CCST - Cisco Certified Support Technician Wireless Security Protocols (WPA) Questions and Answers 1 — Questions and Answers
Question 1: A company wants to implement the highest level of security for its corporate wireless network, which is used by hundreds of employees with individual company-issued laptops. Which wireless security protocol and mode should be implemented to ensure each user authenticates with unique credentials?
- WPA2-Personal
- WPA3-Personal
- WPA2-Enterprise (Correct answer)
- WPA with TKIP
Correct answer: WPA2-Enterprise
WPA2-Enterprise mode is designed for corporate environments. Unlike the 'Personal' mode which uses a single pre-shared key (PSK) for all users, 'Enterprise' mode integrates with a RADIUS server to authenticate each user individually with unique credentials (e.g., username and password). This provides superior security, accountability, and management, as access can be granted or revoked on a per-user basis.
Question 2: A support technician is configuring a new SOHO (Small Office/Home Office) wireless router. The goal is to use the most current and secure protocol that protects against offline dictionary attacks, even if the password is simple. Which WPA protocol should be chosen?
- WPA with AES
- WPA2 with TKIP
- WPA2 with AES-CCMP
- WPA3 with SAE (Correct answer)
Correct answer: WPA3 with SAE
WPA3 is the latest Wi-Fi security standard and its key advantage is the use of Simultaneous Authentication of Equals (SAE), also known as the Dragonfly key exchange. This method is inherently resistant to offline dictionary attacks, where an attacker captures the initial handshake and tries to guess the password repeatedly. SAE ensures the password is never transmitted, providing robust protection even with less complex passwords.
Question 3: Which of the following encryption protocols is considered a deprecated, older standard associated with the original WPA, while its successor, CCMP, is the mandatory standard for WPA2?
- TKIP (Correct answer)
- AES
- SAE
- EAP
Correct answer: TKIP
Temporal Key Integrity Protocol (TKIP) was developed as a replacement for the flawed WEP encryption. It was used with WPA as an interim solution. However, TKIP has known vulnerabilities and has been deprecated. WPA2 mandates the use of the stronger Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP), which is based on the Advanced Encryption Standard (AES).
Question 4: A user is setting up a guest network at a small coffee shop. To support older devices, the technician enables a 'transition mode' on the new WPA3-capable router. What is the primary function of WPA3 Transition Mode?
- It forces all devices to use the highest 192-bit encryption.
- It blocks any device that does not support Protected Management Frames (PMF).
- It allows both WPA3-capable and WPA2-capable devices to connect to the same SSID. (Correct answer)
- It completely disables WPA2-Personal (PSK) in favor of WPA3-Personal (SAE).
Correct answer: It allows both WPA3-capable and WPA2-capable devices to connect to the same SSID.
WPA3 Transition Mode is designed for backward compatibility. When enabled on a network (SSID), it allows devices that support WPA3 to connect using the more secure SAE protocol, while simultaneously permitting older devices that only support WPA2 to connect using PSK. This provides a smooth migration path without requiring an immediate upgrade of all client devices.
Question 5: A technician is auditing the security of a wireless network and discovers that Wi-Fi Protected Setup (WPS) is enabled. Why is this feature generally considered a significant security risk on WPA/WPA2 networks?
- It limits the password length to 8 characters.
- The WPS PIN is susceptible to brute-force attacks, which can reveal the WPA2 pre-shared key. (Correct answer)
- It disables AES encryption and forces the use of the weaker TKIP protocol.
- It requires the SSID to be broadcast, preventing the use of a hidden network.
Correct answer: The WPS PIN is susceptible to brute-force attacks, which can reveal the WPA2 pre-shared key.
Wi-Fi Protected Setup (WPS) was designed for ease of use but introduced a major vulnerability. The PIN-based authentication method can be brute-forced relatively quickly because the validation process happens in two halves, drastically reducing the number of combinations an attacker needs to try. A successful attack reveals the WPS PIN, which can then be used to retrieve the network's main WPA/WPA2 pre-shared key.
Question 6: When comparing WPA2-Personal and WPA3-Personal, what is the fundamental change in the authentication method that enhances security?
- WPA3 replaces the Pre-Shared Key (PSK) four-way handshake with Simultaneous Authentication of Equals (SAE). (Correct answer)
- WPA3 requires the use of a RADIUS server for all personal networks.
- WPA3 mandates 192-bit encryption, whereas WPA2 only supports 128-bit.
- WPA3 introduces TKIP for stronger message integrity over PSK.
Correct answer: WPA3 replaces the Pre-Shared Key (PSK) four-way handshake with Simultaneous Authentication of Equals (SAE).
The most significant security upgrade in WPA3-Personal is the replacement of the WPA2-Personal's Pre-Shared Key (PSK) authentication method with Simultaneous Authentication of Equals (SAE). While WPA2's four-way handshake using a PSK is vulnerable to offline dictionary attacks if the handshake is captured, SAE's Dragonfly key exchange protocol prevents these attacks by not exposing the password directly.
CCST - Cisco Certified Support Technician Wireless Security Protocols (WPA) Questions and Answers 1
A company wants to implement the highest level of security for its corporate wireless network, which is used by hundreds of employees with individual company-issued laptops.
Which wireless security protocol and mode should be implemented to ensure each user authenticates with unique credentials?