Replacing WEP with Secure Wireless Encryption

312-50v12 By islever Editorial Last updated

Hacking Wireless Networks

Short answer

B Recommend WPA2-PSK with AES encryption as the secure replacement for the vulnerable WEP protocol.

Question

You are an ethical hacker contracted to conduct a security audit for a company. During the audit, you discover that the company's wireless network is using WEP encryption. You understand the vulnerabilities associated with WEP and plan to recommend a more secure encryption method. Which of the following would you recommend as a suitable replacement to enhance the security of the company's wireless network?
  1. Open System authentication
  2. WPA2-PSK with AES encryption Correct Answer
  3. SSID broadcast disabling
  4. MAC address filtering

Key Takeaways

The core concept tested is recognizing that WEP is cryptographically broken and must be replaced by modern standards like WPA2/AES, while distractors offer only marginal or ineffective security improvements.

This question evaluates the ability to identify secure alternatives to the vulnerable WEP protocol for wireless networks. The correct answer is WPA2-PSK with AES encryption, which provides robust data confidentiality and integrity.

Common mistake: Candidates often select MAC address filtering or disabling SSID broadcast, mistakenly believing these obscurity measures provide strong encryption comparable to WPA2.

Expert Analysis

Why the Answer Is Correct

WEP (Wired Equivalent Privacy) has been proven insecure due to flaws in the RC4 stream cipher implementation, making it trivial to crack using tools like Aircrack-ng. WPA2-PSK (Wi-Fi Protected Access 2 - Pre-Shared Key) utilizes the AES (Advanced Encryption Standard) algorithm, which is currently the industry standard for securing wireless communications. It provides both strong encryption and message integrity checks, effectively mitigating the vulnerabilities inherent in WEP.

Why the Other Options Are Wrong

Open System authentication (A) provides no encryption, leaving traffic fully exposed. Disabling SSID broadcast (C) and MAC address filtering (D) are security through obscurity measures; they do not encrypt data and can be easily bypassed or discovered by an attacker, offering no protection against eavesdropping or packet injection.

Community Comment Notes

Community consensus strongly supports Option B as the definitive replacement. One commenter referenced CEH study materials confirming WPA2-AES as the standard upgrade path from WEP, aligning with exam doctrine.

Exam Strategy

Always prioritize cryptographic strength over configuration obscurity when securing networks. If a question asks for a 'replacement' or 'enhancement' to encryption, look for protocols implementing AES or CCMP, rather than access control lists or hidden SSIDs.

Frequently Asked Questions

Why is disabling SSID broadcast not a valid encryption replacement?

Disabling SSID broadcast hides the network name but does not encrypt the data transmitted over the air. Attackers can still discover hidden SSIDs and intercept unencrypted traffic.

Is WPA3 better than WPA2 for this recommendation?

While WPA3 is superior, WPA2-PSK with AES remains the widely supported standard for compatibility and sufficient security in most current contexts unless specified otherwise.

More 312-50v12 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. insaniunt 👍 4 Answered B
    B. WPA2-PSK with AES encryption
  2. multivolt 👍 1
    Could someone help me confirm if this is correct
  3. dobarb 👍 1
    B. CEH page 1819

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide