PracticeVideosBlogFlashcardsEspañol
All Practice Exams

100+ Free HTB CWPE Practice Questions

Prepare for the HTB Certified Wi-Fi Pentesting Expert exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More Hack The Box Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

HTB Certified Active Directory Pentesting Expert (CAPE)

Practice Questions

HTB Certified Defensive Security Analyst (CDSA)

Practice Questions

HTB Certified Junior Cybersecurity Associate (CJCA)

Practice Questions

HTB Certified Penetration Testing Specialist (CPTS)

Practice Questions

HTB Certified Web Exploitation Expert (CWEE)

Practice Questions

HTB Certified Web Exploitation Specialist (CWES)

Practice Questions
2026 Statistics

Key Facts: HTB CWPE Exam

7 days

Exam Duration

Hack The Box

No hardware

Cloud-Based Wireless Lab

Hack The Box

Jan 2026

Certification Launch Date

Hack The Box

6 modules

Wi-Fi Penetration Tester Path

HTB Academy

Report required

Professional Wireless Pentest Report

Hack The Box

WPA3 covered

Includes Dragonblood & SAE Attacks

HTB Academy

HTB CWPE is a 7-day practical wireless pentesting exam in a cloud-based lab environment covering WEP cracking, WPS Pixie Dust, WPA2 PMKID/handshake attacks, evil twin with captive portals, WPA-Enterprise EAP/RADIUS attacks via Eaphammer, WPA3 Dragonblood, and wireless-to-AD pivoting. No hardware required. Prerequisites include completing the HTB Academy Wi-Fi Penetration Tester job-role path. This practice exam covers knowledge areas: Aircrack-ng, Hashcat, Eaphammer, PMKID, SAE/Dragonblood, and pivoting.

Sample HTB CWPE Practice Questions

Try these sample questions to test your HTB CWPE exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1Which aircrack-ng component is used to place a wireless interface into monitor mode?
A.airodump-ng
B.airmon-ng
C.aireplay-ng
D.airbase-ng
Explanation: airmon-ng is the aircrack-ng suite component that enables or disables monitor mode on wireless interfaces. It must be run first (e.g., `airmon-ng start wlan0`) before other tools like airodump-ng can capture raw 802.11 frames. Killing conflicting processes with `airmon-ng check kill` is typically required before enabling monitor mode.
2During WEP cracking with aircrack-ng, which statistical attack requires approximately 40,000 captured IVs for reliable key recovery?
A.ChopChop attack
B.Fragmentation attack
C.PTW statistical attack
D.ARP replay attack
Explanation: The PTW (Pyshkin-Tews-Weinmann) statistical attack is the default WEP cracking method in aircrack-ng and requires roughly 40,000 captured initialization vectors (IVs). It exploits the biases in the RC4 keystream caused by weak IVs to statistically determine the WEP key. Earlier FMS and KoreK attacks required many more packets.
3What is the primary purpose of a deauthentication attack (aireplay-ng -0) during WPA2-PSK cracking?
A.Force clients to reconnect and capture the 4-way handshake
B.Decrypt the WPA2 traffic in real time
C.Enumerate SSIDs of hidden networks
D.Inject fake beacon frames to confuse clients
Explanation: Deauthentication attacks (aireplay-ng -0) send spoofed 802.11 deauth frames to disconnect a client from an AP. When the client reconnects it performs the WPA2 4-way handshake, which can be captured by airodump-ng. The captured EAPOL handshake is then cracked offline using a wordlist or brute force.
4The PMKID attack differs from traditional WPA2 handshake capture attacks because it:
A.Requires cracking the MIC of each EAPOL frame individually
B.Only works against WPA2-Enterprise networks
C.Does not require a client to be associated with the AP
D.Requires the attacker to be within 1 meter of the AP
Explanation: The PMKID attack (discovered by Jens Steube in 2018) extracts the PMKID from a single EAPOL frame sent by the AP. The PMKID = HMAC-SHA1-128(PMK, 'PMK Name' || AP_MAC || Client_MAC), so it can be captured without any connected clients or deauthentication. This makes it ideal when no clients are associated.
5Which WPS vulnerability allows an attacker to determine the correct 8-digit WPS PIN in at most 11,000 guesses rather than 100,000,000?
A.WPS KRACK vulnerability
B.WPS Pixie Dust offline attack
C.WPS PIN split design flaw
D.WPS beacon injection flaw
Explanation: The WPS PIN design flaw splits the 8-digit PIN into two 4-digit halves validated separately by the AP. The first half (4 digits = 10,000 possibilities) and the second half (3 effective digits = 1,000 possibilities, since the 8th digit is a checksum) can be brute-forced independently for a maximum of 11,000 total attempts. Tools like Reaver exploit this flaw.
6The Pixie Dust attack against WPS targets which specific cryptographic weakness?
A.Weak RC4 keystream generation in WPS handshake
B.Lack of TLS certificate validation in WPS exchange
C.Reuse of the 4-way handshake MIC across sessions
D.Predictable or zero E-S1/E-S2 nonces due to poor PRNG in embedded devices
Explanation: The Pixie Dust attack (Dominique Bongard, 2014) exploits poor pseudo-random number generation in some WPS implementations where the E-S1 and E-S2 nonces used to prove PIN knowledge are predictable or zero. An attacker can recover the WPS PIN offline in seconds using tools like pixiewps when the router firmware uses a weak PRNG.
7In an evil twin attack against WPA2-Personal clients, how does the attacker harvest the Wi-Fi password?
A.Hosting a captive portal to harvest credentials after clients connect to the deceptive AP
B.Capturing RADIUS accounting messages from the real AP
C.Injecting RSN information elements to downgrade clients to WEP
D.Replaying the 4-way handshake to reveal the PMK
Explanation: In a WPA2-Personal evil twin attack, the attacker creates a rogue AP with the same SSID and stronger signal, disconnects clients from the legitimate AP via deauth, and hosts a fake captive portal requesting the Wi-Fi password under a guise such as a firmware update prompt. Tools like Airgeddon and Wifipumpkin3 automate this workflow.
8Which Airgeddon attack mode creates a rogue AP, deauthenticates clients, and serves a web-based credential harvesting page to capture WPA/WPA2-Personal passwords?
A.WPA/WPA2 handshake cracking mode
B.WPS Pixie Dust offline mode
C.Evil Twin AP with captive portal attack
D.PMKID attack mode
Explanation: Airgeddon's Evil Twin AP with captive portal attack creates a rogue AP mimicking the target, deauthenticates clients from the legitimate AP, and serves a web-based credential harvesting page. The captured Wi-Fi password is verified against the captured WPA2 handshake to confirm authenticity before presenting it to the attacker.
9Eaphammer is primarily used to conduct evil twin attacks against which type of network?
A.WEP networks using open authentication
B.WPA2-Personal PSK networks
C.WPA2/WPA3-Enterprise (EAP-based) networks
D.WPS-enabled networks with Pixie Dust vulnerability
Explanation: Eaphammer (by s0lst1c3/Gabriel Ryan) is designed specifically for targeted evil twin attacks against WPA2-Enterprise and WPA3-Enterprise (EAP-based) networks. It sets up a rogue AP with a RADIUS server that captures EAP credentials such as MSCHAPv2 hashes or EAP-GTC plaintext from clients that connect while downgrading or accepting various EAP methods.
10In a WPA2-Enterprise evil twin attack with a rogue RADIUS server accepting all authentication attempts, what credential is typically captured from clients using EAP-TTLS/MSCHAPv2?
A.The client's TLS private key in plaintext
B.The RADIUS shared secret
C.The client's Kerberos ticket-granting ticket (TGT)
D.The NT hash (NetNTLMv2) of the user's domain password
Explanation: In EAP-TTLS or PEAP with MSCHAPv2 inner authentication, the client sends an MSCHAPv2 challenge-response. When a rogue RADIUS accepts all connections and the client does not validate the server certificate, the attacker captures the NT hash (NetNTLMv2) of the user's password. This hash can then be cracked offline with Hashcat or John the Ripper.

About the HTB CWPE Exam

The HTB Certified Wi-Fi Pentesting Expert (CWPE) is a practical wireless security certification from Hack The Box that validates real-world Wi-Fi exploitation skills. The 7-day cloud-based lab requires attacking networks across WEP, WPS, WPA/WPA2, WPA3, and WPA-Enterprise protocols using industry-standard tools including Aircrack-ng, Airgeddon, Eaphammer, Kismet, and Bettercap. No physical hardware is required. A professional report must be submitted for full certification.

Assessment

Performance-based assessment

Time Limit

7 days (168 hours)

Passing Score

All lab objectives + accepted professional report

Exam Fee

Check HTB Academy for current voucher/subscription pricing (Hack The Box)

HTB CWPE Exam Content Outline

10%

Wi-Fi Pentest Basics & Recon

Monitor mode, airodump-ng, Kismet, Bettercap wifi.recon, MAC spoofing, hidden SSID discovery, and 802.11 frame types

10%

WEP Attacks

PTW statistical attack, fake authentication (-1), ARP replay (-3), ChopChop decryption (-4), fragmentation attack (-5), IV collection

10%

WPS Attacks

WPS PIN split design flaw, Reaver brute-force, Pixie Dust via pixiewps, wash scanning, WPS lockout evasion

20%

WPA/WPA2 Attacks & Password Cracking

4-way handshake capture, PMKID via hcxdumptool, KRACK, Hashcat mode 22000, mask/rule/dictionary attacks, cowpatty PMK tables

15%

Evil Twin & Captive Portal Attacks

Airgeddon/Wifipumpkin3 rogue AP, captive portal credential harvesting, DNS tunneling bypass, ARP poisoning bypass, MAC cloning

15%

WPA-Enterprise & EAP/RADIUS Attacks

Eaphammer rogue RADIUS, hostapd-wpe, MSCHAPv2 hash capture, EAP-GTC downgrade, EAP-TTLS/PAP cleartext, hostile portal LLMNR

5%

WPA3 Attacks

SAE Dragonfly handshake, Dragonblood timing side-channels, OWE open networks, WPA3 transition mode downgrade attacks

10%

Wireless Pivoting to Internal Networks

Internal host discovery after wireless access, SSH dynamic port forwarding SOCKS5, proxychains, AD enumeration via SMB

5%

Wireless Pentest Reporting

Finding severity rating, remediation recommendations for WPS/WPA2/enterprise misconfigs, and professional report structure

How to Pass the HTB CWPE Exam

What You Need to Know

  • Passing score: All lab objectives + accepted professional report
  • Assessment: Performance-based assessment
  • Time limit: 7 days (168 hours)
  • Exam fee: Check HTB Academy for current voucher/subscription pricing

Keys to Passing

  • Work through all 100 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

HTB CWPE Study Tips from Top Performers

1Complete every HTB Academy Wi-Fi Penetration Tester module thoroughly including skills assessments — path completion is required for exam access
2Master the full aircrack-ng workflow: airmon-ng → airodump-ng → aireplay-ng -0 → airodump-ng handshake capture → aircrack-ng or Hashcat
3Practice PMKID collection with hcxdumptool and conversion with hcxpcapngtool for Hashcat mode 22000
4Learn Eaphammer's EAP downgrade and hostile portal attack capabilities — WPA-Enterprise attacks are heavily weighted
5Understand the Dragonblood WPA3 vulnerabilities and how they differ fundamentally from WPA2 attack surfaces
6Build Hashcat mask patterns for ISP router default passwords and corporate password policies (e.g., Season+Year+Symbol)
7Practice evil twin attacks with Airgeddon including the captive portal credential verification workflow
8Study SSH dynamic port forwarding and proxychains for the wireless-to-AD pivoting scenarios
9Document findings with CVSS scores and clear remediation recommendations — the professional report is separately graded

Frequently Asked Questions

What is the HTB CWPE exam format?

The HTB CWPE is a 7-day practical wireless penetration test conducted in a cloud-based lab environment. No physical wireless hardware is required — the lab provides virtual wireless environments. Candidates must demonstrate Wi-Fi exploitation skills across WEP, WPS, WPA/WPA2, WPA3, and WPA-Enterprise networks, capture proof flags, and submit a professional wireless penetration test report. Both lab objectives and an accepted report are required for certification.

Do I need wireless hardware to pass the HTB CWPE?

No — the HTB CWPE uses a cloud-based virtual wireless lab environment that does not require physical wireless adapters or hardware. This distinguishes it from traditional wireless courses that require specific USB adapters with injection support. The lab simulates real wireless networks in a controlled environment accessible via VPN.

What are the prerequisites for the HTB CWPE?

Candidates must complete the HTB Academy Wi-Fi Penetration Tester job-role path before the exam is unlocked. The path includes modules on Wi-Fi basics, WPS vulnerabilities, WEP/WPA/WPA2/WPA3 attacks, evil twin attacks, password cracking, corporate Wi-Fi attacks, and pivoting. Linux command-line proficiency and basic networking knowledge are strongly recommended before starting.

What tools are covered in the HTB CWPE?

The CWPE covers the full Aircrack-ng suite (airmon-ng, airodump-ng, aireplay-ng, airdecap-ng), Airgeddon, Eaphammer, Kismet, Bettercap, hcxdumptool/hcxtools, Hashcat, pixiewps, Reaver, Wifipumpkin3, macchanger, and mdk4. For WPA-Enterprise attacks, Eaphammer and hostapd-wpe are the primary tools. For pivoting, SSH dynamic forwarding and proxychains are used.

How does the HTB CWPE compare to other wireless certifications?

The HTB CWPE is a practical lab-based certification launched in January 2026, distinguishing itself from theory-heavy wireless certifications. It covers modern attack surfaces including WPA3 Dragonblood, WPA-Enterprise EAP attacks, and wireless-to-AD pivoting in a cloud lab requiring no dedicated hardware. It is comparable in depth to specialized wireless training but is accessible without physical infrastructure investment.

Is this practice exam like the real HTB CWPE?

No — this is a knowledge-prep multiple-choice practice exam. The real HTB CWPE requires actually exploiting wireless networks in a live cloud-based lab environment over 7 days. These practice questions build conceptual understanding of tools (Aircrack-ng, Eaphammer, hcxdumptool), attacks (PMKID, Pixie Dust, EAP downgrade), and methodology that underpin practical wireless exploitation. Use this alongside HTB Academy path completion for complete exam preparation.