CVA CVA Wireless & Mobile Security Assessment 2 — Questions and Answers
Question 1: What is a 'rogue access point' and what risk does it present in an enterprise wireless assessment?
- A misconfigured enterprise AP with incorrect VLAN settings
- An unauthorized wireless access point installed on the network that bypasses security controls, creating an unmonitored entry point (Correct answer)
- An access point with outdated firmware
- An access point that exceeds recommended signal strength
Correct answer: An unauthorized wireless access point installed on the network that bypasses security controls, creating an unmonitored entry point
Rogue access points are unauthorized APs connected to the corporate network — intentionally or by employees for convenience — creating unmonitored network entry points that bypass perimeter security.
Question 2: During a mobile application assessment, what is the risk of 'improper certificate validation' (certificate pinning bypass)?
- The application cannot connect to the backend server
- The application accepts invalid or attacker-controlled TLS certificates, enabling man-in-the-middle interception of encrypted traffic (Correct answer)
- The application's SSL certificates expire prematurely
- The application rejects legitimate certificates from trusted CAs
Correct answer: The application accepts invalid or attacker-controlled TLS certificates, enabling man-in-the-middle interception of encrypted traffic
Improper certificate validation or absent certificate pinning allows attackers to intercept HTTPS traffic by presenting forged or attacker-controlled certificates to the mobile application.
Question 3: What is 'Bluetooth Low Energy (BLE) sniffing' and why is it assessed during wireless security testing?
- Testing whether Bluetooth devices correctly implement power-saving modes
- Intercepting BLE communications between devices to analyze unencrypted data transmissions or protocol weaknesses (Correct answer)
- Monitoring Bluetooth signal strength for interference analysis
- Testing Bluetooth compatibility between different device manufacturers
Correct answer: Intercepting BLE communications between devices to analyze unencrypted data transmissions or protocol weaknesses
BLE sniffing captures communications between BLE devices, revealing unencrypted data, authentication mechanisms, and potential vulnerabilities in IoT devices, wearables, and access controls.
Question 4: In mobile application testing, what does 'reverse engineering the APK' allow an assessor to identify?
- The number of active users of the application
- Hardcoded credentials, API keys, insecure cryptographic implementations, and application logic flaws within the decompiled source code (Correct answer)
- The application's revenue model and monetization strategy
- The development framework and programming language used
Correct answer: Hardcoded credentials, API keys, insecure cryptographic implementations, and application logic flaws within the decompiled source code
Reverse engineering an APK using tools like jadx or apktool reveals decompiled source code where hardcoded secrets, API keys, insecure logic, and cryptographic weaknesses can be discovered.
Question 5: What does 'WPS (Wi-Fi Protected Setup) brute force' target and why is it a significant wireless vulnerability?
- The WPA2 Pre-Shared Key directly through exhaustive search
- The 8-digit WPS PIN, which due to its split validation design is vulnerable to brute force in approximately 11,000 attempts rather than 100 million (Correct answer)
- The WPA2 4-way handshake nonces
- The wireless management frame authentication
Correct answer: The 8-digit WPS PIN, which due to its split validation design is vulnerable to brute force in approximately 11,000 attempts rather than 100 million
WPS PIN validation occurs in two halves of 4 digits each, reducing the effective keyspace to ~11,000 combinations; successful brute force reveals the full WPA2 PSK regardless of its complexity.
Question 6: During a wireless assessment, you identify an access point broadcasting WEP. Why is this considered a critical vulnerability?
- WEP uses outdated hardware incompatible with modern devices
- WEP's RC4 implementation has fundamental cryptographic weaknesses that allow the encryption key to be recovered in minutes using passive traffic capture (Correct answer)
- WEP does not support 5GHz bands
- WEP requires manual key rotation which is rarely performed
Correct answer: WEP's RC4 implementation has fundamental cryptographic weaknesses that allow the encryption key to be recovered in minutes using passive traffic capture
WEP's RC4 implementation reuses initialization vectors, allowing statistical analysis of captured packets to recover the encryption key in minutes using tools like aircrack-ng.
CVA CVA Wireless & Mobile Security Assessment 2
What is a 'rogue access point' and what risk does it present in an enterprise wireless assessment?