Wireless Network Security Flashcards

Which wireless intrusion detection/prevention capability detects rogue access points by comparing detected BSSIDs against an authorized AP list and alerts on unauthorized devices?

Answer: Wireless IDS (WIDS) with AP monitoring

A Wireless IDS (WIDS) continuously monitors the RF environment, catalogs all detected APs, and compares them against the authorized AP database to alert defenders when unknown or rogue APs appear.

A CND practitioner wants to isolate wireless guest users from the internal corporate network while using the same physical AP infrastructure. Which technology best achieves this?

Answer: VLAN-based SSID segmentation with separate VLANs per SSID

Mapping each SSID to a separate VLAN allows the same physical infrastructure to carry multiple logical networks, with firewall rules between VLANs enforcing isolation between guest and corporate traffic.

When conducting a wireless site survey for security planning, what is the primary purpose of measuring RF signal coverage patterns?

Answer: To locate coverage gaps and signal bleed beyond the facility perimeter that could be exploited

RF site surveys help defenders understand where the wireless signal extends, ensuring coverage gaps do not create blind spots and that signal does not bleed significantly outside the building where attackers could intercept it.

Which countermeasure directly protects against evil twin attacks by cryptographically binding the network identity to the authentication exchange?

Answer: Using certificate-based mutual authentication (EAP-TLS) with 802.1X

EAP-TLS requires the authentication server to present a certificate the client validates, so a rogue AP cannot complete the mutual auth exchange — the client detects the missing or invalid server certificate and refuses to connect.

A security team uses Aircrack-ng to test their wireless network. After capturing the 4-way handshake, what additional step is required to attempt to recover the WPA2-PSK?

Answer: Run a dictionary or brute-force attack against the captured handshake offline

Once the 4-way handshake is captured, Aircrack-ng performs offline dictionary or brute-force attacks by trying candidate passphrases through the PBKDF2-HMAC-SHA1 function to see if the computed MIC matches the captured one.

Which 802.11 amendment introduced Protected Management Frames (PMF), providing authentication for management frames to mitigate deauthentication and disassociation attacks?

Answer: 802.11w

802.11w introduced Management Frame Protection (MFP/PMF), which uses cryptographic authentication for key management frames, preventing attackers from forging deauthentication and disassociation frames.

A network defender wants to prevent wireless clients from communicating directly with each other on the same AP while still allowing internet access. Which AP feature accomplishes this?

Answer: Client isolation (AP isolation / PSPF)

Client isolation (sometimes called AP isolation or Publicly Secure Packet Forwarding) blocks Layer 2 traffic between wireless clients on the same SSID, preventing peer-to-peer attacks like ARP poisoning while allowing uplink access.