Wireless & Mobile Security Flashcards

Which authentication protocol is commonly used with 802.1X for enterprise wireless networks?

Answer: EAP (Extensible Authentication Protocol)

EAP is the standard authentication framework used with 802.1X and RADIUS servers to provide robust, flexible authentication for enterprise wireless networks.

What is the primary purpose of a Wireless Intrusion Prevention System (WIPS)?

Answer: To detect and prevent unauthorized access points and wireless attacks

WIPS continuously monitors the RF spectrum to detect rogue access points, unauthorized clients, and wireless attacks, and can automatically contain or block threats.

Which WPA3 feature provides forward secrecy and replaces the PSK handshake?

Answer: SAE (Simultaneous Authentication of Equals)

SAE replaces the WPA2 PSK handshake in WPA3, generating unique session keys per connection and providing forward secrecy so past sessions cannot be decrypted if keys are compromised.

What type of wireless attack involves setting up a rogue access point that mimics a legitimate one to intercept traffic?

Answer: Evil Twin attack

An Evil Twin attack creates a malicious access point with the same SSID and similar characteristics as a legitimate AP, tricking clients into connecting so traffic can be intercepted.

Which wireless security protocol is considered critically vulnerable and must never be used in modern networks?

Answer: WEP (Wired Equivalent Privacy)

WEP uses weak RC4 encryption with static keys and flawed IV implementation, allowing an attacker to crack the key by capturing as few as 50,000 packets.

In an enterprise wireless deployment, what is the primary role of a RADIUS server?

Answer: To authenticate wireless users and authorize network access

A RADIUS server centralizes Authentication, Authorization, and Accounting (AAA) for 802.1X wireless deployments, validating credentials and enforcing access policies.

What does a captive portal in a wireless network primarily provide?

Answer: A web-based authentication or terms-acceptance page before granting network access

A captive portal intercepts HTTP/HTTPS traffic and redirects unauthenticated users to a web page for credential entry or acceptance of terms before network access is granted.