CWT Security Protocols & Network Optimization 3 — Questions and Answers
Question 1: What encryption algorithm does WPA3-Personal use to replace the Pre-Shared Key (PSK) handshake?
- Simultaneous Authentication of Equals (SAE) (Correct answer)
- TKIP
- RC4
- MS-CHAPv2
Correct answer: Simultaneous Authentication of Equals (SAE)
WPA3-Personal replaces PSK with SAE (Dragonfly handshake), providing forward secrecy and resistance to offline dictionary attacks.
Question 2: Which EAP method uses server-side certificates only, with client credentials tunneled inside a TLS session?
- PEAP (Correct answer)
- EAP-TLS
- EAP-MD5
- LEAP
Correct answer: PEAP
PEAP establishes a TLS tunnel using only a server certificate, then authenticates the client via MSCHAPv2 or another inner method inside the tunnel.
Question 3: A wireless survey shows high co-channel interference on channel 6. Which optimization technique directly addresses this?
- Reducing transmit power on overlapping APs (Correct answer)
- Enabling WMM admission control
- Switching to WPA3
- Enabling 802.11r fast BSS transition
Correct answer: Reducing transmit power on overlapping APs
Lowering transmit power reduces the RF footprint of each AP, shrinking the co-channel interference zone.
Question 4: Which 802.11 feature allows a client to roam between APs without re-running a full 802.1X authentication?
- 802.11r (Fast BSS Transition) (Correct answer)
- 802.11k (Radio Resource Management)
- 802.11v (BSS Transition Management)
- 802.11w (Protected Management Frames)
Correct answer: 802.11r (Fast BSS Transition)
802.11r pre-negotiates key material between APs, enabling a client to reassociate with a new AP in as few as two frames.
Question 5: A deauthentication flood attack is possible against WPA2 networks because management frames are unprotected. Which amendment addresses this vulnerability?
- 802.11w (Correct answer)
- 802.11r
- 802.11k
- 802.11ac
Correct answer: 802.11w
802.11w (Protected Management Frames) cryptographically protects action, disassociation, and deauthentication frames.
Question 6: In a WPA2-Enterprise deployment, what is the primary role of the PMK (Pairwise Master Key)?
- It seeds the 4-Way Handshake to derive the PTK used for data encryption (Correct answer)
- It encrypts the RADIUS shared secret
- It is used directly to encrypt all unicast data frames
- It authenticates the AP to the WLAN controller
Correct answer: It seeds the 4-Way Handshake to derive the PTK used for data encryption
The PMK is derived from 802.1X authentication and serves as the input to the 4-Way Handshake, which produces the PTK for frame encryption.
Question 7: A CWT candidate is asked about the CSMA/CA mechanism. What does the 'CA' stand for and why is it used in Wi-Fi instead of collision detection?
- Collision Avoidance; wireless nodes cannot detect collisions while transmitting (Correct answer)
- Collision Authentication; all frames must be authenticated before transmission
- Channel Access; each channel must be accessed sequentially
- Carrier Attenuation; signals are weakened before sending to avoid overlap
Correct answer: Collision Avoidance; wireless nodes cannot detect collisions while transmitting
Wi-Fi uses collision avoidance because a transmitting node cannot simultaneously listen for collisions on the half-duplex wireless medium.
CWT Security Protocols & Network Optimization 3
What encryption algorithm does WPA3-Personal use to replace the Pre-Shared Key (PSK) handshake?