CNDA Wireless Network Security 2

Question 1

WPS PIN authentication was deprecated primarily because of which vulnerability?

Accepted Answer

PINs could be brute-forced in under 11,000 attempts due to split-PIN validation

Answer

WPS validates the PIN in two halves independently, reducing the brute-force space from 10^8 to roughly 11,000 attempts, making it trivially crackable with tools like Reaver.

Question 2

The KRACK (Key Reinstallation Attack) vulnerability targeted which phase of the WPA2 protocol?

Accepted Answer

The 4-way handshake nonce and key reinstallation

Answer

KRACK manipulates the 4-way handshake to force nonce reuse by replaying handshake messages, allowing attackers to decrypt, replay, or forge frames.

Question 3

A network architect wants to isolate guest Wi-Fi users from the corporate LAN. Which design approach is most effective?

Accepted Answer

Assign guest users to a separate VLAN with ACLs blocking internal subnets

Answer

Placing guest users in a dedicated VLAN with ACLs preventing access to corporate subnets provides network-layer isolation independent of AP configuration.

Question 4

Which EAP method provides mutual authentication using digital certificates on both the client and the server?

Accepted Answer

EAP-TLS

Answer

EAP-TLS requires both the authentication server and the client to present valid X.509 certificates, providing strong mutual authentication.

Question 5

During a wireless site survey, a security architect discovers overlapping channels 1, 6, and 11 in the 2.4 GHz band being used correctly. Why are these specific channels chosen?

Accepted Answer

They are the only three non-overlapping channels in 2.4 GHz

Answer

In the 2.4 GHz band, only channels 1, 6, and 11 are non-overlapping (in the US), preventing co-channel interference between adjacent access points.

CNDA - Certified Network Defense Architect Practice Test

CNDA - Certified Network Defense Architect Practice Test

CNDA Wireless Network Security 2