CWS CWS WLAN Security Concepts 3 — Questions and Answers
Question 1: What is a PMKID attack and why is it more dangerous than a traditional handshake capture attack?
- It requires a deauth packet to force client reconnection
- It requires capturing a full four-way handshake
- It can be performed without any connected clients by capturing a single EAPOL frame from the AP (Correct answer)
- It only works against WEP networks
Correct answer: It can be performed without any connected clients by capturing a single EAPOL frame from the AP
A PMKID attack extracts the PMKID from a single EAPOL frame sent by the AP, enabling offline cracking without needing an active client connection.
Question 2: In 802.1X authentication, what is the role of the supplicant?
- The device granting network access after RADIUS approval
- The RADIUS server validating credentials
- The client device requesting network access (Correct answer)
- The AP acting as a policy enforcement point
Correct answer: The client device requesting network access
The supplicant is the client device (e.g., laptop or phone) that requests access to the network and provides credentials during 802.1X authentication.
Question 3: Which countermeasure directly addresses the threat of deauthentication flood attacks?
- WPA2-TKIP upgrade
- Enabling 802.11w (Management Frame Protection) (Correct answer)
- Switching from RADIUS to LDAP
- Increasing beacon intervals
Correct answer: Enabling 802.11w (Management Frame Protection)
802.11w protects unicast management frames including deauthentication and disassociation frames from being forged by an attacker.
Question 4: A wireless network uses EAP-PEAP. Which credential type does the inner authentication typically verify?
- Client X.509 certificate
- Username and password (MSCHAPv2) (Correct answer)
- Pre-shared key
- One-time token only
Correct answer: Username and password (MSCHAPv2)
PEAP typically uses MSCHAPv2 as the inner authentication method, verifying username and password inside a TLS tunnel established by the server certificate.
Question 5: What is the key difference between an ad-hoc (IBSS) network and an infrastructure (BSS) network from a security perspective?
- IBSS networks support WPA3 natively
- IBSS networks lack a central AP to enforce security policies (Correct answer)
- Infrastructure networks cannot use 802.1X
- Ad-hoc networks require a RADIUS server
Correct answer: IBSS networks lack a central AP to enforce security policies
Ad-hoc networks operate peer-to-peer without an AP, making centralized security policy enforcement impossible and increasing risk.
Question 6: Which protocol is used to securely tunnel EAP authentication between the wireless AP (authenticator) and the RADIUS server?
- LDAP over TLS
- RADIUS over UDP with shared secret (Correct answer)
- TACACS+ over TCP with full encryption
- Diameter over SCTP
Correct answer: RADIUS over UDP with shared secret
RADIUS communicates between the AP and authentication server over UDP, protecting the payload with MD5 hashing and a shared secret (though RADSEC/TLS is more secure).
Question 7: What security risk is introduced when clients auto-connect to remembered SSIDs?
- WPA3 downgrade to WPA
- Susceptibility to evil twin or karma attacks from rogue APs broadcasting the saved SSID (Correct answer)
- Increased beacon collision
- DHCP exhaustion
Correct answer: Susceptibility to evil twin or karma attacks from rogue APs broadcasting the saved SSID
When a device probes for known SSIDs or auto-connects to any matching SSID, a rogue AP broadcasting that SSID can intercept the connection.
CWS CWS WLAN Security Concepts 3
What is a PMKID attack and why is it more dangerous than a traditional handshake capture attack?