CND Wireless Network Security 2

Question 1

An attacker sends 802.11 deauthentication frames spoofed as the legitimate access point to disconnect clients. What attack is being performed?

Accepted Answer

Deauthentication/Disassociation attack (DoS)

Answer

KRACK (Key Reinstallation Attack)

Answer

WPS Pixie Dust attack

Answer

Beacon flood attack

Question 2

KRACK (Key Reinstallation Attack) targets which phase of the WPA2 protocol?

Accepted Answer

The 4-way handshake used to establish session keys

Answer

The initial beacon and probe response exchange

Answer

The RADIUS authentication exchange

Answer

The DHCP IP address assignment process

Question 3

An attacker sets up a wireless access point near a coffee shop that mimics the legitimate free Wi-Fi, hoping users will connect to it. This is known as which attack?

Accepted Answer

Evil twin attack

Answer

Wardriving

Answer

Bluesnarfing

Answer

RF jamming

Question 4

The Wi-Fi Protected Setup (WPS) PIN method was found to be vulnerable to brute-force attacks requiring fewer than 11,000 guesses rather than 100 million. What design flaw causes this?

Accepted Answer

The 8-digit PIN is validated in two halves independently, reducing the keyspace

Answer

The PIN is transmitted in plaintext over the air

Answer

WPS uses RC4 encryption instead of AES

Answer

The PIN is derived from the MAC address of the AP

Question 5

Wardriving is a reconnaissance technique used to discover wireless networks. Which tool combination is most commonly associated with wardriving on Linux?

Accepted Answer

Kismet + GPS receiver

Answer

Nmap + Metasploit

Answer

Wireshark + Burp Suite

Answer

Airsnort + John the Ripper

Question 6

Which Bluetooth attack allows an attacker to pair with a device without the owner's knowledge and access calendar, contacts, and messages?

Accepted Answer

Bluesnarfing

Answer

Bluejacking

Answer

BlueSmack

Answer

BIAS (Bluetooth Impersonation Attack)

Question 7

A network defender captures 802.11 beacon frames with the SSID field set to null (empty string). What is the attacker or administrator attempting to accomplish?

Accepted Answer

Hiding the network name to reduce casual discovery (SSID cloaking)

Answer

Enabling WPA3 protection on the access point

Answer

Implementing 802.1X port-based authentication

Answer

Enabling band steering to push clients to 5 GHz