Securing Network Connections Flashcards

A user is working from a public coffee shop and connects to the establishment's free Wi-Fi. To protect their data from being intercepted by others on the same network, which of the following is the MOST effective tool to use?

Answer: A Virtual Private Network (VPN)

A VPN creates an encrypted tunnel for your internet traffic, making it unreadable to anyone who might be snooping on the public Wi-Fi network. Antivirus protects against malware, a firewall blocks unauthorized network access to your device, and disabling SSID broadcast is a router setting not applicable to a client device on a public network.

Which of the following wireless security protocols is the most recent and offers the strongest protection by using Simultaneous Authentication of Equals (SAE) to prevent offline dictionary attacks?

Answer: WPA3

WPA3 is the latest Wi-Fi security standard and provides significant improvements over WPA2. One of its key features is the use of Simultaneous Authentication of Equals (SAE), which replaces the Pre-Shared Key (PSK) method found in WPA2, making it much more resilient to offline dictionary attacks where attackers try to guess the password.

An employee brings a personal wireless router from home and connects it to the company's network to get a better signal in their office. This unauthorized device is BEST described as a:

Answer: Rogue Access Point

A rogue access point is any wireless access point that has been installed on a secure network without explicit authorization from a local network administrator. This creates a significant security vulnerability because it bypasses the company's network security controls.

A network administrator wants to implement a security measure that restricts network access to only devices with specific hardware addresses. Which of the following should be configured?

Answer: MAC Filtering

MAC (Media Access Control) filtering is a security method that allows or denies network access to devices based on their unique MAC address. The administrator can create a list of approved MAC addresses (a whitelist) to ensure only authorized devices can connect.

Disabling the SSID broadcast on a wireless router is a security practice often referred to as 'network cloaking'. What is the primary security risk associated with this practice?

Answer: It causes client devices to actively broadcast the SSID, which can be captured by attackers.

When a network's SSID is hidden, devices configured to connect to it must actively probe or broadcast the SSID to find the network. This broadcast can be intercepted by an attacker, revealing the network's name and allowing them to set up a rogue access point to trick the user's device into connecting.

A user is at an airport and sees two Wi-Fi networks with the same name: 'AIRPORT_FREE_WIFI'. One is the legitimate network, and the other is a malicious network set up by an attacker to intercept data. This type of attack is known as:

Answer: A Man-in-the-Middle attack

This scenario describes a Man-in-the-Middle (MITM) attack, often executed using a rogue or 'evil twin' access point. The attacker positions themselves between the user and the legitimate network, intercepting, and potentially altering, the communication. By mimicking the legitimate Wi-Fi name, they trick users into connecting to their malicious hotspot.