nerdexam
CompTIA

PT0-001 · Question #224

A penetration tester is performing a wireless penetration test. Which of the following are some vulnerabilities that might allow the penetration tester to easily and quickly access a WPA2- protected…

The correct answer is C. Weak implementations of the WEP can allow pin numbers to be guessed quickly, which can then. WPS (Wi-Fi Protected Setup) PIN vulnerabilities allow attackers to quickly brute-force the PIN on WPA2-protected access points with WPS enabled, bypassing WPA2 encryption entirely.

Attacks and exploits

Question

A penetration tester is performing a wireless penetration test. Which of the following are some vulnerabilities that might allow the penetration tester to easily and quickly access a WPA2- protected access point?

Options

  • ADeauthentication attacks against an access point can allow an opportunity to capture the four-way
  • BInjection of customized ARP packets can generate many initialization vectors quickly, making it
  • CWeak implementations of the WEP can allow pin numbers to be guessed quickly, which can then
  • DRainbow tables contain all possible password combinations, which can be used to perform a brute-

How the community answered

(19 responses)
  • A
    5% (1)
  • B
    11% (2)
  • C
    74% (14)
  • D
    11% (2)

Why each option

WPS (Wi-Fi Protected Setup) PIN vulnerabilities allow attackers to quickly brute-force the PIN on WPA2-protected access points with WPS enabled, bypassing WPA2 encryption entirely.

ADeauthentication attacks against an access point can allow an opportunity to capture the four-way

While deauthentication attacks can capture the WPA2 four-way handshake, cracking the resulting hash still requires significant time depending on password complexity, making it less reliably fast than a WPS PIN attack.

BInjection of customized ARP packets can generate many initialization vectors quickly, making it

Injecting ARP packets to generate initialization vectors is an attack technique specific to WEP encryption, not WPA2, which uses CCMP/AES and replaced the flawed IV-based keystream with a stronger derivation mechanism.

CWeak implementations of the WEP can allow pin numbers to be guessed quickly, which can thenCorrect

WPS has a well-known design flaw where its 8-digit PIN is validated in two separate halves, reducing the effective keyspace from 100 million to roughly 11,000 combinations. Tools like Reaver and Bully exploit this flaw to brute-force the WPS PIN in minutes and then derive the WPA2 passphrase, granting quick access even to a WPA2-protected network. This makes weakly implemented or enabled WPS the fastest path into an otherwise WPA2-secured access point.

DRainbow tables contain all possible password combinations, which can be used to perform a brute-

Precomputed rainbow tables are not effective against WPA2 because it uses SSID-salted PBKDF2 hashing, which makes generic precomputed tables useless against arbitrary network names.

Concept tested: WPS PIN brute-force vulnerability on WPA2 networks

Source: https://www.kb.cert.org/vuls/id/723755

Topics

#WPA2#WPS attacks#wireless security#password attacks

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PT0-001 Practice