CEH Day 11 Wireless Security + Cloud Security + IoT Security

What does SSID identify?

The name of a wireless network

What does BSSID identify?

An identifier associated with a specific AP radio or interface

Can multiple APs broadcast the same SSID?

Yes multiple APs can share an SSID while having different BSSIDs

Why is a hidden SSID not a strong security control?

The SSID may still be exposed through wireless traffic and hiding it does not replace encryption or authentication

What is infrastructure mode in WLAN?

Wireless clients communicate through an access point

What is ad hoc wireless mode?

Devices communicate directly without a traditional access point

What makes WEP insecure?

WEP uses RC4 with a weak IV design

Which legacy security protocol introduced TKIP?

WPA

Which encryption method is commonly used by WPA2?

AES-CCMP

What authentication method does WPA2-Personal use?

A shared pre-shared key

What authentication method does WPA2-Enterprise commonly use?

802.1X with EAP and centralized authentication

What does WPA3-Personal use to improve password security?

SAE

What can an attacker attempt after capturing a WPA2-Personal handshake?

Offline guessing of a weak passphrase

Does capturing a WPA2 handshake automatically reveal the password?

No the attacker must still recover the passphrase

What is an Evil Twin attack?

A rogue AP impersonating a legitimate wireless network

What is a rogue access point?

An unauthorized wireless access point

What is the primary effect of a deauthentication attack?

Availability disruption by disconnecting wireless clients

What is wardriving?

Mapping wireless networks while moving through an area

What does KRACK stand for?

Key Reinstallation Attack

What does Aircrack-ng primarily help with?

Wireless security auditing and captured handshake password recovery

What is Airodump-ng used for?

Capturing wireless traffic and observing APs and clients

What is Aireplay-ng used for?

Wireless packet injection and replay

What is Airbase-ng used for?

Creating a software based wireless access point

What is Kismet used for?

Wireless network detection sniffing and monitoring

What is Reaver associated with?

WPS PIN attacks

Why is MAC filtering not strong authentication?

MAC addresses can be spoofed

What is the main purpose of wireless IDS or IPS?

Detecting or responding to suspicious wireless activity

What does IaaS mean?

Infrastructure as a Service

In IaaS what does the customer typically manage?

Guest OS applications configurations IAM and data

What does PaaS mean?

Platform as a Service

In PaaS what does the customer typically manage?

Applications data identities and service configurations

What does SaaS mean?

Software as a Service

In SaaS what does the provider typically manage?

The hosted application and underlying platform

What is the shared responsibility model?

A division of security responsibilities between the cloud provider and customer

What is a public cloud?

Cloud infrastructure offered for use by multiple customers

What is a private cloud?

Cloud infrastructure dedicated to one organization

What is a hybrid cloud?

Integrated use of distinct cloud environments

What is a community cloud?

Cloud infrastructure shared by organizations with common concerns

What is cloud misconfiguration?

Incorrect cloud security settings that may expose resources or data

What is account hijacking in cloud security?

An attacker gains control of a cloud account

What is an insecure cloud API?

An API with inadequate security that may expose data or functionality

What is VM escape?

Breaking out of a guest VM's isolation to interact with the host or hypervisor

What is tenant isolation failure?

A weakness allowing one tenant to access or affect another tenant's resources

What is cryptojacking?

Unauthorized use of computing resources for cryptocurrency mining

What is cloud metadata service abuse?

Abusing access to instance metadata to potentially retrieve role credentials

What is a side channel attack in cloud environments?

Inferring information from shared resource behavior

What is the direct remediation for a public cloud storage bucket?

Block unintended public access and correct the bucket access policy

Does encryption alone fix a publicly accessible storage bucket?

No access control must also be corrected

What is the principle of least privilege?

Granting identities only the permissions required for their legitimate functions

What is the most direct control for a cloud admin account without MFA?

Implement multi factor authentication

What is the most direct control for a database accepting connections from any IP?

Restrict inbound traffic using security group or firewall rules

What is the difference between network segmentation and security group rules?

Segmentation separates network zones while security group rules filter traffic

What is a cloud backup?

A recoverable copy of data

What is disaster recovery?

The broader capability to restore systems and services after disruption

Why should backups be recovery tested?

Untested backups do not prove that data or services can be restored

What is the IoT perception or device layer?

The layer that collects environmental data or interacts with the physical world

What is the IoT network or transport layer?

The layer that transfers data between devices gateways and services

What is the IoT application layer?

The layer that processes data and provides user facing services

What is MQTT primarily used for?

Lightweight broker based publish subscribe messaging

What is CoAP?

A lightweight REST like protocol commonly associated with UDP

What is Zigbee commonly used for?

Low power wireless mesh networking in smart home and IoT systems

What is BLE?

Bluetooth Low Energy for short range low power communication

What is Z Wave commonly used for?

Low power smart home networking

What is 6LoWPAN?

IPv6 over Low Power Wireless Personal Area Networks

What is a common authentication weakness in IoT devices?

Default or hardcoded credentials

What is the primary weakness of an insecure firmware update mechanism?

Inadequate firmware authenticity or integrity verification

What is an IoT replay attack?

Retransmitting a previously captured valid message or command

What is the difference between replay and MITM?

Replay reuses captured messages while MITM intercepts and may modify or relay communication

What is IoT botnet recruitment?

Compromising IoT devices and controlling them collectively

What is wireless jamming?

RF interference that disrupts wireless communication

What is the primary impact of jamming?

Availability disruption

What is Shodan used for?

Discovering internet exposed devices and services

Does Shodan automatically exploit devices it finds?

No it is primarily a discovery and search tool

What is Binwalk used for?

Analyzing firmware images and identifying or extracting embedded filesystems and files

What is Wireshark used for?

Capturing and analyzing network packets and protocols

What is the key difference between Binwalk and Wireshark?

Binwalk analyzes firmware images while Wireshark analyzes network traffic

What is the purpose of IoT network segmentation?

Limiting communication and reducing lateral movement from compromised devices

Does network segmentation patch vulnerable IoT firmware?

No patching and firmware lifecycle management are separate controls

What is the purpose of signed firmware?

Verifying firmware authenticity and integrity

What was the limitation of the Kali wireless lab environment?

The VM had no dedicated wireless adapter and exposed only virtual Ethernet interfaces

Why could the existing PCAPNG not support raw 802.11 analysis?

It contained Ethernet II traffic rather than raw 802.11 wireless frames

Which protocols were observed in the existing PCAPNG?

TCP HTTP TLS ARP SSDP DNS and QUIC

What does ARP map?

IPv4 addresses to MAC addresses

What transport protocol does QUIC use?

UDP

What is the key wireless password recovery clue in a CEH scenario?

A weak WPA2 Personal passphrase with captured handshake material suggests offline guessing

What is the key CEH clue for Binwalk?

Firmware image analysis or embedded filesystem extraction

What is the key CEH clue for Shodan?

Searching for internet exposed devices and services

What is the key CEH clue for VM escape?

A guest VM breaks out of isolation and interacts with the host or hypervisor

What is the key CEH clue for metadata service abuse?

An attacker accesses instance metadata to retrieve cloud role credentials

What is the key CEH clue for MQTT?

Lightweight broker based publish subscribe messaging