220-1202 Wireless Security Protocols — Timed 15 Questions

Question 1

A company's IT policy requires that all wireless traffic be encrypted using the strongest available protocol. A technician is configuring a new access point that supports WPA3-SAE, WPA2-PSK with AES, and WPA2-PSK with TKIP. Which configuration meets the policy?

Accepted Answer

WPA3-SAE.. WPA3-SAE is the strongest available wireless security protocol, providing forward secrecy and stronger authentication than WPA2. It is the correct choice for maximum security.

Answer

WPA2-PSK with TKIP.

Answer

WPA2-PSK with AES.

Answer

A mixed mode of WPA2 and WPA3.

Question 2

A technician is configuring a wireless network for a school that uses Chromebooks and iPads. The network must support fast roaming and prioritize security. The technician enables WPA2-Enterprise with 802.1X. What additional configuration is needed to ensure seamless roaming between access points?

Accepted Answer

Enable 802.11r (Fast Roaming) on the wireless controller.. Fast roaming (802.11r) allows clients to quickly re-authenticate when moving between access points, reducing latency. WPA2-Enterprise alone does not provide fast roaming; 802.11r must be enabled on the controller and access points.

Answer

Enable WPA3-SAE on all access points.

Answer

Configure all access points with the same SSID and passphrase.

Answer

Disable WPS on all access points.

Question 3

A customer reports that their laptop frequently disconnects from the office Wi-Fi and reconnects after a few seconds. The network uses WPA2-PSK with AES encryption. The technician checks the router logs and sees repeated '4-way handshake timeout' errors. What is the most likely cause of this issue?

Accepted Answer

The laptop is too far from the access point, causing intermittent signal loss.. The 4-way handshake timeout errors indicate that the laptop cannot complete the WPA2 authentication process, often due to signal interference or weak signal strength. While other options could cause connectivity issues, the specific handshake timeout points to a problem with the wireless signal or authentication process.

Answer

The laptop is using an outdated WEP encryption protocol.

Answer

The router's DHCP lease time is set too short.

Answer

The router is configured for WPA2-Enterprise instead of WPA2-PSK.

Question 4

A user reports that their smartphone cannot connect to the office Wi-Fi, but other devices can. The network uses WPA2-Enterprise with PEAP-MSCHAPv2. The technician checks the phone's settings and sees that it is configured for WPA2-PSK. What is the most likely reason for the connection failure?

Accepted Answer

The phone is using the wrong security protocol.. WPA2-Enterprise requires a username and password or certificate for authentication, not a pre-shared key. The phone's WPA2-PSK setting is incompatible with the network's authentication method.

Answer

The phone's Wi-Fi antenna is damaged.

Answer

The router's SSID is hidden.

Answer

The phone's MAC address is filtered.

Question 5

A security incident occurs where an attacker captures the 4-way handshake of a WPA2-PSK network and successfully cracks the passphrase offline. The technician is tasked with preventing this type of attack in the future. Which protocol should the technician implement?

Accepted Answer

WPA3-SAE.. WPA3-SAE uses Simultaneous Authentication of Equals (SAE), which provides forward secrecy and prevents offline dictionary attacks. WPA2-PSK is vulnerable to handshake capture and offline cracking.

Answer

WPA2-PSK with a longer passphrase.

Answer

WPA2-Enterprise with PEAP-MSCHAPv2.

Answer

WPA2-PSK with TKIP.

Question 6

A technician is setting up a wireless network for a home office. The client is concerned about neighbors accessing their internet. The technician enables WPA2-PSK with a strong passphrase. Which additional step should the technician take to ensure the network is as secure as possible?

Accepted Answer

Disable WPS on the router.. Disabling WPS prevents attackers from using brute-force attacks to guess the PIN and retrieve the passphrase. WPA2-PSK with a strong passphrase is secure, but WPS can bypass that security.

Answer

Enable WPS for easy device pairing.

Answer

Disable SSID broadcast.

Answer

Enable MAC address filtering.

Question 7

During a security audit, a technician discovers that a company's wireless network uses WEP encryption. The network has been in place for 10 years and still uses the original router. What is the most immediate security risk?

Accepted Answer

WEP keys can be easily cracked using tools like Aircrack-ng.. WEP encryption is fundamentally flawed and can be cracked in minutes with readily available tools. This is the most pressing risk, as it allows attackers to decrypt traffic and potentially access the network.

Answer

The router may not support modern encryption protocols.

Answer

The router's firmware is likely outdated and vulnerable to exploits.

Answer

WEP does not support WPA2-PSK, so clients must use a different protocol.

Question 8

A technician is configuring a wireless network for a new office. The network must support legacy devices that only support WPA-TKIP, but the technician also wants to maximize security for modern devices. Which configuration should the technician use?

Accepted Answer

Set up a separate SSID with WPA-TKIP for legacy devices and another SSID with WPA2-AES for modern devices.. WPA2-PSK with AES is the most secure option, but it is not backward compatible with WPA-TKIP devices. The technician must choose between compatibility and security; the best practice is to upgrade legacy devices or use a separate network for them.

Answer

Enable WPA3-SAE for all devices.

Answer

Use WPA2-PSK with TKIP encryption.

Answer

Configure the router for WPA2-PSK with AES and enable WPA-TKIP as a fallback.

Question 9

A technician is troubleshooting a wireless network where users report intermittent connectivity. The network uses WPA2-Enterprise with a RADIUS server. The technician notices that the RADIUS server logs show frequent authentication failures from one specific access point. What is the most likely cause?

Accepted Answer

The access point's RADIUS shared secret is incorrect.. A mismatched pre-shared key or RADIUS secret between the access point and the RADIUS server will cause authentication failures. Other options like channel interference or encryption mismatch would not specifically show RADIUS authentication failures.

Answer

The access point is using a different channel than the others.

Answer

The RADIUS server certificate has expired.

Answer

The clients are using WPA2-PSK instead of WPA2-Enterprise.

Question 10

A small business owner wants to replace their old wireless router because guests have been using the network to access inappropriate content. The owner wants to isolate guest traffic from the main business network and enforce content filtering. Which combination of wireless security and features should the technician recommend?

Accepted Answer

WPA2-PSK with a guest network enabled and content filtering via OpenDNS.. WPA2-PSK with a separate guest network and content filtering DNS provides both security and isolation. WPA3 is not yet widely supported on all devices, and MAC filtering is not effective for guest isolation.

Answer

WPA3-Personal with MAC address filtering.

Answer

WPA2-Enterprise with a RADIUS server and no guest network.

Answer

WEP encryption with a hidden SSID.

Question 11

During a wireless site survey, a technician discovers that an employee has set up a personal wireless router in their cubicle, connected to the corporate network. This rogue access point is broadcasting an open SSID. Which security risk is most immediately concerning?

Accepted Answer

The rogue AP provides an unencrypted entry point for attackers to access the corporate network.. An open rogue access point allows anyone within range to connect to the corporate network without authentication, bypassing all security controls. This is a severe security incident. The question tests knowledge of rogue AP risks and the importance of wireless security policies.

Answer

The rogue AP may cause radio frequency interference with the corporate WLAN.

Answer

The rogue AP will consume additional power from the corporate UPS.

Answer

The rogue AP's DHCP server may conflict with the corporate DHCP server.

Question 12

A technician is setting up a guest Wi-Fi network in a coffee shop. The owner wants customers to be able to connect easily without entering a password, but still wants basic encryption to prevent eavesdropping. Which security configuration should the technician use?

Accepted Answer

Set up an open network with no encryption and a captive portal for terms of service.. WPA3-Personal offers an 'Enhanced Open' mode (OWE) that provides encryption without a password, but WPA2-PSK with a simple password is more common. However, the scenario explicitly asks for 'no password' and 'basic encryption'. The correct answer is to use an open network with a captive portal, but that doesn't provide encryption. The best compromise is to use WPA3-Enhanced Open (OWE) if supported, but since that may not be an option, the technician might use an open network with a captive portal. Among the options, the correct one is to use an open network with a captive portal for ease of access, but encryption is not provided. However, the question expects the technician to explain that an open network cannot provide encryption. The correct answer is to use a captive portal on an open network, acknowledging the lack of encryption. This tests understanding of trade-offs between security and convenience.

Answer

Use WPA2-PSK with a simple password like 'coffee123'.

Answer

Enable WPA3-Enterprise with certificate-based authentication.

Answer

Use WEP with a shared key printed on a receipt.

Question 13

A company's IT policy requires that all wireless connections use certificate-based authentication to prevent unauthorized access. The network is currently using WPA2-PSK. Which configuration change is necessary to meet this policy?

Accepted Answer

Switch to WPA2-Enterprise and configure a RADIUS server.. Certificate-based authentication is a feature of WPA2-Enterprise (802.1X), not WPA2-Personal. This requires a RADIUS server and PKI infrastructure. The question tests the understanding of the difference between Personal and Enterprise modes.

Answer

Enable MAC address filtering on the access point.

Answer

Upgrade to WPA3-Personal.

Answer

Change the encryption from AES to TKIP.

Question 14

A user's laptop running Windows 10 Pro connects to the corporate Wi-Fi but cannot access internal resources. The network uses WPA2-Enterprise with PEAP-MSCHAPv2. The laptop's wireless profile is configured correctly. Other users in the same office can access resources. What is the most likely cause?

Accepted Answer

The user's domain account is locked or the password has expired.. In a WPA2-Enterprise environment, the user's domain credentials are used for authentication. If the account is locked or the password has expired, authentication will fail even though the wireless association succeeds. This tests understanding of enterprise authentication integration.

Answer

The laptop's wireless adapter is faulty.

Answer

The access point is broadcasting on a congested channel.

Answer

The laptop has an incorrect IP address from DHCP.

Question 15

A small business owner reports that after upgrading their wireless router to a newer model, their older laptops running Windows 7 cannot connect to the Wi-Fi network. The new router is configured with WPA3-Personal. Which of the following is the most likely reason for the connectivity failure?

Accepted Answer

The laptops' wireless adapters do not support WPA3.. WPA3 is not supported on older operating systems like Windows 7, which only support up to WPA2. The correct solution is to either downgrade to WPA2 or update the wireless adapter drivers if possible. This question tests knowledge of backward compatibility between WPA2 and WPA3.

Answer

The router's SSID is hidden.

Answer

The router is broadcasting on a 5 GHz band only.

Answer

The laptops have incorrect DNS settings.