GSEC Wireless Network Security — All Questions With Answers

Question 1

A security analyst is investigating a suspected rogue access point in the office. Which behavior most strongly indicates that a device is performing an Evil Twin attack?

Accepted Answer

The access point shows a higher signal strength while using the same MAC address as a legitimate AP.. An Evil Twin attack relies on cloning the SSID and BSSID of a legitimate access point to deceive wireless clients into connecting. By mimicking the legitimate signal strength and network characteristics, the attacker lures users away from the real AP. This is a critical threat because it allows the attacker to intercept traffic, perform man-in-the-middle attacks, or harvest sensitive credentials through transparent proxying.

Answer

The access point broadcasts a unique SSID that does not match company policy.

Answer

The device has DHCP enabled and is assigning IP addresses from a private range.

Answer

The access point is connected directly to the corporate Ethernet drop.

Question 2

An organization requires a wireless security solution that prevents unauthorized personnel from connecting to the office Wi-Fi, even if the pre-shared key is leaked. Which technology should be implemented?

Accepted Answer

WPA2-Enterprise with PEAP-MSCHAPv2 or EAP-TLS.. The requirement is to ensure that even if a PSK is known, it cannot be used to gain access. 802.1X, integrated with a RADIUS server, solves this by requiring a second factor or a unique user identity for every single connection. This ensures that access is tied to a specific user account, and the administrator can revoke that access instantly without changing the network-wide authentication configuration.

Answer

WPA2-Personal with a 64-character PSK.

Answer

MAC address filtering via a centralized database.

Answer

Wireless Intrusion Prevention System (WIPS).

Question 3

Refer to the exhibit. What is the most likely risk associated with this log entry in an office environment?

Accepted Answer

The AP is attempting to bypass enterprise security protocols.. The detection of an unauthorized AP broadcasting a 'Free_Public_Wifi' SSID is a classic example of an Evil Twin or a rogue access point intended to lure employees. Employees connecting to this AP may unknowingly bypass corporate security controls, allowing an attacker to intercept their traffic or gain a foothold in the internal network if the rogue AP is bridged to the corporate Ethernet.

Answer

The unauthorized AP is likely causing a channel overlap.

Answer

The AP is failing to authenticate via RADIUS.

Answer

The AP is performing a brute-force attack on the SSID.

Question 4

A network administrator is configuring a new wireless LAN controller for a corporate office. The company requires that all wireless clients authenticate using individual credentials and that the credentials are never transmitted in cleartext over the air. The administrator also wants to ensure that session keys are unique per user and per session. Which authentication method should be implemented?

Accepted Answer

WPA2-Enterprise with EAP-TLS and a RADIUS server.. WPA2-Enterprise with EAP-TLS uses digital certificates for mutual authentication, providing each client with unique credentials that are not transmitted in cleartext. The TLS handshake derives unique session keys per user and per session, meeting all requirements. Other methods either use shared credentials or do not provide the same level of per-user key uniqueness.

Answer

WPA2-Enterprise with EAP-TTLS and a RADIUS server.

Answer

WPA2-Personal with a pre-shared key (PSK).

Answer

WPA3-Personal with Simultaneous Authentication of Equals (SAE).

Question 5

A financial firm is deploying a new WPA3-Enterprise wireless network and wants to use 192-bit mode. Which TWO configuration requirements must be met to enable WPA3-Enterprise 192-bit mode? (Choose two.)

Accepted Answer

Use GCMP-256 for unicast and broadcast/multicast encryption.. WPA3-Enterprise 192-bit mode requires Suite-B cryptographic algorithms, including GCMP-256 for encryption and SHA-256 for key derivation and certificate hashing. These ensure strong protection aligned with government and financial standards. OWE, PSK, and SAE belong to other wireless modes and do not satisfy the 192-bit mode mandate. Meeting these two requirements is essential for compliant deployment.

Answer

Enable Opportunistic Wireless Encryption (OWE) for transitional clients.

Answer

Configure WPA3-SAE for the enterprise network.

Answer

Use a 64-character pre-shared key for the enterprise network.

Question 6

A company is deploying a wireless network for guests. The security team wants to ensure that guest traffic is encrypted over the air and that guests cannot access internal corporate resources. Which combination of technologies should be implemented?

Accepted Answer

WPA2-Personal with a shared password and VLAN isolation.. For a guest network, WPA2-Personal with a shared password provides over-the-air encryption, and VLAN isolation prevents guests from reaching internal resources. This combination is practical and widely supported. Open authentication lacks encryption, while WPA2-Enterprise with EAP-TLS is too cumbersome for guests. WPA3-Personal is secure but may not be compatible with all guest devices, making WPA2-Personal the better choice for broad compatibility.

Answer

Open authentication with a captive portal and client isolation.

Answer

WPA2-Enterprise with EAP-TLS and a separate guest VLAN.

Answer

WPA3-Personal with SAE and a guest VLAN.

Question 7

A security engineer is hardening a corporate Wi-Fi deployment that uses WPA2-Enterprise with PEAP-MSCHAPv2 and a RADIUS server. The CIO wants to reduce the risk of over-the-air credential capture from malicious access points. Which server-side change best addresses this risk while keeping the existing client supplicant configuration unchanged?

Accepted Answer

Replace PEAP-MSCHAPv2 with EAP-TLS and issue client certificates to all managed devices.. Moving from PEAP-MSCHAPv2 to EAP-TLS eliminates the password-based challenge-response that attackers capture and crack offline, because authentication relies on certificates and mutual TLS. A rogue AP cannot impersonate the legitimate RADIUS server without a trusted certificate, and clients cannot be tricked into revealing reusable credential material. This is the most direct server-side hardening change that addresses over-the-air credential capture without altering existing client supplicant behavior.

Answer

Deploy server certificate validation on the RADIUS server and require clients to validate the server certificate.

Answer

Enable RADIUS accounting and log all authentication attempts to a central syslog server.

Answer

Enable Protected Management Frames (802.11w) on the WLAN controller and all access points.

Question 8

An administrator observes unauthorized devices connecting to an enterprise wireless network using WPA2-Personal. Which mitigation strategy best prevents credential sharing and ensures unique authentication for every employee?

Accepted Answer

Transition to WPA2-Enterprise utilizing 802.1X authentication with EAP-TLS.. Moving from WPA2-Personal to WPA2-Enterprise (802.1X) forces each user to authenticate against a central RADIUS server using unique credentials. This eliminates the risk of shared PSKs, which are easily compromised when employees leave or share them. This transition is a foundational requirement for securing enterprise wireless environments and ensuring accountability through centralized logging and per-user access control.

Answer

Implement MAC address filtering on all wireless access points.

Answer

Increase the PSK complexity to a 64-character alphanumeric string.

Answer

Enable hidden SSIDs to prevent unauthorized discovery.

Question 9

Refer to the exhibit. Which configuration setting poses the most significant risk to the wireless network environment?

Accepted Answer

WPS enabled allows for PIN-based brute-force attacks.. The exhibit shows WPS enabled on a WPA2-PSK network. WPS is notoriously vulnerable to brute-force attacks against its 8-digit PIN, which can be cracked in hours, revealing the underlying WPA2 passphrase. Disabling WPS is a standard security requirement because the protocol's design flaw allows for efficient recovery of the network key regardless of the passphrase's complexity, rendering the PSK security model entirely ineffective.

Answer

Channel 1 selection is a performance concern.

Answer

WPA2-PSK is insufficient for modern enterprise needs.

Answer

Management Frame Protection is disabled.

Question 10

Which THREE of the following actions are considered best practices when hardening an enterprise wireless infrastructure?

Accepted Answer

Disable WPS on all wireless access points.. Hardening a wireless network requires a layered defense approach. Disabling unused features like WPS prevents direct exploitation, implementing WPA3 or WPA2-Enterprise ensures strong cryptographic bounds, and using a Wireless Intrusion Prevention System (WIPS) allows for the continuous monitoring and mitigation of rogue devices. These three steps cover the primary vectors of wireless attack: protocol flaws, weak authentication, and unauthorized infrastructure deployment.

Answer

Enable SSID hiding to conceal the network.

Answer

Use WEP for legacy hardware compatibility.

Question 11

A security auditor notices that wireless clients are frequently disconnected by de-authentication frames that contain a spoofed MAC address of the access point. What is the auditor witnessing?

Accepted Answer

A de-authentication Denial of Service (DoS) attack.. This behavior is characteristic of an 802.11 de-authentication attack. By sending spoofed management frames that appear to originate from the legitimate access point, an attacker can force clients to disconnect. This is often a precursor to forcing clients to reconnect to an attacker-controlled Evil Twin AP, enabling the interception of credentials or the execution of further man-in-the-middle attacks.

Answer

A standard re-keying process defined by WPA2 standards.

Answer

An automated load balancing mechanism on the AP.

Answer

A probe response flood from an adjacent network.

Question 12

Which TWO of the following statements are true regarding the use of WPA3 compared to WPA2?

Accepted Answer

WPA3 uses SAE to replace the vulnerable WPA2 PSK exchange.. WPA3 introduces significant security improvements over WPA2. SAE (Simultaneous Authentication of Equals) replaces the vulnerable PSK exchange, providing forward secrecy and protection against offline dictionary attacks. Additionally, WPA3 mandates Protected Management Frames (PMF), which prevents the de-authentication attacks that plague WPA2. These enhancements make WPA3 the current standard for protecting wireless networks against common interception and session-hijacking techniques.

Answer

WPA3 is fully backward compatible with all WEP-based devices.

Answer

WPA3 removes the requirement for 802.1X authentication entirely.

Answer

WPA3 encryption is strictly limited to 64-bit keys.

Question 13

A security analyst at a financial firm is reviewing wireless traffic captured near the executive conference room. The capture shows a flood of 802.11 management frames with source addresses set to the company's legitimate AP MAC address, but the frames are not encrypted and are arriving at a high rate. Which type of attack is most likely occurring?

Accepted Answer

A deauthentication flood using spoofed management frames.. The flood of unencrypted 802.11 management frames with a spoofed AP MAC address is a classic deauthentication attack. Attackers use this to disconnect clients from the legitimate AP, often to capture the WPA handshake or to force clients to connect to a rogue AP. The high rate and spoofed source distinguish it from other wireless attacks that manipulate encrypted frames or handshake processes.

Answer

A rogue access point broadcasting a duplicate SSID to lure clients.

Answer

A KRACK key reinstallation attack against the WPA2 four-way handshake.

Answer

A WPA3 Dragonblood downgrade attack forcing the use of WPA2.

Question 14

A hospital's wireless network uses WPA2-Enterprise with PEAP-MSCHAPv2. A security engineer discovers that an attacker can capture a client's authentication exchange and crack the password offline. Which change most directly mitigates this specific attack?

Accepted Answer

Configure EAP-TLS with client certificates for all wireless clients.. PEAP-MSCHAPv2 transmits an MSCHAPv2 challenge-response that can be captured and cracked offline because the protocol's DES-based keying is weak and lacks channel binding. Replacing it with EAP-TLS removes the password-derived secret entirely, requiring client certificates for mutual authentication. PMF, 802.11w, and PSK length changes do not alter the inner EAP method, so they leave the offline cracking vulnerability intact.

Answer

Deploy Protected Management Frames (PMF) on all access points.

Answer

Enable 802.11w on the wireless controller.

Answer

Increase the WPA2 pre-shared key length to 64 characters.

Question 15

A security administrator is configuring a new wireless intrusion prevention system (WIPS) for a corporate campus. The administrator wants the WIPS to automatically contain an unauthorized access point that is broadcasting the corporate SSID. Which WIPS capability should be enabled to achieve this?

Accepted Answer

Rogue AP containment via over-the-air deauthentication and disassociation frames.. Automatic rogue AP containment in a WIPS works by sending deauthentication and disassociation frames to clients associated with the rogue device, preventing them from using it. This meets the requirement for automatic neutralization. Alerting, spectrum analysis, and location tracking are valuable but do not provide containment. Enabling containment is the direct action that achieves the goal.

Answer

Location tracking of wireless clients.

Answer

Wireless intrusion detection with alerting only.

Answer

Spectrum analysis to identify interference sources.

Question 16

A financial services firm deploys 802.1X with EAP-TLS on its corporate WLAN. During an assessment, a consultant captures the 802.11 four-way handshake and observes that the attacker cannot derive the PMK because the exchange never leaves the client and RADIUS-issued credentials exposed. Which property of EAP-TLS best explains why this capture alone cannot be used to impersonate a legitimate client?

Accepted Answer

EAP-TLS performs mutual authentication using X.509 client and server certificates, so no reusable password-derived secret traverses the wireless medium.. EAP-TLS bases authentication on mutual X.509 certificate exchange, so neither a password nor a shared secret crosses the air. A captured four-way handshake yields only session-specific values that cannot be replayed or brute-forced into the PMK. Impersonation would require possession of the legitimate client's private key, which the passive capture does not provide.

Answer

EAP-TLS encrypts the entire four-way handshake inside the TLS tunnel, so the ANonce and SNonce are never visible to a passive observer.

Answer

EAP-TLS relies on PEAP inner-method tunneling, which wraps the client credential exchange in a protected TLS channel so offline dictionary attacks are impossible.

Answer

EAP-TLS uses a per-session PSK that the RADIUS server generates and transmits to the client over the encrypted tunnel, so each session key is unique and unrecoverable from the capture.

Question 17

A hospital's wireless intrusion prevention system reports that a nearby attacker is broadcasting beacon frames that clone the SSID and BSSID of the hospital's legitimate access point at a higher signal strength, luring staff laptops to associate with the attacker's hardware. Which attack is being described, and which defense most directly addresses it?

Accepted Answer

An evil twin attack; requiring server certificate validation in the supplicant profile prevents clients from trusting the rogue AP.. Cloning an AP's SSID and BSSID with a stronger signal to attract clients is an evil twin attack. In an enterprise deployment the rogue cannot present a certificate signed by the trusted CA, so configuring the supplicant to validate the RADIUS server certificate causes the association to fail. Detection alone is weaker than preventing the trust decision.

Answer

A deauthentication flood; enabling Management Frame Protection forces the attacker's forged frames to be discarded by clients.

Answer

A MAC spoofing attack; deploying 802.1X with MAC authentication bypass on switch ports eliminates the rogue association.

Answer

A karma attack; disabling the SSID broadcast on legitimate APs prevents clients from probing for and joining the rogue device.

Question 18

A security researcher is evaluating the susceptibility of a WPA3-Personal network to offline dictionary attacks. Which statement accurately describes the resistance provided by WPA3-SAE compared to WPA2-PSK?

Accepted Answer

WPA3-SAE prevents offline dictionary attacks by using a simultaneous authentication of equals handshake that does not expose a crackable hash.. WPA3-SAE employs the Dragonfly handshake, which provides forward secrecy and prevents offline dictionary attacks by ensuring that the password is not exposed in a crackable form. An attacker must interact with the AP for each guess, making brute-force impractical. WPA2-PSK's 4-way handshake exposes a hash that can be cracked offline. The other options mischaracterize SAE's design or confuse it with unrelated features.

Answer

WPA3-SAE still allows offline dictionary attacks but requires more computational effort due to stronger encryption.

Answer

WPA3-SAE requires a captive portal to prevent offline attacks, as it does not encrypt management frames.

Answer

WPA3-SAE uses the same 4-way handshake as WPA2-PSK but with a longer key, making offline attacks infeasible.

Question 19

A retail chain wants to let customers join a guest WLAN without sharing the corporate preshared key, while still keeping guest traffic isolated from point-of-sale systems. Which design best meets these requirements?

Accepted Answer

Configure a separate guest SSID mapped to a dedicated VLAN with client isolation enabled and no route to internal subnets.. Guest access is best delivered on its own SSID mapped to a segmented VLAN with client isolation and no internal routing. This keeps the corporate preshared key private, prevents guest-to-guest and guest-to-internal access, and protects point-of-sale systems through network segmentation rather than relying on the guest credential.

Answer

Broadcast the corporate SSID with WPA3-SAE and give customers a rotating guest passphrase that changes weekly.

Answer

Deploy the guest network on the same SSID as corporate users and rely on 802.1X to assign guests a restricted role after authentication.

Answer

Enable a hidden guest SSID using WEP with a shared key so customers can connect without configuration changes.

Question 20

A security engineer is reviewing the WLAN configuration of a small business that uses WPA2-Personal. The owner wants to raise resistance to offline dictionary attacks against the preshared key without replacing all client hardware. Which two changes best accomplish this goal? (Choose two.)

Accepted Answer

Migrate the SSID to WPA3-SAE so the authentication exchange uses a simultaneous authentication of equals handshake resistant to offline guessing.. Offline dictionary attacks against WPA2-Personal succeed by deriving the PMK from a guessable passphrase and testing it against a captured handshake. Migrating to WPA3-SAE removes that offline attack path, and using a long random passphrase increases entropy so any captured material is impractical to crack. The two measures reinforce each other.

Answer

Enable 802.11w Management Frame Protection on the SSID to prevent capture of the four-way handshake.

Answer

Disable the SSID broadcast and enable MAC address filtering to prevent attackers from capturing the handshake.

Answer

Configure the AP to use TKIP instead of CCMP so that the captured handshake cannot be decrypted.

GSEC Wireless Network Security — All Questions With Answers

A security analyst is investigating a suspected rogue access point in the office. Which behavior most strongly indicates that a device is performing an Evil Twin attack?

An organization requires a wireless security solution that prevents unauthorized personnel from connecting to the office Wi-Fi, even if the pre-shared key is leaked. Which technology should be implemented?

Refer to the exhibit. What is the most likely risk associated with this log entry in an office environment?

Exhibit

A financial firm is deploying a new WPA3-Enterprise wireless network and wants to use 192-bit mode. Which TWO configuration requirements must be met to enable WPA3-Enterprise 192-bit mode? (Choose two.)

A company is deploying a wireless network for guests. The security team wants to ensure that guest traffic is encrypted over the air and that guests cannot access internal corporate resources. Which combination of technologies should be implemented?

An administrator observes unauthorized devices connecting to an enterprise wireless network using WPA2-Personal. Which mitigation strategy best prevents credential sharing and ensures unique authentication for every employee?

Refer to the exhibit. Which configuration setting poses the most significant risk to the wireless network environment?

Exhibit

Which THREE of the following actions are considered best practices when hardening an enterprise wireless infrastructure?

A security auditor notices that wireless clients are frequently disconnected by de-authentication frames that contain a spoofed MAC address of the access point. What is the auditor witnessing?

Which TWO of the following statements are true regarding the use of WPA3 compared to WPA2?

A hospital's wireless network uses WPA2-Enterprise with PEAP-MSCHAPv2. A security engineer discovers that an attacker can capture a client's authentication exchange and crack the password offline. Which change most directly mitigates this specific attack?

A security administrator is configuring a new wireless intrusion prevention system (WIPS) for a corporate campus. The administrator wants the WIPS to automatically contain an unauthorized access point that is broadcasting the corporate SSID. Which WIPS capability should be enabled to achieve this?

A security researcher is evaluating the susceptibility of a WPA3-Personal network to offline dictionary attacks. Which statement accurately describes the resistance provided by WPA3-SAE compared to WPA2-PSK?

A retail chain wants to let customers join a guest WLAN without sharing the corporate preshared key, while still keeping guest traffic isolated from point-of-sale systems. Which design best meets these requirements?

A security engineer is reviewing the WLAN configuration of a small business that uses WPA2-Personal. The owner wants to raise resistance to offline dictionary attacks against the preshared key without replacing all client hardware. Which two changes best accomplish this goal? (Choose two.)

An assessor is standing in a parking lot outside a warehouse and needs to map the coverage footprint and identify all BSSIDs in range, including hidden networks, using a passive approach that does not associate to any AP. Which tool and technique fit this requirement?

GSEC Wireless Network Security — All Questions With Answers

A security analyst is investigating a suspected rogue access point in the office. Which behavior most strongly indicates that a device is performing an Evil Twin attack?

An organization requires a wireless security solution that prevents unauthorized personnel from connecting to the office Wi-Fi, even if the pre-shared key is leaked. Which technology should be implemented?

Refer to the exhibit. What is the most likely risk associated with this log entry in an office environment?

Exhibit

A financial firm is deploying a new WPA3-Enterprise wireless network and wants to use 192-bit mode. Which TWO configuration requirements must be met to enable WPA3-Enterprise 192-bit mode? (Choose two.)

A company is deploying a wireless network for guests. The security team wants to ensure that guest traffic is encrypted over the air and that guests cannot access internal corporate resources. Which combination of technologies should be implemented?

An administrator observes unauthorized devices connecting to an enterprise wireless network using WPA2-Personal. Which mitigation strategy best prevents credential sharing and ensures unique authentication for every employee?

Refer to the exhibit. Which configuration setting poses the most significant risk to the wireless network environment?

Exhibit

Which THREE of the following actions are considered best practices when hardening an enterprise wireless infrastructure?

A security auditor notices that wireless clients are frequently disconnected by de-authentication frames that contain a spoofed MAC address of the access point. What is the auditor witnessing?

Which TWO of the following statements are true regarding the use of WPA3 compared to WPA2?

A hospital's wireless network uses WPA2-Enterprise with PEAP-MSCHAPv2. A security engineer discovers that an attacker can capture a client's authentication exchange and crack the password offline. Which change most directly mitigates this specific attack?

A security administrator is configuring a new wireless intrusion prevention system (WIPS) for a corporate campus. The administrator wants the WIPS to automatically contain an unauthorized access point that is broadcasting the corporate SSID. Which WIPS capability should be enabled to achieve this?

A security researcher is evaluating the susceptibility of a WPA3-Personal network to offline dictionary attacks. Which statement accurately describes the resistance provided by WPA3-SAE compared to WPA2-PSK?

A retail chain wants to let customers join a guest WLAN without sharing the corporate preshared key, while still keeping guest traffic isolated from point-of-sale systems. Which design best meets these requirements?

A security engineer is reviewing the WLAN configuration of a small business that uses WPA2-Personal. The owner wants to raise resistance to offline dictionary attacks against the preshared key without replacing all client hardware. Which two changes best accomplish this goal? (Choose two.)

An assessor is standing in a parking lot outside a warehouse and needs to map the coverage footprint and identify all BSSIDs in range, including hidden networks, using a passive approach that does not associate to any AP. Which tool and technique fit this requirement?