CNDA Wireless Network Security 1 — Questions and Answers
Question 1: Which security improvement does WPA3 provide over WPA2 that prevents offline dictionary attacks on captured handshakes?
- RC4 stream cipher replacement
- Simultaneous Authentication of Equals (SAE) (Correct answer)
- Increased IV length to 128 bits
- Certificate-based client authentication
Correct answer: Simultaneous Authentication of Equals (SAE)
WPA3 uses SAE (Dragonfly handshake) instead of PSK, which provides forward secrecy and prevents attackers from capturing handshakes for offline brute-force.
Question 2: In a wireless enterprise environment, 802.1X authentication relies on which three-party model?
- Client, Access Point, LDAP Server
- Supplicant, Authenticator, Authentication Server (Correct answer)
- Client, Firewall, RADIUS Proxy
- Device, Controller, Certificate Authority
Correct answer: Supplicant, Authenticator, Authentication Server
802.1X uses a supplicant (client device), authenticator (access point), and authentication server (typically RADIUS) to control network access.
Question 3: A network defender detects an access point broadcasting the corporate SSID but with a different BSSID and stronger signal. This is most likely which type of attack?
- Beacon flooding
- Evil twin attack (Correct answer)
- Deauthentication attack
- SSID squatting
Correct answer: Evil twin attack
An evil twin is a rogue AP mimicking a legitimate SSID/BSSID to lure clients into connecting so the attacker can intercept traffic.
Question 4: Why is hiding the SSID considered an insufficient security control for wireless networks?
- Hidden SSIDs still appear in beacon frames at full power
- Clients actively probe for hidden SSIDs, revealing them in probe request frames (Correct answer)
- Hidden SSIDs disable WPA2 authentication
- SSID hiding is not supported on 5 GHz bands
Correct answer: Clients actively probe for hidden SSIDs, revealing them in probe request frames
Devices configured for a hidden SSID broadcast probe request frames containing the SSID name, making it trivially discoverable with passive sniffing tools.
Question 5: Which fundamental cryptographic weakness made WEP completely broken and unsuitable for use?
- Use of SHA-1 for integrity checking
- Short 24-bit Initialization Vector reuse with RC4 (Correct answer)
- Lack of a 4-way handshake
- Absence of certificate-based mutual authentication
Correct answer: Short 24-bit Initialization Vector reuse with RC4
WEP's 24-bit IV space is small enough to force IV reuse within minutes on a busy network, allowing attackers to recover the key using statistical attacks on RC4 keystreams.
Question 6: A wireless IDS (WIDS) has flagged a large number of deauthentication frames targeting all clients on an AP. What is the most likely intent of this activity?
- RF spectrum analysis
- Forcing clients to reassociate to capture the 4-way WPA2 handshake (Correct answer)
- Testing AP load balancing
- Triggering 802.11r fast BSS transition
Correct answer: Forcing clients to reassociate to capture the 4-way WPA2 handshake
Attackers send spoofed deauthentication frames to disconnect clients, forcing them to reauthenticate so the WPA2 4-way handshake can be captured for offline cracking.
Question 7: Which encryption protocol replaced TKIP in WPA2 and provides stronger confidentiality through AES in counter mode?
- CCMP (Counter Mode CBC-MAC Protocol) (Correct answer)
- GCMP (Galois/Counter Mode Protocol)
- WRAP (Wireless Robust Authenticated Protocol)
- LEAP (Lightweight Extensible Authentication Protocol)
Correct answer: CCMP (Counter Mode CBC-MAC Protocol)
CCMP uses AES in Counter Mode for encryption and CBC-MAC for integrity, making it the mandatory strong cipher suite in WPA2.
CNDA Wireless Network Security 1
Which security improvement does WPA3 provide over WPA2 that prevents offline dictionary attacks on captured handshakes?