6.0 Wireless Network Hacking CEH Practice Quiz

• A. The human-readable name that identifies a wireless network, broadcast in AP beacon frames
• B. The hardware MAC address of the wireless access point serving the network
• C. The pre-shared encryption key used to authenticate clients to the wireless network
• D. The radio frequency channel number on which the access point broadcasts its signal

The SSID (Service Set Identifier) is the logical name assigned to a wireless network, the human-readable label (up to 32 characters) that appears in device Wi-Fi menus. It is included in beacon frames broadcast by the AP approximately 10 times per second, in probe responses, and in association/reassociation frames. Multiple APs sharing the same SSID form an Extended Service Set (ESS).

• A. WEP (Wired Equivalent Privacy)
• B. WPA-TKIP (Wi-Fi Protected Access with Temporal Key Integrity Protocol)
• C. WPA2-CCMP (Counter Mode with CBC-MAC Protocol)
• D. WPA3-SAE (Simultaneous Authentication of Equals)

WEP (Wired Equivalent Privacy, IEEE 802.11 1997) is completely broken. Its 24-bit IV space means IVs repeat frequently in busy networks, and the weak RC4 key scheduling algorithm (discovered by Fluhrer, Mantin, and Shamir in 2001) allows statistical analysis of IV-key pairs to recover the full WEP key. Tools like aircrack-ng can crack WEP keys in under 60 seconds with as few as 20,000-40,000 captured packets. WEP should never be used.

• A. OFDMA allows the two APs to share overlapping channels with zero performance impact
• B. Channels 4 and 6 are non-overlapping in the 2.4GHz band and will not cause interference
• C. Channel 4 devices will automatically migrate to channel 6 via 802.11k neighbor reports
• D. Channels 4 and 6 overlap in the 2.4GHz band, only channels 1, 6, and 11 are non-overlapping, causing adjacent-channel interference and degraded performance for both networks

In the 2.4GHz band, the only three non-overlapping channels are 1, 6, and 11 (in North America). Channels 4 and 6 overlap spectrally, causing adjacent-channel interference (ACI), radio energy from one AP bleeds into the other's channel, corrupting frames, forcing retransmissions, and reducing throughput for both networks. From a security perspective, ACI can also interfere with wireless monitoring tools operating on these channels.

• A. Capturing the WPA2 4-way handshake immediately to begin offline password cracking
• B. Performing passive wireless reconnaissance to identify SSIDs, BSSIDs, channels, signal strength, and encryption types
• C. Deploying a deauthentication attack to disconnect clients and observe the network's reconnection behavior
• D. Attempting connections to discovered networks using manufacturer default credentials

Passive wireless reconnaissance is the mandatory first step in wireless penetration testing methodology. Using tools like airodump-ng or Kismet in monitor mode, the tester identifies all nearby networks (SSIDs, BSSIDs, operating channels, encryption types, signal strengths, and connected clients) without transmitting any frames. This intelligence guides all subsequent attack decisions.

• A. To permanently deny the client access to the network by blacklisting its MAC at the AP
• B. To capture the client's browser session cookie transmitted during the reconnection
• C. To force the AP to rotate the Group Temporal Key (GTK) to a weaker, predictable value
• D. To trigger a new WPA2 4-way handshake during client reconnection, which is captured for offline dictionary attack

WPA2 handshake capture requires observing the 4-way handshake between a client and the AP, an event that only occurs during authentication. If no new client is connecting, the attacker must force one. Sending forged deauthentication frames (exploiting the lack of management frame authentication in pre-802.11w networks) causes the client to disconnect and immediately re-initiate the 4-way handshake, which airodump-ng captures for subsequent offline hashcat/aircrack-ng dictionary attack.

• A. Scanning for beacon frames on all 802.11 channels in passive mode, hidden SSIDs still appear in beacons with empty SSID fields
• B. Capturing probe request and response frames exchanged when a legitimate client connects, which include the SSID in plaintext
• C. Performing an offline dictionary attack against a WPA2 handshake file to brute-force the hidden SSID value
• D. Executing a ping sweep against the AP's default management IP address, which returns the SSID in ICMP response headers

When a client that knows the hidden SSID connects to the AP, it sends a directed probe request containing the SSID in plaintext. The AP responds with a probe response also containing the SSID. Additionally, association and reassociation frames include the SSID. An auditor using airodump-ng in monitor mode will capture these frames and extract the SSID. Alternatively, sending a deauthentication frame to force a reconnection will trigger this exchange.

• A. 802.11ac (Wi-Fi 5), introduced MU-MIMO on the 5GHz band
• B. 802.11n (Wi-Fi 4), introduced MIMO and dual-band 2.4/5GHz support
• C. 802.11ax (Wi-Fi 6), introduced OFDMA for simultaneous uplink and downlink multi-user access
• D. 802.11ad (WiGig), introduced 60GHz mmWave operation for multi-gigabit short-range links

802.11ax (Wi-Fi 6, released 2019) introduced OFDMA, which subdivides wireless channels into smaller resource units (RUs) that can be simultaneously allocated to different clients. This dramatically improves efficiency in dense environments (airports, stadiums, enterprise offices) by serving multiple users in parallel rather than sequentially. Wi-Fi 6E extends this to the 6GHz band.

• A. A deauthentication flood against the legitimate corporate AP to permanently block the victim's MAC
• B. A man-in-the-middle (MITM) attack, routing all victim traffic through the attacker's system to intercept credentials, session cookies, and unencrypted data
• C. An offline WPA2 brute-force attack against the victim's encrypted association with the evil twin
• D. A firmware injection attack that overwrites the victim's wireless adapter driver via the rogue AP connection

Once the victim connects to the evil twin, the attacker controls the network gateway. All victim traffic is routed through the attacker's device, enabling: (1) HTTPS downgrade attacks via SSLstrip to capture credentials in cleartext, (2) session cookie theft from unencrypted HTTP sessions, (3) DNS manipulation to redirect victims to phishing pages, and (4) credential harvesting from captive portal login pages. This is the primary purpose of an evil twin attack.