CWS Wireless Security & Troubleshooting Techniques 5

Question 1

A CWS technician configures a captive portal for a guest WLAN. After connecting, guests receive an IP but are never redirected to the portal page. What is the MOST likely cause?

Accepted Answer

DNS not resolving hostnames so the HTTP redirect cannot be triggered

Answer

Incorrect WPA2 passphrase on the guest SSID

Answer

AP transmit power too low

Answer

RADIUS timeout on the guest VLAN

Question 2

Which metric BEST indicates whether a wireless client will experience high data rates: RSSI alone or SNR?

Accepted Answer

SNR, because throughput depends on signal quality relative to noise, not just signal strength

Answer

RSSI alone, because higher signal always means better throughput

Answer

Neither; only channel width determines data rates

Answer

Channel utilization percentage only

Question 3

What is the role of the 'pairwise master key' (PMK) in the WPA2 four-way handshake?

Accepted Answer

It is derived from the PSK or EAP authentication and used to generate the PTK

Answer

It is the final encryption key used to protect data frames

Answer

It is exchanged between APs during fast roaming

Answer

It replaces the need for a RADIUS server in WPA2-Enterprise

Question 4

A user reports they can connect to the WLAN and browse the internet, but cannot reach internal corporate servers. The WLAN has separate guest and employee SSIDs on different VLANs. What is the MOST likely issue?

Accepted Answer

The user is connected to the guest SSID/VLAN instead of the employee SSID/VLAN

Answer

The user's device has an incorrect time zone setting

Answer

The AP needs a firmware upgrade

Answer

The 5 GHz radio on the AP is disabled

Question 5

During a wireless security audit, the auditor discovers the AP is using TKIP instead of CCMP. What risk does this introduce?

Accepted Answer

Vulnerability to known TKIP attacks such as the Beck-Tews attack, and lower cryptographic strength than AES-CCMP

Answer

Reduced beacon interval causing higher overhead

Answer

Inability to support 802.11ac data rates

Answer

Incompatibility with 802.1X authentication

Question 6

Which 802.11 feature allows a client to remain associated with an AP while transitioning between VLANs without re-authenticating, commonly used in voice deployments?

Accepted Answer

802.11r Fast BSS Transition (FT)

Answer

802.11k neighbor reports

Answer

802.11v BSS Transition Management

Answer

802.11u Hotspot 2.0

Question 7

A site survey reveals -85 dBm RSSI at a client location. The noise floor is -95 dBm. What is the SNR, and is it sufficient for reliable 802.11ac connectivity?

Accepted Answer

SNR = 10 dB; marginal to insufficient for high MCS rates

Answer

SNR = 80 dB; excellent for 802.11ac

Answer

SNR = -10 dB; below the noise floor

Answer

SNR = 180 dB; requires attenuation