312-50 Question 370
Single answer▪ Wireless ConceptsDuring an authorized wireless assessment, you discover that a company’s guest Wi-Fi uses WPA2-Personal with a strong passphrase. Management wants to know whether an attacker outside the building could still obtain the passphrase without associating to the network. Which action would be the most effective first step for the tester to demonstrate this risk in a real-world scenario?
- A
Capture the 4-way handshake by monitoring the AP and forcing a connected client to reconnect, then perform an offline password-cracking attack against the captured handshake
- B
Launch a packet-fragmentation attack against the access point to recover the WPA2-Personal passphrase directly from encrypted traffic
- C
Send repeated ARP requests to the wireless network until the AP reveals the pre-shared key in a management frame
- D
Exploit WPS PIN brute force against any WPA2-Personal network, because WPA2 passphrase strength does not matter when WPS is enabled
Show answer and explanation
Correct answer: A
Explanation
For WPA2-Personal, the realistic attack path is usually to capture authentication material such as the 4-way handshake and then conduct an offline password attack. This is why strong, high-entropy passphrases remain important even when an attacker cannot initially join the network. In practice, testers often monitor for a client association or, during an authorized engagement, trigger a reconnect to capture the handshake. This aligns with established wireless security guidance: WPA/WPA2-PSK security depends heavily on passphrase strength and resistance to offline guessing. WEP-specific techniques such as fragmentation or IV-based key recovery do not apply to WPA2-CCMP. WPS may create an alternate attack path, but it must be confirmed as enabled and vulnerable; it is not an automatic weakness of all WPA2-Personal deployments. Relevant references include Wi-Fi Alliance WPA/WPA2 security guidance and NIST wireless security recommendations such as SP 800-153, which emphasize strong authentication configuration and the risks of weak shared secrets.
- A. Correct.
Correct. In WPA2-Personal (PSK), an attacker does not need to be associated to attempt password recovery if they can capture material used for offline guessing. A common real-world method is to passively capture the 4-way handshake or obtain a PMKID where applicable; if no client reconnect is naturally observed, a tester may force a reconnect using deauthentication frames during an authorized assessment. The captured handshake can then be subjected to offline dictionary, rule-based, mask, or brute-force attacks. This is the practical attack path CEH candidates are expected to recognize.
- B. Incorrect.
Incorrect. Packet-fragmentation attacks are associated with older weaknesses in WEP, not with directly recovering a WPA2-Personal passphrase. WPA2-CCMP/AES does not expose the PSK in a way that can be recovered from encrypted traffic using fragmentation techniques. This option reflects a common misconception that legacy WEP attack methods also apply to WPA2.
- C. Incorrect.
Incorrect. ARP traffic can be useful in some wireless attack workflows, especially with older protocols or for traffic generation, but access points do not reveal the WPA2 pre-shared key in management frames in response to ARP requests. The PSK is never transmitted directly over the air in plaintext as part of normal WPA2 operation.
- D. Incorrect.
Incorrect. WPS can be a serious weakness if enabled and vulnerable, but this statement is too broad. Not every WPA2-Personal network has WPS enabled, and not every WPS implementation is brute-forceable in the same way. Also, the question asks for the most effective first step in this scenario without assuming WPS is present. A tester would first verify whether WPS is enabled before considering WPS-specific attacks.