CWS CWS WLAN Security Concepts 5 — Questions and Answers
Question 1: Which WLAN security protocol was deprecated due to its use of RC4 and a 24-bit initialization vector?
- WPA2-CCMP
- WPA-TKIP
- WEP (Wired Equivalent Privacy) (Correct answer)
- WPA3-SAE
Correct answer: WEP (Wired Equivalent Privacy)
WEP is critically flawed because its 24-bit IV is too short, leading to IV reuse, and RC4 is vulnerable to statistical attacks that can recover the key in minutes.
Question 2: An organization wants to allow guest Wi-Fi access without exposing internal resources. Which architecture best achieves this?
- A single SSID with MAC filtering for guests
- Separate guest SSID mapped to an isolated VLAN with firewall rules (Correct answer)
- WEP for the guest network and WPA2 for internal
- Disabling DHCP on the guest SSID
Correct answer: Separate guest SSID mapped to an isolated VLAN with firewall rules
A separate guest SSID on an isolated VLAN with firewall policies ensures guests have internet access without any path to internal network resources.
Question 3: What does a wireless IDS/IPS do when it detects a rogue AP on the network?
- It sends a TCP RST to the rogue AP's upstream router
- It can alert administrators and/or use over-the-air deauthentication to contain the rogue AP (Correct answer)
- It automatically reconfigures RADIUS to block the rogue AP's MAC
- It disables the nearest legitimate AP to isolate the rogue
Correct answer: It can alert administrators and/or use over-the-air deauthentication to contain the rogue AP
A WIDS/WIPS can alert staff and, through automated containment, send spoofed deauth frames to disconnect clients from the rogue AP.
Question 4: In the context of WLAN security, what is a 'disassociation attack'?
- A physical attack severing the Ethernet uplink of an AP
- Sending forged disassociation frames to disconnect clients from the AP (Correct answer)
- Overloading the RADIUS server with authentication requests
- Injecting malformed beacon frames to confuse clients
Correct answer: Sending forged disassociation frames to disconnect clients from the AP
A disassociation attack sends spoofed 802.11 disassociation frames from the AP's MAC address, forcing clients to disconnect and potentially reconnect to a rogue AP.
Question 5: Which key hierarchy element is unique to each client-AP session and is used to derive the actual encryption and integrity keys?
- PMK (Pairwise Master Key)
- GMK (Group Master Key)
- PTK (Pairwise Transient Key) (Correct answer)
- PSK (Pre-Shared Key)
Correct answer: PTK (Pairwise Transient Key)
The PTK is derived from the PMK during the four-way handshake and is unique per session; it contains the TK, MIC keys, and EAPOL keys used for the session.
Question 6: Why is hiding an SSID (not broadcasting it in beacon frames) considered a weak security control?
- It prevents clients from ever connecting to the network
- Hidden SSIDs still appear in probe requests and responses, making them easily discoverable with passive scanning tools (Correct answer)
- It causes compatibility issues only with Android devices
- It reduces throughput by removing beacon overhead
Correct answer: Hidden SSIDs still appear in probe requests and responses, making them easily discoverable with passive scanning tools
Clients actively probe for hidden SSIDs by name, and those probe requests are visible to anyone performing passive wireless scanning, revealing the hidden SSID.
Question 7: A CWS candidate reviews a WLAN deployment using WPA2-Enterprise with PEAP-MSCHAPv2. What critical client-side configuration is required to prevent credential theft?
- Disabling automatic reconnection to the SSID
- Validating the RADIUS server's certificate and pinning the CA (Correct answer)
- Enabling MAC address randomization on client devices
- Configuring static IP addresses instead of DHCP
Correct answer: Validating the RADIUS server's certificate and pinning the CA
Without validating the RADIUS server certificate on the client, an attacker running a rogue RADIUS server can intercept MSCHAPv2 credentials via a man-in-the-middle attack.
CWS CWS WLAN Security Concepts 5
Which WLAN security protocol was deprecated due to its use of RC4 and a 24-bit initialization vector?