CND Wireless Network Security 3

Question 1

Which wireless intrusion detection/prevention capability detects rogue access points by comparing detected BSSIDs against an authorized AP list and alerts on unauthorized devices?

Accepted Answer

Wireless IDS (WIDS) with AP monitoring

Answer

A Wireless IDS (WIDS) continuously monitors the RF environment, catalogs all detected APs, and compares them against the authorized AP database to alert defenders when unknown or rogue APs appear.

Question 2

A CND practitioner wants to isolate wireless guest users from the internal corporate network while using the same physical AP infrastructure. Which technology best achieves this?

Accepted Answer

VLAN-based SSID segmentation with separate VLANs per SSID

Answer

Mapping each SSID to a separate VLAN allows the same physical infrastructure to carry multiple logical networks, with firewall rules between VLANs enforcing isolation between guest and corporate traffic.

Question 3

When conducting a wireless site survey for security planning, what is the primary purpose of measuring RF signal coverage patterns?

Accepted Answer

To locate coverage gaps and signal bleed beyond the facility perimeter that could be exploited

Answer

RF site surveys help defenders understand where the wireless signal extends, ensuring coverage gaps do not create blind spots and that signal does not bleed significantly outside the building where attackers could intercept it.

Question 4

Which countermeasure directly protects against evil twin attacks by cryptographically binding the network identity to the authentication exchange?

Accepted Answer

Using certificate-based mutual authentication (EAP-TLS) with 802.1X

Answer

EAP-TLS requires the authentication server to present a certificate the client validates, so a rogue AP cannot complete the mutual auth exchange — the client detects the missing or invalid server certificate and refuses to connect.

Question 5

A security team uses Aircrack-ng to test their wireless network. After capturing the 4-way handshake, what additional step is required to attempt to recover the WPA2-PSK?

Accepted Answer

Run a dictionary or brute-force attack against the captured handshake offline

Answer

Once the 4-way handshake is captured, Aircrack-ng performs offline dictionary or brute-force attacks by trying candidate passphrases through the PBKDF2-HMAC-SHA1 function to see if the computed MIC matches the captured one.

(CND) Certified Network Defender Practice Test

(CND) Certified Network Defender Practice Test

CND Wireless Network Security 3