Question 1

Given: In a security penetration exercise, a WLAN consultant obtains the WEP key of XYZ Corporation’s wireless network. Demonstrating the vulnerabilities of using WEP, the consultant uses a laptop running a software AP in an attempt to hijack the authorized user’s connections. XYZ’s legacy network is using 802.11n APs with 802.11b, 11g, and 11n client devices. With this setup, how can the consultant cause all of the authorized clients to establish Layer 2 connectivity with the software access point?

Options :

A : All WLAN clients will reassociate to the consultant’s software AP if the consultant’s software AP provides the same SSID on any channel with a 10 dB SNR improvement over the authorized AP.

B : A higher SSID priority value configured in the Beacon frames of the consultant’s software AP will take priority over the SSID in the authorized AP, causing the clients to reassociate.

C : When the RF signal between the clients and the authorized AP is temporarily disrupted and the consultant’s software AP is using the same SSID on a different channel than the authorized AP, the clients will reassociate to the software AP.

D : If the consultant’s software AP broadcasts Beacon frames that advertise 802.11g data rates that are faster rates than XYZ’s current 802.11b data rates, all WLAN clients will reassociate to the faster AP.

Answer: C

Question 2

What preventative measures are performed by a WIPS against intrusions?

Options :

A : EAPoL Reject frame flood against a rogue AP

B : Evil twin attack against a rogue AP

C : Deauthentication attack against a classified neighbor AP

D : ASLEAP attack against a rogue AP

E : Uses SNMP to disable the switch port to which rogue APs connect

Answer: E

Question 3

Given: ABC Company has recently installed a WLAN controller and configured it to support WPA2-Enterprise security. The administrator has configured a security profile on the WLAN controller for each group within the company (Marketing, Sales, and Engineering). How are authenticated users assigned to groups so that they receive the correct security profile within the WLAN controller?

Options :

A : The WLAN controller polls the RADIUS server for a complete list of authenticated users and groups after each user authentication.

B : The RADIUS server sends a group name return list attribute to the WLAN controller during every successful user authentication.

C : The RADIUS server forwards the request for a group attribute to an LDAP database service, and LDAP sends the group attribute to the WLAN controller.

D : The RADIUS server sends the list of authenticated users and groups to the WLAN controller as part of a 4-Way Handshake prior to user authentication.

Answer: B

Question 4

What attack cannot be detected by a Wireless Intrusion Prevention System (WIPS)?

Options :

A : MAC Spoofing

B : Eavesdropping

C : Hot-spotter

D : Soft AP

E : Deauthentication flood

F : EAP flood

Answer: B

Question 5

What EAP type supports using MS-CHAPv2, EAP-GTC or EAP-TLS for wireless client authentication?

Options :

A : H-REAP

B : EAP-GTC

C : EAP-TTLS

D : PEAP

E : LEAP

Answer: D