NSE Wireless & Mobile Security 2 — Questions and Answers
Question 1: Which modern attack technique allows WPA2 PSK cracking without capturing a full 4-way handshake from a connected client?
- Bluejacking attack
- PMKID attack (Correct answer)
- ARP poisoning attack
- DNS spoofing attack
Correct answer: PMKID attack
The PMKID attack extracts the PMKID value directly from the AP's EAPOL frame, enabling offline PSK cracking without needing a connected client or capturing the full handshake.
Question 2: What is the primary security vulnerability in WPS (Wi-Fi Protected Setup) PIN authentication?
- It transmits the network password in plaintext
- The 8-digit PIN is validated in two halves, reducing brute-force space to ~11,000 guesses (Correct answer)
- It uses the deprecated DES encryption algorithm
- It automatically disables the network firewall during pairing
Correct answer: The 8-digit PIN is validated in two halves, reducing brute-force space to ~11,000 guesses
WPS PIN authentication validates the PIN in two independent halves (4+4 digits), reducing the effective keyspace from 10^8 to ~11,000 combinations, making brute-force attacks trivial.
Question 3: What is the primary function of MDM (Mobile Device Management) in enterprise mobile security?
- To encrypt all cellular network traffic end-to-end
- To track device GPS location and report to management
- To centrally manage, enforce security policies, and control enterprise mobile devices (Correct answer)
- To provide automatic VPN tunneling for all mobile traffic
Correct answer: To centrally manage, enforce security policies, and control enterprise mobile devices
MDM allows organizations to remotely manage mobile devices, enforce password and encryption policies, push or restrict applications, and perform remote wipe if devices are lost or stolen.
Question 4: Which wireless denial-of-service attack exploits unauthenticated 802.11 management frames to disconnect clients from their AP?
- Karma attack
- Deauthentication flood attack (Correct answer)
- Fragmentation attack
- KRACK attack
Correct answer: Deauthentication flood attack
A deauthentication flood attack sends spoofed, unauthenticated 802.11 deauth frames to clients or APs, continuously disconnecting users since management frames lack authentication in WPA2.
Question 5: What does the KRACK (Key Reinstallation Attack) vulnerability exploit in WPA2?
- WEP's static encryption keys and weak IVs
- Bluetooth pairing protocol weaknesses
- Nonce reuse caused by key reinstallation during the WPA2 4-way handshake (Correct answer)
- The WPS PIN brute-force vulnerability
Correct answer: Nonce reuse caused by key reinstallation during the WPA2 4-way handshake
KRACK forces nonce reuse by manipulating and replaying cryptographic handshake messages, allowing attackers to decrypt encrypted packets in WPA2-protected networks.
Question 6: Which security measure is MOST effective at protecting a corporate wireless network against rogue access points?
- Using WPA2-Personal with a complex passphrase
- Deploying a WIPS with continuous RF spectrum monitoring and automatic AP containment (Correct answer)
- Disabling SSID broadcast on all corporate access points
- Maximizing wireless transmit power to overpower rogue signals
Correct answer: Deploying a WIPS with continuous RF spectrum monitoring and automatic AP containment
A WIPS continuously scans the RF environment, correlates detected APs against an authorized list, and can automatically contain rogue APs by sending deauth frames to connected clients.
Question 7: Which EAP method provides the strongest security for WPA2-Enterprise by requiring digital certificates on both the client and authentication server?
- EAP-MD5
- EAP-PEAP
- EAP-TLS (Correct answer)
- EAP-TTLS
Correct answer: EAP-TLS
EAP-TLS requires mutual certificate-based authentication where both the supplicant (client) and authentication server present valid X.509 certificates, eliminating password-based attacks.
NSE Wireless & Mobile Security 2
Which modern attack technique allows WPA2 PSK cracking without capturing a full 4-way handshake from a connected client?