GSEC Wireless Network Security — 10 Questions

Question 1

A security analyst is investigating a suspected rogue access point in the office. Which behavior most strongly indicates that a device is performing an Evil Twin attack?

Accepted Answer

The access point shows a higher signal strength while using the same MAC address as a legitimate AP.. An Evil Twin attack relies on cloning the SSID and BSSID of a legitimate access point to deceive wireless clients into connecting. By mimicking the legitimate signal strength and network characteristics, the attacker lures users away from the real AP. This is a critical threat because it allows the attacker to intercept traffic, perform man-in-the-middle attacks, or harvest sensitive credentials through transparent proxying.

Answer

The access point broadcasts a unique SSID that does not match company policy.

Answer

The device has DHCP enabled and is assigning IP addresses from a private range.

Answer

The access point is connected directly to the corporate Ethernet drop.

Question 2

An organization requires a wireless security solution that prevents unauthorized personnel from connecting to the office Wi-Fi, even if the pre-shared key is leaked. Which technology should be implemented?

Accepted Answer

WPA2-Enterprise with PEAP-MSCHAPv2 or EAP-TLS.. The requirement is to ensure that even if a PSK is known, it cannot be used to gain access. 802.1X, integrated with a RADIUS server, solves this by requiring a second factor or a unique user identity for every single connection. This ensures that access is tied to a specific user account, and the administrator can revoke that access instantly without changing the network-wide authentication configuration.

Answer

WPA2-Personal with a 64-character PSK.

Answer

MAC address filtering via a centralized database.

Answer

Wireless Intrusion Prevention System (WIPS).

Question 3

Refer to the exhibit. What is the most likely risk associated with this log entry in an office environment?

Accepted Answer

The AP is attempting to bypass enterprise security protocols.. The detection of an unauthorized AP broadcasting a 'Free_Public_Wifi' SSID is a classic example of an Evil Twin or a rogue access point intended to lure employees. Employees connecting to this AP may unknowingly bypass corporate security controls, allowing an attacker to intercept their traffic or gain a foothold in the internal network if the rogue AP is bridged to the corporate Ethernet.

Answer

The unauthorized AP is likely causing a channel overlap.

Answer

The AP is failing to authenticate via RADIUS.

Answer

The AP is performing a brute-force attack on the SSID.

Question 4

A network administrator is configuring a new wireless LAN controller for a corporate office. The company requires that all wireless clients authenticate using individual credentials and that the credentials are never transmitted in cleartext over the air. The administrator also wants to ensure that session keys are unique per user and per session. Which authentication method should be implemented?

Accepted Answer

WPA2-Enterprise with EAP-TLS and a RADIUS server.. WPA2-Enterprise with EAP-TLS uses digital certificates for mutual authentication, providing each client with unique credentials that are not transmitted in cleartext. The TLS handshake derives unique session keys per user and per session, meeting all requirements. Other methods either use shared credentials or do not provide the same level of per-user key uniqueness.

Answer

WPA2-Enterprise with EAP-TTLS and a RADIUS server.

Answer

WPA2-Personal with a pre-shared key (PSK).

Answer

WPA3-Personal with Simultaneous Authentication of Equals (SAE).

Question 5

A financial firm is deploying a new WPA3-Enterprise wireless network and wants to use 192-bit mode. Which TWO configuration requirements must be met to enable WPA3-Enterprise 192-bit mode? (Choose two.)

Accepted Answer

Use GCMP-256 for unicast and broadcast/multicast encryption.. WPA3-Enterprise 192-bit mode requires Suite-B cryptographic algorithms, including GCMP-256 for encryption and SHA-256 for key derivation and certificate hashing. These ensure strong protection aligned with government and financial standards. OWE, PSK, and SAE belong to other wireless modes and do not satisfy the 192-bit mode mandate. Meeting these two requirements is essential for compliant deployment.

Answer

Enable Opportunistic Wireless Encryption (OWE) for transitional clients.

Answer

Configure WPA3-SAE for the enterprise network.

Answer

Use a 64-character pre-shared key for the enterprise network.

Question 6

A company is deploying a wireless network for guests. The security team wants to ensure that guest traffic is encrypted over the air and that guests cannot access internal corporate resources. Which combination of technologies should be implemented?

Accepted Answer

WPA2-Personal with a shared password and VLAN isolation.. For a guest network, WPA2-Personal with a shared password provides over-the-air encryption, and VLAN isolation prevents guests from reaching internal resources. This combination is practical and widely supported. Open authentication lacks encryption, while WPA2-Enterprise with EAP-TLS is too cumbersome for guests. WPA3-Personal is secure but may not be compatible with all guest devices, making WPA2-Personal the better choice for broad compatibility.

Answer

Open authentication with a captive portal and client isolation.

Answer

WPA2-Enterprise with EAP-TLS and a separate guest VLAN.

Answer

WPA3-Personal with SAE and a guest VLAN.

Question 7

A security engineer is hardening a corporate Wi-Fi deployment that uses WPA2-Enterprise with PEAP-MSCHAPv2 and a RADIUS server. The CIO wants to reduce the risk of over-the-air credential capture from malicious access points. Which server-side change best addresses this risk while keeping the existing client supplicant configuration unchanged?

Accepted Answer

Replace PEAP-MSCHAPv2 with EAP-TLS and issue client certificates to all managed devices.. Moving from PEAP-MSCHAPv2 to EAP-TLS eliminates the password-based challenge-response that attackers capture and crack offline, because authentication relies on certificates and mutual TLS. A rogue AP cannot impersonate the legitimate RADIUS server without a trusted certificate, and clients cannot be tricked into revealing reusable credential material. This is the most direct server-side hardening change that addresses over-the-air credential capture without altering existing client supplicant behavior.

Answer

Deploy server certificate validation on the RADIUS server and require clients to validate the server certificate.

Answer

Enable RADIUS accounting and log all authentication attempts to a central syslog server.

Answer

Enable Protected Management Frames (802.11w) on the WLAN controller and all access points.

Question 8

An administrator observes unauthorized devices connecting to an enterprise wireless network using WPA2-Personal. Which mitigation strategy best prevents credential sharing and ensures unique authentication for every employee?

Accepted Answer

Transition to WPA2-Enterprise utilizing 802.1X authentication with EAP-TLS.. Moving from WPA2-Personal to WPA2-Enterprise (802.1X) forces each user to authenticate against a central RADIUS server using unique credentials. This eliminates the risk of shared PSKs, which are easily compromised when employees leave or share them. This transition is a foundational requirement for securing enterprise wireless environments and ensuring accountability through centralized logging and per-user access control.

Answer

Implement MAC address filtering on all wireless access points.

Answer

Increase the PSK complexity to a 64-character alphanumeric string.

Answer

Enable hidden SSIDs to prevent unauthorized discovery.

Question 9

Refer to the exhibit. Which configuration setting poses the most significant risk to the wireless network environment?

Accepted Answer

WPS enabled allows for PIN-based brute-force attacks.. The exhibit shows WPS enabled on a WPA2-PSK network. WPS is notoriously vulnerable to brute-force attacks against its 8-digit PIN, which can be cracked in hours, revealing the underlying WPA2 passphrase. Disabling WPS is a standard security requirement because the protocol's design flaw allows for efficient recovery of the network key regardless of the passphrase's complexity, rendering the PSK security model entirely ineffective.

Answer

Channel 1 selection is a performance concern.

Answer

WPA2-PSK is insufficient for modern enterprise needs.

Answer

Management Frame Protection is disabled.

Question 10

Which THREE of the following actions are considered best practices when hardening an enterprise wireless infrastructure?

Accepted Answer

Disable WPS on all wireless access points.. Hardening a wireless network requires a layered defense approach. Disabling unused features like WPS prevents direct exploitation, implementing WPA3 or WPA2-Enterprise ensures strong cryptographic bounds, and using a Wireless Intrusion Prevention System (WIPS) allows for the continuous monitoring and mitigation of rogue devices. These three steps cover the primary vectors of wireless attack: protocol flaws, weak authentication, and unauthorized infrastructure deployment.

Answer

Enable SSID hiding to conceal the network.

Answer

Use WEP for legacy hardware compatibility.