CNDA Wireless Network Security 2 — Questions and Answers
Question 1: WPS PIN authentication was deprecated primarily because of which vulnerability?
- PINs could be brute-forced in under 11,000 attempts due to split-PIN validation (Correct answer)
- WPS used MD5 hashing for PIN storage
- WPS PINs were transmitted in cleartext over the air
- WPS disabled WPA2 encryption during the enrollment phase
Correct answer: PINs could be brute-forced in under 11,000 attempts due to split-PIN validation
WPS validates the PIN in two halves independently, reducing the brute-force space from 10^8 to roughly 11,000 attempts, making it trivially crackable with tools like Reaver.
Question 2: The KRACK (Key Reinstallation Attack) vulnerability targeted which phase of the WPA2 protocol?
- EAP-TLS certificate exchange
- The 4-way handshake nonce and key reinstallation (Correct answer)
- RADIUS server CHAP authentication
- TKIP MIC (Michael) integrity check
Correct answer: The 4-way handshake nonce and key reinstallation
KRACK manipulates the 4-way handshake to force nonce reuse by replaying handshake messages, allowing attackers to decrypt, replay, or forge frames.
Question 3: A network architect wants to isolate guest Wi-Fi users from the corporate LAN. Which design approach is most effective?
- Assign guest users to a separate VLAN with ACLs blocking internal subnets (Correct answer)
- Use SSID hiding on the corporate network
- Enable client isolation only on the corporate SSID
- Deploy a captive portal without VLAN segmentation
Correct answer: Assign guest users to a separate VLAN with ACLs blocking internal subnets
Placing guest users in a dedicated VLAN with ACLs preventing access to corporate subnets provides network-layer isolation independent of AP configuration.
Question 4: Which EAP method provides mutual authentication using digital certificates on both the client and the server?
- EAP-MD5
- EAP-TLS (Correct answer)
- EAP-FAST
- PEAP-MSCHAPv2
Correct answer: EAP-TLS
EAP-TLS requires both the authentication server and the client to present valid X.509 certificates, providing strong mutual authentication.
Question 5: During a wireless site survey, a security architect discovers overlapping channels 1, 6, and 11 in the 2.4 GHz band being used correctly. Why are these specific channels chosen?
- They are the only channels that support WPA3
- They are the only three non-overlapping channels in 2.4 GHz (Correct answer)
- They provide maximum range due to lower frequency
- They are reserved for enterprise 802.1X use
Correct answer: They are the only three non-overlapping channels in 2.4 GHz
In the 2.4 GHz band, only channels 1, 6, and 11 are non-overlapping (in the US), preventing co-channel interference between adjacent access points.
Question 6: MAC address filtering as a wireless security control is ineffective primarily because of what reason?
- Access points cannot store more than 255 MAC addresses
- MAC addresses are transmitted in cleartext and can be spoofed by an attacker (Correct answer)
- MAC filtering disables WPA2 CCMP encryption
- Modern operating systems randomize MACs every connection
Correct answer: MAC addresses are transmitted in cleartext and can be spoofed by an attacker
MAC addresses are visible in plaintext 802.11 frame headers even on encrypted networks, allowing attackers to clone an authorized MAC using freely available tools.
Question 7: A WIDS alert indicates 'beacon flooding' on the wireless network. What is the primary impact of this attack?
- Exhaustion of DHCP address pool
- Denial of service by overwhelming client scanning queues with thousands of fake SSIDs (Correct answer)
- Capture of WPA2 4-way handshakes from all clients
- Forced downgrade from WPA3 to WPA2
Correct answer: Denial of service by overwhelming client scanning queues with thousands of fake SSIDs
Beacon flooding generates thousands of fake SSID beacons, overwhelming the scanning and display capabilities of wireless clients and potentially causing DoS conditions.
CNDA Wireless Network Security 2
WPS PIN authentication was deprecated primarily because of which vulnerability?