Wireless & Mobile Security Flashcards
7 cards from real Technology Certifications practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Wireless & Mobile Security flashcards as text
Which protocol vulnerability in WEP allows attackers to eventually decrypt wireless traffic without knowing the encryption key?
Answer: Short 24-bit Initialization Vector (IV) reuse weakness
WEP's 24-bit IV space is too small and reuses values frequently; collecting enough packets allows statistical analysis (FMS/Korek attacks) to recover the RC4 key.
What is the primary goal of a wireless deauthentication attack against a WPA2-protected network?
Answer: Force clients to disconnect so their reconnection handshake can be captured for offline cracking
Deauthentication attacks send forged 802.11 management frames to disconnect clients, forcing them to re-authenticate and generating a WPA2 4-way handshake the attacker can capture and crack offline.
Which attack exploits a design flaw in Wi-Fi Protected Setup (WPS) PIN authentication, reducing the effective brute-force search space?
Answer: WPS PIN brute-force attack
WPS PIN is split into two halves verified independently, reducing the 8-digit PIN from 100 million possibilities to roughly 11,000 guesses — making brute-force feasible.
What does the KRACK (Key Reinstallation Attack) vulnerability target in wireless networks?
Answer: The WPA2 4-way handshake nonce reuse during reconnection
KRACK forces nonce reuse during the WPA2 4-way handshake by replaying handshake messages, allowing attackers to decrypt, replay, and potentially forge encrypted packets.
Which wireless security countermeasure authenticates and authorizes devices at Layer 2 before granting any network access, using EAP and a backend authentication server?
Answer: 802.1X port-based Network Access Control
802.1X blocks all network traffic from a port until the connecting device successfully authenticates via EAP to a RADIUS server, providing strong, identity-based access control.
Which countermeasure is most effective against evil twin access point attacks in an enterprise environment?
Answer: Using certificate-based authentication (EAP-TLS) that validates the server's certificate
EAP-TLS and similar certificate-based EAP methods require the client to validate the authentication server's certificate, so clients reject rogue APs that cannot present a trusted certificate.
What security control uses hardware addresses to restrict which devices may connect to a wireless network, and what is its primary weakness?
Answer: MAC address filtering; MAC addresses can be easily spoofed by attackers
MAC address filtering only allows pre-registered hardware addresses to connect, but since MAC addresses are transmitted in plaintext and can be trivially spoofed using readily available tools, it provides minimal security.