CWS CWS WLAN Security Concepts 4 — Questions and Answers
Question 1: In WPA2-Enterprise, what cryptographic protocol protects the data frame payload over the air?
- RC4 stream cipher with TKIP
- CCMP based on AES in counter mode with CBC-MAC (Correct answer)
- DES-CBC with 56-bit keys
- MD5 HMAC with 128-bit seed
Correct answer: CCMP based on AES in counter mode with CBC-MAC
WPA2-Enterprise mandates CCMP (Counter Mode CBC-MAC Protocol) using AES-128 to provide both confidentiality and data integrity for wireless frames.
Question 2: A security analyst finds clients connecting to an AP with a stronger signal but no certificate validation prompt. What attack is most likely occurring?
- MAC spoofing
- Beacon stuffing
- SSL stripping on wired side
- Evil twin AP with no server cert validation by clients (Correct answer)
Correct answer: Evil twin AP with no server cert validation by clients
An evil twin AP can impersonate the legitimate AP and, if clients do not validate server certificates, successfully intercept EAP credentials or traffic.
Question 3: What is the role of the Pairwise Master Key (PMK) in WPA2 authentication?
- It is used directly to encrypt data frames
- It serves as the seed from which the PTK is derived via the four-way handshake (Correct answer)
- It replaces the pre-shared key for WPA3 networks
- It is broadcast in beacon frames to identify the network
Correct answer: It serves as the seed from which the PTK is derived via the four-way handshake
The PMK is derived from the PSK or EAP authentication and is used during the four-way handshake to derive the Pairwise Transient Key (PTK) used for encrypting data.
Question 4: Which WLAN attack specifically targets the WPS PIN feature?
- Pixie Dust attack (Correct answer)
- Deauth flood
- PMKID offline crack
- ARP poisoning
Correct answer: Pixie Dust attack
The Pixie Dust attack exploits weak nonce generation in certain WPS implementations to recover the WPS PIN and subsequently the WPA2 passphrase offline.
Question 5: In a CWS context, what does the term 'RF jamming' describe as a wireless threat?
- An attacker injecting malformed 802.11 frames to crash APs
- Deliberate interference on the wireless spectrum to cause a denial of service (Correct answer)
- ARP broadcast storms on the wired uplink
- Sending oversized EAP identity responses
Correct answer: Deliberate interference on the wireless spectrum to cause a denial of service
RF jamming is a physical-layer DoS attack where a device transmits interference signals on the same frequency band, disrupting legitimate wireless communications.
Question 6: Which feature of WPA3-Personal provides protection even if the Wi-Fi password is later compromised?
- Opportunistic Wireless Encryption (OWE)
- AES-256 key length
- Forward secrecy through SAE (Correct answer)
- PMKID elimination
Correct answer: Forward secrecy through SAE
WPA3-Personal's SAE handshake generates unique session keys, so compromising the password after the fact cannot decrypt previously captured traffic.
Question 7: What is Opportunistic Wireless Encryption (OWE) designed to protect?
- Enterprise networks requiring RADIUS authentication
- Open networks by providing unauthenticated but encrypted connections (Correct answer)
- WPA3-Personal SAE handshake negotiation
- Management frame integrity in dense deployments
Correct answer: Open networks by providing unauthenticated but encrypted connections
OWE (defined in 802.11-2016 and used in Wi-Fi Enhanced Open) encrypts open network traffic without requiring a password, protecting against passive eavesdropping.
CWS CWS WLAN Security Concepts 4
In WPA2-Enterprise, what cryptographic protocol protects the data frame payload over the air?