CCST - Cisco Certified Support Technician Wireless Security Protocols (WPA) Questions and Answers

Question 1

A company wants to implement the highest level of security for its corporate wireless network, which is used by hundreds of employees with individual company-issued laptops. Which wireless security protocol and mode should be implemented to ensure each user authenticates with unique credentials?

Accepted Answer

WPA2-Enterprise

Answer

WPA2-Enterprise mode is designed for corporate environments. Unlike the 'Personal' mode which uses a single pre-shared key (PSK) for all users, 'Enterprise' mode integrates with a RADIUS server to authenticate each user individually with unique credentials (e.g., username and password). This provides superior security, accountability, and management, as access can be granted or revoked on a per-user basis.

Question 2

A support technician is configuring a new SOHO (Small Office/Home Office) wireless router. The goal is to use the most current and secure protocol that protects against offline dictionary attacks, even if the password is simple. Which WPA protocol should be chosen?

Accepted Answer

WPA3 with SAE

Answer

WPA3 is the latest Wi-Fi security standard and its key advantage is the use of Simultaneous Authentication of Equals (SAE), also known as the Dragonfly key exchange. This method is inherently resistant to offline dictionary attacks, where an attacker captures the initial handshake and tries to guess the password repeatedly. SAE ensures the password is never transmitted, providing robust protection even with less complex passwords.

Question 3

Which of the following encryption protocols is considered a deprecated, older standard associated with the original WPA, while its successor, CCMP, is the mandatory standard for WPA2?

Accepted Answer

TKIP

Answer

Temporal Key Integrity Protocol (TKIP) was developed as a replacement for the flawed WEP encryption. It was used with WPA as an interim solution. However, TKIP has known vulnerabilities and has been deprecated. WPA2 mandates the use of the stronger Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP), which is based on the Advanced Encryption Standard (AES).

Question 4

A user is setting up a guest network at a small coffee shop. To support older devices, the technician enables a 'transition mode' on the new WPA3-capable router. What is the primary function of WPA3 Transition Mode?

Accepted Answer

It allows both WPA3-capable and WPA2-capable devices to connect to the same SSID.

Answer

WPA3 Transition Mode is designed for backward compatibility. When enabled on a network (SSID), it allows devices that support WPA3 to connect using the more secure SAE protocol, while simultaneously permitting older devices that only support WPA2 to connect using PSK. This provides a smooth migration path without requiring an immediate upgrade of all client devices.

Question 5

A technician is auditing the security of a wireless network and discovers that Wi-Fi Protected Setup (WPS) is enabled. Why is this feature generally considered a significant security risk on WPA/WPA2 networks?

Accepted Answer

The WPS PIN is susceptible to brute-force attacks, which can reveal the WPA2 pre-shared key.

Answer

Wi-Fi Protected Setup (WPS) was designed for ease of use but introduced a major vulnerability. The PIN-based authentication method can be brute-forced relatively quickly because the validation process happens in two halves, drastically reducing the number of combinations an attacker needs to try. A successful attack reveals the WPS PIN, which can then be used to retrieve the network's main WPA/WPA2 pre-shared key.

(CCST) Cisco Certified Support Technician Practice Test

(CCST) Cisco Certified Support Technician Practice Test

CCST - Cisco Certified Support Technician Wireless Security Protocols (WPA) Questions and Answers