The assertion that many companies continue to use WEP to avoid the cost of reconfiguring all access points and clients to 802.11i and because WEP has not been fully cracked yet is:

• A. True
• B. False
• C. Not enough information
• D. Not applicable

Answer: (B)

WEP is insecure by design. It uses RC4 with a 24-bit initialization vector that is sent in clear, and that small IV space leads to many IV collisions once enough traffic is captured. With those collisions and the same key reused, attackers can recover the WEP key using practical, readily available attacks and tools. Because of this, WEP has been considered broken for decades, and real-world cracking is straightforward and fast in many cases.

So the assertion that organizations keep using WEP just to avoid reconfiguring devices or because WEP hasn’t been fully cracked is not accurate. The security risk with WEP is already well established, and the proper response is to upgrade to 802.11i-based protections (WPA2/WPA3) with stronger encryption and better key management. Some shops delay upgrades for compatibility or cost, but the idea that WEP remains secure or uncracked is incorrect.