CND Wireless Network Security 2 — Questions and Answers
Question 1: An attacker sends 802.11 deauthentication frames spoofed as the legitimate access point to disconnect clients. What attack is being performed?
- KRACK (Key Reinstallation Attack)
- Deauthentication/Disassociation attack (DoS) (Correct answer)
- WPS Pixie Dust attack
- Beacon flood attack
Correct answer: Deauthentication/Disassociation attack (DoS)
A deauthentication attack exploits the unauthenticated nature of 802.11 management frames, allowing an attacker to forge de-auth frames and disconnect legitimate clients from an AP.
Question 2: KRACK (Key Reinstallation Attack) targets which phase of the WPA2 protocol?
- The initial beacon and probe response exchange
- The 4-way handshake used to establish session keys (Correct answer)
- The RADIUS authentication exchange
- The DHCP IP address assignment process
Correct answer: The 4-way handshake used to establish session keys
KRACK manipulates retransmissions in the WPA2 4-way handshake to force nonce reuse, allowing decryption and potentially injection of traffic by reinstalling an already-in-use cryptographic key.
Question 3: An attacker sets up a wireless access point near a coffee shop that mimics the legitimate free Wi-Fi, hoping users will connect to it. This is known as which attack?
- Wardriving
- Evil twin attack (Correct answer)
- Bluesnarfing
- RF jamming
Correct answer: Evil twin attack
An evil twin attack creates a fraudulent AP that mimics a legitimate one, tricking users into connecting so the attacker can intercept traffic, capture credentials, or conduct man-in-the-middle attacks.
Question 4: The Wi-Fi Protected Setup (WPS) PIN method was found to be vulnerable to brute-force attacks requiring fewer than 11,000 guesses rather than 100 million. What design flaw causes this?
- The PIN is transmitted in plaintext over the air
- The 8-digit PIN is validated in two halves independently, reducing the keyspace (Correct answer)
- WPS uses RC4 encryption instead of AES
- The PIN is derived from the MAC address of the AP
Correct answer: The 8-digit PIN is validated in two halves independently, reducing the keyspace
WPS validates the first 4 digits of the PIN separately from the last 4 (minus a checksum digit), reducing the brute-force space from 10^8 to roughly 10^4 + 10^3 = ~11,000 guesses.
Question 5: Wardriving is a reconnaissance technique used to discover wireless networks. Which tool combination is most commonly associated with wardriving on Linux?
- Nmap + Metasploit
- Kismet + GPS receiver (Correct answer)
- Wireshark + Burp Suite
- Airsnort + John the Ripper
Correct answer: Kismet + GPS receiver
Kismet is a passive wireless network detector and sniffer, and when combined with a GPS receiver it can map discovered networks geographically, which is the core capability used in wardriving.
Question 6: Which Bluetooth attack allows an attacker to pair with a device without the owner's knowledge and access calendar, contacts, and messages?
- Bluejacking
- Bluesnarfing (Correct answer)
- BlueSmack
- BIAS (Bluetooth Impersonation Attack)
Correct answer: Bluesnarfing
Bluesnarfing exploits vulnerabilities in OBEX Push Profile or OBEX File Transfer Profile to access sensitive data on a Bluetooth device without user authorization or authentication.
Question 7: A network defender captures 802.11 beacon frames with the SSID field set to null (empty string). What is the attacker or administrator attempting to accomplish?
- Enabling WPA3 protection on the access point
- Hiding the network name to reduce casual discovery (SSID cloaking) (Correct answer)
- Implementing 802.1X port-based authentication
- Enabling band steering to push clients to 5 GHz
Correct answer: Hiding the network name to reduce casual discovery (SSID cloaking)
SSID cloaking (hiding) sets the SSID field to null in beacon frames, making the network invisible to casual scanners; however, passive sniffers can still capture the SSID from probe requests and responses.
