CWS CWS WLAN Security Concepts 2 — Questions and Answers
Question 1: Which attack exploits the 802.11 four-way handshake by capturing it and then running offline dictionary attacks?
- Deauthentication flood
- PMKID attack
- WPA2-PSK brute force via captured handshake (Correct answer)
- Evil twin injection
Correct answer: WPA2-PSK brute force via captured handshake
An attacker can capture the WPA2-PSK four-way handshake and perform offline dictionary or brute-force attacks without staying connected to the network.
Question 2: What is the primary purpose of 802.11w (Management Frame Protection)?
- Encrypting data frames with AES-256
- Protecting management frames from spoofing and replay attacks (Correct answer)
- Enabling fast BSS transition between APs
- Increasing beacon interval to reduce overhead
Correct answer: Protecting management frames from spoofing and replay attacks
802.11w adds cryptographic protection to unicast and some multicast management frames to prevent deauthentication and disassociation spoofing.
Question 3: In WPA3-Enterprise, what minimum encryption suite is required compared to WPA2-Enterprise?
- RC4 with 128-bit keys
- TKIP with MIC
- GCMP-128 as the minimum cipher (Correct answer)
- CCMP-64 as the minimum cipher
Correct answer: GCMP-128 as the minimum cipher
WPA3-Enterprise requires a minimum of GCMP-128, and the 192-bit mode mandates GCMP-256 for stronger government/enterprise security.
Question 4: A rogue AP is detected broadcasting the same SSID as the corporate network. What type of attack does this describe?
- Karma attack
- Evil twin attack (Correct answer)
- Deauth flood attack
- MAC flooding attack
Correct answer: Evil twin attack
An evil twin attack involves deploying a rogue AP with the same SSID (and often BSSID spoofed) to lure clients into connecting to the attacker's AP.
Question 5: Which EAP method uses a server-side certificate and a client-side certificate for mutual authentication?
- EAP-MD5
- PEAP
- EAP-TLS (Correct answer)
- LEAP
Correct answer: EAP-TLS
EAP-TLS requires both the RADIUS server and the client to present valid X.509 certificates, providing strong mutual authentication.
Question 6: What does SAE (Simultaneous Authentication of Equals) replace in WPA3-Personal?
- TKIP key mixing
- The PSK-based four-way handshake authentication exchange (Correct answer)
- EAP outer identity protection
- RADIUS shared secret negotiation
Correct answer: The PSK-based four-way handshake authentication exchange
SAE replaces the PSK authentication mechanism used in WPA2-Personal, providing forward secrecy and resistance to offline dictionary attacks.
Question 7: Which wireless security mechanism prevents a compromised session key from exposing past or future sessions?
- TKIP sequence counter
- Perfect Forward Secrecy (PFS) (Correct answer)
- WEP IV rotation
- SSID cloaking
Correct answer: Perfect Forward Secrecy (PFS)
Perfect Forward Secrecy ensures that each session uses a unique key, so compromising one session key does not expose other sessions.
CWS CWS WLAN Security Concepts 2
Which attack exploits the 802.11 four-way handshake by capturing it and then running offline dictionary attacks?