CVA CVA Wireless & Mobile Security Assessment 2

Question 1

What is a 'rogue access point' and what risk does it present in an enterprise wireless assessment?

Accepted Answer

An unauthorized wireless access point installed on the network that bypasses security controls, creating an unmonitored entry point

Answer

Rogue access points are unauthorized APs connected to the corporate network — intentionally or by employees for convenience — creating unmonitored network entry points that bypass perimeter security.

Question 2

During a mobile application assessment, what is the risk of 'improper certificate validation' (certificate pinning bypass)?

Accepted Answer

The application accepts invalid or attacker-controlled TLS certificates, enabling man-in-the-middle interception of encrypted traffic

Answer

Improper certificate validation or absent certificate pinning allows attackers to intercept HTTPS traffic by presenting forged or attacker-controlled certificates to the mobile application.

Question 3

What is 'Bluetooth Low Energy (BLE) sniffing' and why is it assessed during wireless security testing?

Accepted Answer

Intercepting BLE communications between devices to analyze unencrypted data transmissions or protocol weaknesses

Answer

BLE sniffing captures communications between BLE devices, revealing unencrypted data, authentication mechanisms, and potential vulnerabilities in IoT devices, wearables, and access controls.

Question 4

In mobile application testing, what does 'reverse engineering the APK' allow an assessor to identify?

Accepted Answer

Hardcoded credentials, API keys, insecure cryptographic implementations, and application logic flaws within the decompiled source code

Answer

Reverse engineering an APK using tools like jadx or apktool reveals decompiled source code where hardcoded secrets, API keys, insecure logic, and cryptographic weaknesses can be discovered.

Question 5

What does 'WPS (Wi-Fi Protected Setup) brute force' target and why is it a significant wireless vulnerability?

Accepted Answer

The 8-digit WPS PIN, which due to its split validation design is vulnerable to brute force in approximately 11,000 attempts rather than 100 million

Answer

WPS PIN validation occurs in two halves of 4 digits each, reducing the effective keyspace to ~11,000 combinations; successful brute force reveals the full WPA2 PSK regardless of its complexity.

(CVA) Certified Vulnerability Assessor Practice Test

(CVA) Certified Vulnerability Assessor Practice Test

CVA CVA Wireless & Mobile Security Assessment 2