CWNA Wireless Security & Authentication 2 — Questions and Answers
Question 1: What type of attack involves an attacker setting up a rogue AP with the same SSID as a legitimate network to intercept traffic?
- Replay attack
- Evil twin attack (Correct answer)
- War driving
- Bluejacking
Correct answer: Evil twin attack
An evil twin attack creates a rogue AP mimicking a legitimate SSID, tricking clients into associating and allowing the attacker to intercept traffic.
Question 2: Which EAP method uses TLS tunnels and does NOT require client-side digital certificates?
- EAP-TLS
- PEAP (Correct answer)
- LEAP
- EAP-FAST without PAC
Correct answer: PEAP
PEAP (Protected EAP) creates an encrypted TLS tunnel using only a server certificate, then authenticates the client with credentials inside the tunnel.
Question 3: What is the four-way handshake in WPA2 used to derive?
- The SSID and channel for the connection
- The Pairwise Transient Key (PTK) for unicast encryption (Correct answer)
- The RADIUS server IP address
- The DTIM interval for power saving
Correct answer: The Pairwise Transient Key (PTK) for unicast encryption
The four-way handshake between the client and AP derives the PTK from the PMK, ANonce, SNonce, and MAC addresses for unicast frame encryption.
Question 4: Which 802.11 amendment introduced Management Frame Protection (MFP) to protect management frames from spoofing?
- 802.11i
- 802.11w (Correct answer)
- 802.11r
- 802.11e
Correct answer: 802.11w
802.11w introduced Management Frame Protection, cryptographically protecting certain management frames like deauthentication and disassociation.
Question 5: What does WIDS (Wireless Intrusion Detection System) primarily monitor for?
- Interference from microwave ovens
- Rogue APs, unauthorized clients, and attack signatures like deauth floods (Correct answer)
- Optimal channel selection for APs
- DNS resolution failures on wireless clients
Correct answer: Rogue APs, unauthorized clients, and attack signatures like deauth floods
WIDS scans the RF environment to detect rogue APs, unauthorized associations, and patterns indicative of wireless attacks.
Question 6: Which security protocol is considered completely broken and should never be used in a modern wireless deployment?
- WPA3-Personal
- WPA2-Enterprise with EAP-TLS
- WEP (Correct answer)
- WPA2-Personal with AES-CCMP
Correct answer: WEP
WEP uses RC4 with static keys and weak IVs, making it trivially crackable in minutes; it is completely deprecated and must not be used.
CWNA Wireless Security & Authentication 2
What type of attack involves an attacker setting up a rogue AP with the same SSID as a legitimate network to intercept traffic?