CWS Wireless Security & Troubleshooting Techniques 2

Question 1

A network admin notices clients frequently deauthenticating from the WLAN. Which tool would BEST help identify whether a deauthentication attack is occurring?

Accepted Answer

Wireless protocol analyzer (packet capture)

Answer

A wireless protocol analyzer can capture 802.11 management frames and reveal illegitimate deauthentication frames from a rogue source.

Question 2

Which 802.11 frame type is exploited in a deauthentication flood attack?

Accepted Answer

Management frames

Answer

Deauthentication packets are 802.11 management frames, and because they were historically unprotected, attackers can spoof them to disconnect clients.

Question 3

PMF (Protected Management Frames) as defined in 802.11w primarily defends against which attack vector?

Accepted Answer

Spoofed deauthentication/disassociation frames

Answer

802.11w cryptographically protects unicast and broadcast management frames, preventing an attacker from forging deauth/disassoc packets.

Question 4

A user in a warehouse reports intermittent drops every ~20 minutes. The admin finds the AP association log shows the client reassociating repeatedly. What is the MOST likely cause?

Accepted Answer

Client roaming aggressiveness set too low causing sticky client behavior

Answer

A sticky client holds onto a distant AP instead of roaming to a closer one, causing signal degradation and eventual disconnection, then reconnection.

Question 5

Which EAP method uses a server-side certificate and a client-side certificate (mutual TLS) for authentication?

Accepted Answer

EAP-TLS

Answer

EAP-TLS requires both the RADIUS server and the supplicant to present X.509 certificates, providing mutual authentication.

(CWS) Certified Wireless Specialist Practice Test

(CWS) Certified Wireless Specialist Practice Test

CWS Wireless Security & Troubleshooting Techniques 2