CWS Risk Assessment & Mitigation 3 — Questions and Answers
Question 1: During a site survey, an analyst detects a wireless client probe-requesting an SSID named 'Free_Airport_WiFi' in a corporate office. What security concern does this indicate?
- The client device is malfunctioning
- The client is vulnerable to an evil twin attack targeting that remembered network (Correct answer)
- The corporate Wi-Fi password needs to be changed
- The wireless infrastructure has insufficient coverage
Correct answer: The client is vulnerable to an evil twin attack targeting that remembered network
Probe requests for remembered SSIDs allow nearby attackers to create a matching evil twin AP that the client may automatically connect to, bypassing user awareness.
Question 2: Which of the following BEST describes the risk associated with using WPS PIN authentication on a wireless router?
- WPS PIN is vulnerable to online brute-force due to a design flaw splitting the PIN into two halves (Correct answer)
- WPS PIN exposes the SSID in plaintext during setup
- WPS PIN disables WPA2 encryption temporarily
- WPS PIN allows any device to bypass MAC filtering
Correct answer: WPS PIN is vulnerable to online brute-force due to a design flaw splitting the PIN into two halves
The WPS PIN has a design flaw where it is validated in two separate halves (4+3 digits), reducing the effective keyspace from 10^7 to about 11,000 combinations, making it trivially brute-forceable.
Question 3: A risk assessment identifies that wireless clients in a hospital are using open (unencrypted) Wi-Fi to access the EHR system via HTTPS. Which residual risk remains even with HTTPS?
- Patient data is unprotected because HTTPS cannot work on open Wi-Fi
- SSL stripping attacks can downgrade HTTPS connections if HSTS is not implemented (Correct answer)
- Open Wi-Fi prevents authentication to the EHR system
- HTTPS certificates are invalid on open networks
Correct answer: SSL stripping attacks can downgrade HTTPS connections if HSTS is not implemented
Without HSTS (HTTP Strict Transport Security), a man-in-the-middle attacker on the open network can perform SSL stripping to downgrade HTTPS connections to unencrypted HTTP.
Question 4: What is the primary risk of using a shared PSK (pre-shared key) for a large number of employees on a corporate wireless network?
- PSKs cannot support more than 50 simultaneous connections
- A single compromised employee exposes the entire network, and rekeying requires updating all devices (Correct answer)
- PSK authentication is slower than 802.1X authentication
- PSKs are incompatible with WPA3 encryption
Correct answer: A single compromised employee exposes the entire network, and rekeying requires updating all devices
With a shared PSK, one compromised credential exposes the entire network, and rotating the key requires reconfiguring every device, making credential management operationally challenging.
Question 5: An organization wants to assess the risk from nearby competing businesses' Wi-Fi networks. What specific threat should they evaluate?
- Accidental client association to neighboring networks exposing corporate traffic (Correct answer)
- Physical theft of wireless access points by competitors
- Competitors deliberately jamming their wireless frequency
- Neighboring networks increasing DNS query response times
Correct answer: Accidental client association to neighboring networks exposing corporate traffic
Accidental association occurs when corporate devices connect to similarly named or open neighboring networks, potentially exposing sensitive data to untrusted networks.
Question 6: Which risk mitigation approach is MOST appropriate when wireless communication is required in an environment with significant RF interference and jamming threats?
- Increasing the number of access points deployed
- Using frequency hopping spread spectrum (FHSS) or direct sequence spread spectrum (DSSS) techniques (Correct answer)
- Switching from 5 GHz to 2.4 GHz band
- Reducing transmit power of all access points
Correct answer: Using frequency hopping spread spectrum (FHSS) or direct sequence spread spectrum (DSSS) techniques
FHSS and DSSS spread signals across multiple frequencies, making them resilient to narrow-band jamming and interference because they don't rely on a single channel.
Question 7: A CWS candidate is reviewing a wireless risk register. An identified risk has a HIGH impact but VERY LOW likelihood. How should this risk typically be prioritized?
- Addressed immediately with maximum resources regardless of cost
- Accepted or monitored with contingency plans, as risk score may be medium (Correct answer)
- Ignored since likelihood is low
- Transferred to an insurance policy before any assessment
Correct answer: Accepted or monitored with contingency plans, as risk score may be medium
Risk prioritization uses both impact and likelihood; a high impact but very low likelihood risk typically results in a medium risk score, warranting monitoring and contingency planning rather than immediate maximum investment.
CWS Risk Assessment & Mitigation 3
During a site survey, an analyst detects a wireless client probe-requesting an SSID named 'Free_Airport_WiFi' in a corporate office.
What security concern does this indicate?