CompTIA Network+ Network+ Wireless Security Protocols 3 — Questions and Answers
Question 1: Which EAP method uses mutual certificate-based authentication between the client and the RADIUS server?
- EAP-TLS (Correct answer)
- EAP-MD5
- LEAP
- PEAP-MSCHAPv2
Correct answer: EAP-TLS
EAP-TLS requires both the client and server to present digital certificates, providing strong mutual authentication.
Question 2: A wireless technician notices that a rogue access point is broadcasting the same SSID as the corporate network. What type of attack is this?
- Evil twin (Correct answer)
- De-authentication flood
- WPS brute force
- KRACK
Correct answer: Evil twin
An evil twin attack uses a fraudulent AP with the same SSID to trick clients into associating with the attacker's device.
Question 3: Which WPS attack method allows an attacker to recover the WPS PIN through repeated authentication attempts exploiting a design flaw?
- Pixie Dust / online PIN brute force (Correct answer)
- De-auth flood
- ARP poisoning
- SSID spoofing
Correct answer: Pixie Dust / online PIN brute force
WPS PIN brute-force exploits the fact that the 8-digit PIN is validated in two halves, reducing the keyspace to about 11,000 combinations.
Question 4: What does 802.1X provide in a wireless network deployment?
- Port-based Network Access Control (NAC) (Correct answer)
- Frequency channel selection
- SSID encryption
- Antenna gain configuration
Correct answer: Port-based Network Access Control (NAC)
802.1X provides port-based NAC, requiring clients to authenticate before being granted network access.
Question 5: Which of the following BEST describes the purpose of a wireless IDS (WIDS)?
- Detect rogue APs and unauthorized wireless activity (Correct answer)
- Assign IP addresses to wireless clients
- Balance load across multiple access points
- Encrypt wireless management frames
Correct answer: Detect rogue APs and unauthorized wireless activity
A WIDS monitors the RF environment to identify rogue APs, unauthorized clients, and wireless attack patterns.
Question 6: Management Frame Protection (MFP/802.11w) is designed to defend against which type of attack?
- De-authentication/disassociation flooding (Correct answer)
- WEP IV collision
- RADIUS dictionary attack
- DNS spoofing
Correct answer: De-authentication/disassociation flooding
802.11w protects management frames (including de-auth and disassoc frames) with cryptographic integrity to prevent spoofed disconnects.
Question 7: A network admin wants to ensure that only specific devices can connect to the wireless network based on hardware addresses. Which control is being used?
- MAC address filtering (Correct answer)
- SSID cloaking
- WEP encryption
- TKIP
Correct answer: MAC address filtering
MAC address filtering allows or denies wireless association based on a device's hardware (MAC) address.
CompTIA Network+ Network+ Wireless Security Protocols 3
Which EAP method uses mutual certificate-based authentication between the client and the RADIUS server?