CWNA Risk Assessment & Management 5

Question 1

Which NIST publication provides a framework specifically for information security risk management that is commonly referenced in wireless security risk assessments?

Accepted Answer

NIST SP 800-30

Answer

NIST SP 800-30 'Guide for Conducting Risk Assessments' provides the foundational process for identifying, analyzing, and responding to information security risks.

Question 2

During a post-incident review, the security team finds that an attacker used a Karma attack to compromise a remote employee's device. What makes Karma attacks particularly effective?

Accepted Answer

Karma attacks respond to any probe request, impersonating any SSID a client searches for

Answer

In a Karma attack, a rogue AP responds to all probe requests from clients looking for previously connected networks, tricking devices into auto-connecting to the attacker's AP.

Question 3

An organization uses a risk scoring system where likelihood and impact are each rated 1-5. A newly discovered wireless vulnerability scores 5/5 on impact but 1/5 on likelihood. How should this risk be documented?

Accepted Answer

Scored as risk level 5 (5×1) and tracked in the risk register with periodic review

Answer

A 5×1 = 5 risk score should be documented in the risk register with appropriate oversight; the low likelihood doesn't eliminate the need to track and periodically reassess the risk.

Question 4

A wireless network assessment identifies that clients are using outdated EAP-MD5 for 802.1X authentication. What is the primary security risk of EAP-MD5?

Accepted Answer

EAP-MD5 does not provide mutual authentication and is vulnerable to offline dictionary attacks

Answer

EAP-MD5 only authenticates the client (not the server), making it vulnerable to man-in-the-middle attacks, and its MD5-hashed credentials are susceptible to offline dictionary and brute-force attacks.

Question 5

A risk assessment identifies that RF signals from a corporate WLAN extend 200 feet beyond the building perimeter. What is the most appropriate initial risk mitigation?

Accepted Answer

Adjusting transmit power and antenna placement to minimize signal leakage

Answer

Reducing transmit power and optimizing antenna placement is the most practical and direct mitigation to minimize RF signal spillage beyond the intended coverage area.

CWNA - Wireless Network Administrator Practice Test

CWNA - Wireless Network Administrator Practice Test

CWNA Risk Assessment & Management 5