Wireless Attacks (PenTest+) Handshake Quiz

1. In the context of wireless attacks, what does PMKID stand for?

Pairwise Master Key Identifier

Protected Management Key ID

Primary Mutual Key Infrastructure

Packet Management Key Index

2. A successful WPA handshake capture typically requires the attacker to observe which of the following?

A client authenticating to the AP or forcing a re-authentication via deauth

The AP broadcasting its beacon frame

The SSID being transmitted in plaintext

All clients connected to the AP

3. In packet sniffing, what tool is used to capture wireless frames in monitor mode?

Wireshark or tcpdump

Hashcat

Metasploit

Nessus

4. Which wireless security standard requires both parties to prove knowledge of the PSK without transmitting it?

WPA3 with SAE

WPA2-PSK

WEP

Open Network with 802.1X

5. What is the primary advantage of using a rainbow table attack against WPA2 compared to dictionary attacks?

Pre-computed hashes allow faster lookups but require significant storage

No wordlist dependency, works for any password

Eliminates the need to capture handshakes

Cracks WPA3-SAE instantly

6. When cracking WPA2 offline, the hash value used is derived from which handshake components?

SSID, PSK, nonce values, and MAC addresses

Only the PSK and SSID

Channel number and transmit power

Beacon interval and capability information

7. An attacker sets up an evil twin with the same SSID and stronger signal. Which attack type is this?

Evil Twin or Rogue Access Point attack

Jamming attack

Packet injection

Beacon flooding

8. What is the purpose of the Temporal Key Integrity Protocol (TKIP) in WPA?

Provide per-packet key mixing and message integrity checking

Replace AES encryption entirely

Eliminate the need for handshakes

Authenticate users via 802.1X only

9. Which of the following is a protection mechanism against brute force WPA password attacks?

Rate limiting and exponential backoff on failed attempts

Hiding the SSID

MAC filtering

Using channel hopping

10. A PMKID attack is advantageous over traditional handshake capture because it requires only which type of frame?

A single EAPOL frame from the AP to a client

Complete four-way handshake

Deauthentication frame

Beacon frame with full authentication data

11. Which wireless authentication method is vulnerable to dictionary attacks due to its reliance on a Pre-Shared Key (PSK)?

WPA2-PSK

WPA3-SAE

802.1X

Open Network

12. What is the primary weakness of WEP encryption that makes it vulnerable to modern attacks?

Weak Initialization Vector (IV) implementation with RC4

Lack of AES encryption

No authentication mechanism

Requires too many handshake frames

13. Which wireless attack passively collects network information without sending packets?

Passive reconnaissance or wardriving

Active scanning

Deauthentication attack

Brute force attack

14. An evil twin (rogue access point) is most effective when configured with which SSID?

Same SSID as the legitimate network

A completely different SSID

Hidden SSID

WPA3-only SSID

15. What technique allows an attacker to intercept traffic between a client and AP by positioning themselves as a relay?

Man-in-the-Middle (MITM) attack

Evil Twin attack

Packet injection

Signal jamming

16. In aircrack-ng, what does the -w parameter specify when performing a dictionary attack?

Path to the wordlist file

Wireless interface name

WPA encryption type

Output file location

17. Which wireless standard introduced Simultaneous Authentication of Equals (SAE) to replace PSK?

WPA3

WPA2

WPA

802.11i

18. What is the primary purpose of a deauthentication attack in wireless penetration testing?

Force clients to disconnect and reconnect to capture a fresh handshake

Permanently disable a wireless access point

Encrypt all traffic on the network

Identify the network administrator

19. A penetration tester captures a complete WPA2 handshake. Which tool is commonly used to crack the PSK offline?

Hashcat or John the Ripper

Wireshark

Aircrack-ng

Nmap

20. In a WPA handshake capture, what are the four frames exchanged between the client and access point?

EAPOL Message 1, 2, 3, 4

Beacon, Probe Request, Association, Authentication

Deauthentication, Reassociation, Key Exchange, Confirmation

Challenge, Response, Verification, Acknowledgment

Pentest Wireless Quiz: Can You Crack the WPA Handshake?