. LEAP
Why A is correct: CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) is the encryption and authentication protocol mandated for WPA2. CCMP uses AES for encryption and provides both confidentiality and integrity protection. It replaced TKIP (used in WPA) due to TKIP’s vulnerabilities.
Why others are incorrect:
- B: 3DES (Triple DES) is an older encryption algorithm not used in WPA2; it’s slower and less secure than AES-CCMP
- C: AES is the encryption cipher used within CCMP, but CCMP is the complete protocol that includes authentication (via CBC-MAC)
- D: LEAP (Lightweight Extensible Authentication Protocol) is a Cisco-proprietary authentication protocol with known vulnerabilities, not used in WPA2
Q458, Q467, Q476, Q485, Q494. During the course of testing, you identify a WAP that you are going to exploit. You discover that the WAP is using WEP. Which method will you utilize in order to exploit the WAP?
- A. The encryption algorithm, which is RC4
- B. The initialization vector (IV) ✓
- C. The password
- D. The username and password
Why B is correct: The critical vulnerability in WEP is its 24-bit initialization vector (IV), which is transmitted in cleartext and reused frequently due to its short length. Attackers can collect enough packets with repeated IVs to perform statistical attacks (like the Fluhrer, Mantin, and Shamir attack) to recover the WEP key. Tools like Aircrack-ng exploit this IV weakness to crack WEP encryption.
Why others are incorrect:
- A: While RC4 is the encryption algorithm, the vulnerability isn’t RC4 itself but how WEP implements it with weak IV management
- C: The password isn’t directly exploited; attackers recover the key through IV analysis, not by guessing the password
- D: WEP doesn’t use username/password authentication; it uses a shared key for encryption
Q459, Q468, Q477, Q486, Q495. Which of the following is associated with security access in a wireless network?
- A. WPA
- B. 802.1X ✓
- C. Radius
- D. TACACS+
Why B is correct: IEEE 802.1X is the standard for port-based network access control, including wireless networks. It provides an authentication framework that allows devices to authenticate before gaining network access. In wireless networks, 802.1X works with EAP (Extensible Authentication Protocol) to authenticate users/devices, commonly used in WPA2-Enterprise configurations.
Why others are incorrect:
- A: WPA (Wi-Fi Protected Access) is an encryption/security protocol, not specifically an access control standard
- C: RADIUS is an AAA (Authentication, Authorization, Accounting) server protocol commonly used with 802.1X, but 802.1X is the access control standard itself
- D: TACACS+ is a Cisco-proprietary AAA protocol, less commonly used for wireless access control compared to 802.1X/RADIUS
Key Takeaways for Module 16: Hacking Wireless Networks
- Evil Twin Attacks: Rogue APs broadcasting legitimate SSIDs with different BSSIDs; users may connect unknowingly, enabling credential theft or MITM attacks.
- WEP Vulnerabilities: Uses RC4 encryption with a critically weak 24-bit IV transmitted in cleartext; easily cracked with tools like Aircrack-ng; never use WEP.
- WPA2 Security: Uses CCMP (AES-based) for encryption/authentication and a four-way handshake with nonces to prevent replay attacks and establish mutual authentication.
- Wireless Network Types: Infrastructure mode (central AP) vs. Ad hoc mode (peer-to-peer); understanding these helps identify attack surfaces.
- 802.1X Authentication: Port-based access control standard used in WPA2-Enterprise; works with RADIUS/EAP for robust user/device authentication.
- Wardriving: Searching for wireless networks using high-gain antennas while mobile; used for reconnaissance to identify vulnerable networks.
- Four-Way Handshake: Critical WPA2 mechanism that derives encryption keys while preventing replay attacks through nonces and MICs.
- Attack Indicators: Same SSID + different BSSID = evil twin; tall antenna + laptop in parking lot = wardriving; WEP = easily exploitable.
Study Tip: Practice wireless security concepts using tools like Aircrack-ng in a controlled lab environment. Capture WPA2 handshakes, analyze IV weaknesses in WEP captures, and understand how the four-way handshake prevents replay attacks. Always obtain proper authorization before testing any wireless network.
