CWNA Risk Assessment & Management 4

Question 1

A security team performs a wireless vulnerability scan and finds that several APs still support TKIP. Why does TKIP represent a security risk in modern wireless networks?

Accepted Answer

TKIP is vulnerable to known cryptographic weaknesses including the Beck-Tews attack

Answer

TKIP was found vulnerable to the Beck-Tews and Ohigashi-Morii attacks, which can decrypt and inject short packets, making it insecure compared to AES-CCMP.

Question 2

During a wireless risk assessment, what does the term 'threat vector' specifically describe?

Accepted Answer

The path or method an attacker uses to gain unauthorized access

Answer

A threat vector is the specific path or mechanism through which a threat actor can exploit a vulnerability to cause harm to an asset.

Question 3

A WIPS alert fires when a station associates with an AP outside the approved vendor OUI list. This is an example of which security approach?

Accepted Answer

Anomaly-based detection

Answer

Anomaly-based detection identifies deviations from a defined baseline (like approved OUI lists), flagging behavior that differs from the norm rather than matching known attack signatures.

Question 4

A hospital wireless network handles PHI (Protected Health Information). Which regulation most directly governs risk assessment requirements for this wireless infrastructure?

Accepted Answer

HIPAA Security Rule

Answer

The HIPAA Security Rule (45 CFR § 164.308) explicitly requires covered entities to conduct an accurate and thorough assessment of potential risks to the confidentiality, integrity, and availability of ePHI.

Question 5

An attacker sets up a high-power AP with the same SSID as the corporate network to lure clients. From a risk framework perspective, this is classified as which type of threat?

Accepted Answer

Man-in-the-middle via evil twin AP

Answer

An evil twin attack uses a rogue AP with a legitimate-appearing SSID to intercept traffic, placing the attacker in the middle of communications between the client and the real network.

CWNA - Wireless Network Administrator Practice Test

CWNA - Wireless Network Administrator Practice Test

CWNA Risk Assessment & Management 4