220-1102 Wireless Security Protocols Practice Test 2 — 15 Questions

Question 1

A network administrator is configuring a new wireless network for a hospital that requires the highest level of security for patient data. The network must support 802.1X authentication with smart cards. Which combination of security protocols and authentication methods should be used?

Accepted Answer

WPA2-Enterprise with EAP-TLS.. WPA2-Enterprise (or WPA3-Enterprise) with EAP-TLS provides certificate-based authentication, which can use smart cards. EAP-TLS is considered the most secure because it requires both client and server certificates. This tests knowledge of enterprise authentication methods and their security levels.

Answer

WPA2-PSK with PEAP-MSCHAPv2.

Answer

WPA3-Personal with SAE.

Answer

WPA3-Enterprise with EAP-TTLS.

Question 2

A customer calls saying their home Wi-Fi network suddenly stopped working after they changed the router's security mode from WPA2-PSK to WPA2-Enterprise. All their devices previously connected fine. What is the most likely cause of the problem?

Accepted Answer

The router is now requiring a username and password from a RADIUS server, which the home network lacks.. WPA2-Enterprise requires a RADIUS authentication server, which is not present in a typical home network. WPA2-PSK uses a pre-shared key, which is standard for home use. This question tests the understanding of the difference between Personal and Enterprise modes.

Answer

The router's firmware is outdated.

Answer

The devices do not support the new encryption cipher.

Answer

The SSID was changed during the configuration.

Question 3

During a security audit at a law firm, the IT manager wants to ensure that all wireless communication is encrypted with the strongest available standard that is also compatible with their mix of Windows 10 laptops and iOS tablets. Which security protocol should you recommend?

Accepted Answer

WPA3-Personal. WPA3 is the latest Wi-Fi security standard, offering stronger encryption (GCMP-256) and improved authentication (SAE). It is backward compatible with WPA2 devices, making it suitable for mixed environments. This question tests knowledge of current wireless security standards and their compatibility.

Answer

WEP

Answer

WPA2-TKIP

Answer

WPA2-Enterprise

Question 4

A company's security policy mandates that all wireless traffic must be encrypted using a protocol that is resistant to KRACK attacks. The current network uses WPA2-PSK with AES. Which of the following upgrades should be implemented to meet this requirement?

Accepted Answer

Upgrade to WPA3-Personal.. KRACK attacks exploit vulnerabilities in the WPA2 protocol's four-way handshake. WPA3 is designed to mitigate these attacks through the use of SAE (Simultaneous Authentication of Equals) and 256-bit encryption. This question tests knowledge of specific vulnerabilities and the corresponding protocol improvements.

Answer

Change the encryption from AES to TKIP.

Answer

Enable WPA2-Enterprise with 802.1X.

Answer

Implement MAC address filtering.

Question 5

A user reports that their Windows 11 laptop can see the office Wi-Fi network but fails to connect, displaying 'Can't connect to this network'. Other users with the same laptop model connect without issues. The network uses WPA2-PSK with AES. What should you check first?

Accepted Answer

Forget the network on the laptop and reconnect by entering the passphrase again.. A mismatch in the saved passphrase is a common cause of connection failures when the network is visible. The correct answer is to forget the network and re-enter the correct passphrase. This tests troubleshooting skills for wireless authentication issues.

Answer

Update the wireless adapter driver.

Answer

Change the router's security protocol to WPA3.

Answer

Disable the firewall on the laptop.

Question 6

A user reports that their corporate laptop can connect to the guest Wi-Fi network but not to the internal corporate network. Both networks use WPA2-Enterprise with 802.1X. The laptop works fine on other corporate networks. What is the most likely issue?

Accepted Answer

The corporate network's RADIUS certificate has expired or is untrusted.. WPA2-Enterprise uses RADIUS for authentication. A common issue is that the laptop's certificate for the corporate network has expired or is not trusted by the specific RADIUS server. Guest networks often use simpler authentication like PSK, which bypasses certificate requirements.

Answer

The laptop's wireless card is faulty.

Answer

The corporate network is using a different SSID than expected.

Answer

The laptop's Wi-Fi profile is configured for WPA2-Personal instead of Enterprise.

Question 7

A customer complains that their new smartphone connects to their home Wi-Fi but has no internet access. The router is configured with WPA2-PSK and a 64-character pre-shared key. Other devices work fine. What is the most likely cause?

Accepted Answer

The smartphone is using a wrong or mistyped Wi-Fi password.. WPA2-PSK with a 64-character key is extremely long and easy to mistype. The smartphone likely has an incorrect password stored, so it authenticates to the router but fails to get an IP address because the router rejects the mismatched key during the 4-way handshake.

Answer

The smartphone's Wi-Fi antenna is faulty.

Answer

The router's DHCP server has run out of IP addresses.

Answer

The smartphone's DNS settings are misconfigured.

Question 8

A technician is troubleshooting a wireless network where users report intermittent connectivity and slow speeds. The network uses WPA2-Enterprise with EAP-TLS and certificate-based authentication. The technician notices that the RADIUS server logs show frequent certificate validation failures. What is the most likely root cause?

Accepted Answer

Client devices have expired or untrusted certificates.. EAP-TLS requires both the server and client to present valid certificates. If the client certificates are expired or not trusted by the RADIUS server, authentication will fail. This causes intermittent disconnects as clients attempt to reauthenticate.

Answer

The access point's firmware is outdated, causing packet loss.

Answer

The RADIUS server's certificate has expired.

Answer

The wireless channel is overlapping with neighboring networks.

Question 9

A company's security policy requires all wireless traffic to be encrypted with AES. A technician is configuring a new access point and sees the following options: WPA2-PSK (TKIP), WPA2-PSK (AES), WPA3-SAE, and WEP. Which option should the technician select?

Accepted Answer

WPA3-SAE. WPA3-SAE uses AES encryption by default and is the most secure option. It also provides forward secrecy and protection against offline dictionary attacks. The policy requires AES, and WPA3 meets that while being the latest standard.

Answer

WPA2-PSK (TKIP)

Answer

WPA2-PSK (AES)

Answer

WEP

Question 10

During a security audit, a technician discovers that a small office's wireless router is still using WPA-TKIP. The office has 20 devices, including some older smartphones that cannot support WPA2. What should the technician recommend to improve security without replacing all devices?

Accepted Answer

Upgrade the router to support WPA2 and configure it to use WPA2-PSK with AES encryption.. WPA-TKIP is vulnerable and should be replaced. The best approach is to upgrade the router to support WPA2 and use WPA2-PSK with AES, which is backward-compatible with most devices. If some devices truly cannot support WPA2, they should be replaced or isolated.

Answer

Keep WPA-TKIP but enable MAC address filtering to block unauthorized devices.

Answer

Change the SSID to something non-descript and disable SSID broadcast.

Answer

Switch to WPA3 and set up a separate guest network for older devices.

Question 11

A technician is setting up a wireless network for a small office that handles sensitive client data. The office has a mix of modern laptops and a few legacy printers that only support WEP. What should the technician do to maintain security while keeping the printers functional?

Accepted Answer

Create a separate VLAN for the printers using WEP and a strong passphrase, and keep the main network on WPA2.. WEP is deprecated due to severe vulnerabilities. The best practice is to isolate legacy devices on a separate VLAN with WEP and use a strong passphrase, while the main network uses WPA2 or WPA3. This limits exposure of sensitive data.

Answer

Enable WEP on the main router and set a complex 128-bit key.

Answer

Replace the printers with modern ones that support WPA2.

Answer

Set the router to mixed mode (WEP + WPA2) and use a single SSID.

Question 12

A network administrator is investigating a security incident where an attacker captured the 4-way handshake of a WPA2-PSK network and successfully cracked the passphrase. Which protocol change would most effectively prevent this type of attack in the future?

Accepted Answer

Upgrade to WPA3-SAE.. WPA3-SAE uses Simultaneous Authentication of Equals (SAE), which provides forward secrecy. This means that even if an attacker captures the handshake, they cannot crack the passphrase offline because the handshake does not contain enough information to derive the key.

Answer

Switch to WPA2-Enterprise with 802.1X and a RADIUS server.

Answer

Increase the WPA2-PSK passphrase length to 63 characters.

Answer

Enable MAC address filtering on the access point.

Question 13

A technician is configuring a new wireless network for a school. The network must support hundreds of student devices simultaneously and provide strong security. The school wants to use a single SSID with individual logins for students. Which security protocol should the technician choose?

Accepted Answer

WPA3-Enterprise with 192-bit encryption.. WPA3-Enterprise with 192-bit encryption is the most secure option for environments requiring individual authentication and high traffic. It provides stronger encryption and protection against dictionary attacks compared to WPA2-Enterprise.

Answer

WPA2-PSK with a long passphrase.

Answer

WPA2-Enterprise with 802.1X and RADIUS.

Answer

WPA3-Personal with SAE.

Question 14

A small business owner reports that after upgrading their wireless router to a newer model, several older laptops running Windows 7 can no longer connect to the Wi-Fi network. The new router is configured to use WPA3. What is the most likely reason for the connection failures?

Accepted Answer

The laptops have outdated wireless drivers that do not support WPA3.. WPA3 is the latest wireless security protocol, but it is not backward-compatible with older operating systems like Windows 7, which only support WPA2. The technician should configure the router to use WPA2/WPA3 mixed mode or WPA2 only to ensure compatibility with all devices.

Answer

The router's firewall is blocking the older laptops' MAC addresses.

Answer

The laptops are using an incompatible encryption cipher like TKIP.

Answer

The router's SSID is hidden, and the laptops cannot discover it.

Question 15

A user reports that their laptop frequently disconnects from the office Wi-Fi and reconnects after a few seconds. The network uses WPA2-Enterprise with PEAP-MSCHAPv2. Other users do not experience this issue. What is the most likely cause?

Accepted Answer

The RADIUS server is rejecting the laptop's certificate intermittently.. PEAP-MSCHAPv2 is prone to authentication timeouts if the RADIUS server is slow or if the client's certificate validation fails. This can cause periodic disconnects. The issue is specific to the client's configuration or certificate trust.

Answer

The laptop's wireless driver is outdated.

Answer

The office Wi-Fi channel is congested.

Answer

The laptop's power saving mode is turning off the Wi-Fi adapter.