FirstTry

Exam objective

CEH

Hacking Wireless Networks

This objective sits in Wireless Network Hacking, which carries 5% of the CEH exam. The questions below are original, written from the official objective title above, and each explanation cites the EC-Council page it rests on.

Objective title verbatim from the official objectives. EC-Council exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

Wireless Network Hacking

An engineer wants to list every nearby network name and its cipher suite while transmitting nothing. Which frame already carries that information?

Association requests sent by clientsAn association request comes from a client that has already found the network, so it appears after discovery rather than enabling it.
Beacon frames the AP broadcastsCorrect · your answerCorrect.
EAPOL-Key messages in the handshakeEAPOL-Key frames carry the four-way handshake, the exchange captured to attack a passphrase, not to enumerate networks.
RTS and CTS control framesRTS and CTS reserve airtime between stations. They answer a hidden node problem.

Correct.

Checked against rfc-editor.org, September 2026

Concept

Access points announce themselves on a schedule, so a listener within radio range can inventory an entire wireless neighborhood without ever transmitting. Passive collection leaves no trace on the air and is where a wireless assessment starts.

Why B

Beacons name the SSID, the access point's BSSID, the security policy governing access and the ciphers used for unicast and broadcast traffic, so a receiver that never sends a frame already holds the inventory.

Source

Wi-Fi access points (APs) advertise their presence through frames called "beacons". These frames inform clients within earshot of the SSID (Service Set Identifier) the AP is advertising, the AP's Media Access Control (MAC) address (known as its "BSSID"...), security policy governing access, the symmetric ciphers it uses for unicast and broadcast frames, QoS information, as well as support for other optional features of [IEEE802.11].... After an AP is discovered by a client, actively through probing or passively through beacons, the client initiates a two-step method to gain network access.

IETF, RFC 8110: Opportunistic Wireless Encryption, checked September 2026
#wireless-concepts#802.11#reconnaissance

Now you: practice questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

Wireless Network Hacking

A cafe prints one WPA2-Personal passphrase on its menu board. An auditor reports that guests have no privacy from each other. Which fact supports the finding?

Sample question 2 of 3

Wireless Network Hacking

An analyst reviewing a wireless IDS sees bursts of deauthentication frames aimed at one AP's clients, each burst followed by a fresh association. What is the likely goal?

Sample question 3 of 3

Wireless Network Hacking

A hotel engineer replaces the open guest SSID with Opportunistic Wireless Encryption. Which risk does the change leave untouched?

That’s 3 of the full CEH bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.