Which of the following wireless protocols could be vulnerable to a brute-force password attack? (Select TWO).

WPA2-PSK (Pre-Shared Key) is vulnerable to offline brute-force and dictionary attacks because the 4-way handshake can be captured and the passphrase guessed repeatedly without interacting with the network.

WPA-EAP-TLS uses mutual certificate-based authentication - there is no shared password to brute-force, making offline password attacks infeasible.

WPA2-CCMP refers to the AES-based encryption cipher used in WPA2 and is not itself an authentication mechanism susceptible to brute-force password attacks.

WPA-CCMP similarly describes the encryption component of WPA and does not define an authentication method that is brute-forceable via password guessing.

WPA-LEAP (Cisco LEAP) uses MS-CHAPv2-based authentication which is known to be weak and vulnerable to offline dictionary and brute-force attacks, as exploited by tools like ASLEAP.

WEP is broken through IV (initialization vector) statistical attacks that recover the key by capturing enough packets, not through a direct brute-force password attack.