CWS Risk Assessment & Mitigation 2 — Questions and Answers
Question 1: A company discovers its Wi-Fi network is vulnerable to a KRACK attack. Which layer of the OSI model is primarily targeted by this exploit?
- Physical layer
- Data Link layer (Correct answer)
- Network layer
- Transport layer
Correct answer: Data Link layer
KRACK (Key Reinstallation Attack) targets the 4-way handshake process at the Data Link layer (Layer 2) of the OSI model, specifically the WPA2 protocol.
Question 2: During a wireless risk assessment, an analyst identifies multiple APs broadcasting SSIDs with default manufacturer names. What is the primary risk this represents?
- Signal interference with neighboring networks
- Attackers can easily identify the hardware vendor and exploit known default credentials (Correct answer)
- Reduced wireless coverage area
- Increased beacon frame traffic
Correct answer: Attackers can easily identify the hardware vendor and exploit known default credentials
Default SSIDs reveal the hardware manufacturer, allowing attackers to look up default credentials and known vulnerabilities for that specific device.
Question 3: Which mitigation technique is MOST effective against a rogue AP that is mimicking a legitimate corporate SSID?
- Increasing transmit power of legitimate APs
- Implementing 802.1X authentication with mutual certificate verification (Correct answer)
- Changing the corporate SSID to a unique name
- Enabling MAC address filtering
Correct answer: Implementing 802.1X authentication with mutual certificate verification
802.1X with mutual certificate verification requires both the client and server to authenticate each other, preventing clients from connecting to rogue APs that cannot present a valid certificate.
Question 4: A wireless penetration tester uses a tool to capture the PMKID from a WPA2 network without requiring any client to be connected. What type of attack does this enable?
- Deauthentication flood attack
- Offline dictionary/brute-force attack against the PSK (Correct answer)
- Man-in-the-middle session hijacking
- ARP poisoning attack
Correct answer: Offline dictionary/brute-force attack against the PSK
The PMKID is derived from the PMK (which is based on the PSK), allowing an attacker to perform offline brute-force or dictionary attacks against the pre-shared key without needing a connected client.
Question 5: What is the purpose of a wireless honeypot in a risk mitigation strategy?
- To increase network throughput for legitimate users
- To lure and detect attackers while gathering threat intelligence (Correct answer)
- To block all unauthorized wireless devices
- To encrypt all wireless traffic automatically
Correct answer: To lure and detect attackers while gathering threat intelligence
A wireless honeypot attracts attackers to a decoy network, allowing security teams to detect intrusion attempts and gather intelligence about attack methods and attacker behavior.
Question 6: In a risk assessment, the likelihood of a denial-of-service attack via 802.11 deauthentication frames is rated HIGH. Which control BEST mitigates this specific risk?
- Deploying WPA3 with Protected Management Frames (PMF) (Correct answer)
- Using WPA2-Enterprise with RADIUS
- Enabling band steering
- Implementing SSID cloaking
Correct answer: Deploying WPA3 with Protected Management Frames (PMF)
WPA3 mandates Protected Management Frames (PMF/802.11w), which cryptographically protects deauthentication and disassociation frames, preventing spoofed deauth attacks.
Question 7: A risk assessment reveals that an organization's wireless network lacks segmentation between IoT devices and corporate workstations. What is the MOST significant risk this creates?
- Reduced Wi-Fi signal strength
- Lateral movement from a compromised IoT device to sensitive corporate systems (Correct answer)
- Increased IP address consumption
- Higher wireless channel contention
Correct answer: Lateral movement from a compromised IoT device to sensitive corporate systems
Without network segmentation, a compromised IoT device can be used as a pivot point to laterally move and attack more sensitive corporate systems on the same network.
CWS Risk Assessment & Mitigation 2
A company discovers its Wi-Fi network is vulnerable to a KRACK attack.
Which layer of the OSI model is primarily targeted by this exploit?