CWS Wireless Security & Troubleshooting Techniques 2 — Questions and Answers
Question 1: A network admin notices clients frequently deauthenticating from the WLAN. Which tool would BEST help identify whether a deauthentication attack is occurring?
- Ping sweep
- Wireless protocol analyzer (packet capture) (Correct answer)
- SNMP MIB browser
- Cable tester
Correct answer: Wireless protocol analyzer (packet capture)
A wireless protocol analyzer can capture 802.11 management frames and reveal illegitimate deauthentication frames from a rogue source.
Question 2: Which 802.11 frame type is exploited in a deauthentication flood attack?
- Data frames
- Control frames (RTS/CTS)
- Management frames (Correct answer)
- Beacon frames only
Correct answer: Management frames
Deauthentication packets are 802.11 management frames, and because they were historically unprotected, attackers can spoof them to disconnect clients.
Question 3: PMF (Protected Management Frames) as defined in 802.11w primarily defends against which attack vector?
- WEP key cracking
- Evil twin APs
- Spoofed deauthentication/disassociation frames (Correct answer)
- TKIP replay attacks
Correct answer: Spoofed deauthentication/disassociation frames
802.11w cryptographically protects unicast and broadcast management frames, preventing an attacker from forging deauth/disassoc packets.
Question 4: A user in a warehouse reports intermittent drops every ~20 minutes. The admin finds the AP association log shows the client reassociating repeatedly. What is the MOST likely cause?
- WPA2 four-way handshake failure
- Client roaming aggressiveness set too low causing sticky client behavior (Correct answer)
- DHCP lease expiration mismatch
- Hidden SSID preventing reconnection
Correct answer: Client roaming aggressiveness set too low causing sticky client behavior
A sticky client holds onto a distant AP instead of roaming to a closer one, causing signal degradation and eventual disconnection, then reconnection.
Question 5: Which EAP method uses a server-side certificate and a client-side certificate (mutual TLS) for authentication?
- EAP-LEAP
- EAP-FAST
- EAP-TLS (Correct answer)
- PEAP-MSCHAPv2
Correct answer: EAP-TLS
EAP-TLS requires both the RADIUS server and the supplicant to present X.509 certificates, providing mutual authentication.
Question 6: An 802.1X-secured WLAN is failing to authenticate users. The RADIUS server log shows 'unknown CA.' What is the MOST likely fix?
- Increase the RADIUS timeout value on the AP
- Install the correct CA certificate in the supplicant's trust store (Correct answer)
- Switch from WPA2-Enterprise to WPA3-Personal
- Disable SSID broadcast
Correct answer: Install the correct CA certificate in the supplicant's trust store
The 'unknown CA' error means the client does not trust the certificate authority that signed the RADIUS server's certificate; adding the CA cert to the client resolves this.
Question 7: A CWS technician is performing a site survey and discovers an SSID broadcasting the same name as the corporate network but with a stronger signal. This is BEST described as:
- A co-channel interference source
- An evil twin AP (Correct answer)
- A misconfigured guest VLAN
- A hidden SSID
Correct answer: An evil twin AP
An evil twin AP mimics a legitimate SSID with higher power to lure clients into connecting to a rogue access point.
CWS Wireless Security & Troubleshooting Techniques 2
A network admin notices clients frequently deauthenticating from the WLAN.
Which tool would BEST help identify whether a deauthentication attack is occurring?