Wireless Security Protocols practice questions

WPA2-PSK with TKIP.

Why wrong: TKIP is deprecated and insecure; it is not the strongest available.

WPA2-PSK with AES.

Why wrong: AES is strong, but WPA3-SAE is stronger and more modern.

A mixed mode of WPA2 and WPA3.

Why wrong: Mixed mode may allow devices to connect using the less secure WPA2, violating the policy.

Enable WPA3-SAE on all access points.

Why wrong: WPA3-SAE does not inherently provide fast roaming; 802.11r is needed.

Configure all access points with the same SSID and passphrase.

Why wrong: This is already standard; it does not enable fast roaming.

Disable WPS on all access points.

Why wrong: Disabling WPS is a security measure but does not affect roaming performance.

The laptop is using an outdated WEP encryption protocol.

Why wrong: WEP is not used with WPA2-PSK, so this is incorrect.

The router's DHCP lease time is set too short.

Why wrong: DHCP lease time affects IP address assignment, not the 4-way handshake.

The router is configured for WPA2-Enterprise instead of WPA2-PSK.

Why wrong: WPA2-Enterprise would require a RADIUS server, but the logs show PSK handshake errors, not authentication server issues.

The phone's Wi-Fi antenna is damaged.

Why wrong: Other devices connect fine, so the antenna is not the issue.

The router's SSID is hidden.

Why wrong: Other devices connect, so the SSID is not hidden.

The phone's MAC address is filtered.

Why wrong: MAC filtering would block all connections, but other devices connect.

WPA2-PSK with a longer passphrase.

Why wrong: A longer passphrase makes cracking harder but does not prevent handshake capture and offline attacks.

WPA2-Enterprise with PEAP-MSCHAPv2.

Why wrong: While more secure, PEAP-MSCHAPv2 can still be vulnerable to credential harvesting if not properly configured.

WPA2-PSK with TKIP.

Why wrong: TKIP is even less secure and also vulnerable to handshake capture attacks.

Enable WPS for easy device pairing.

Why wrong: WPS has known vulnerabilities that can expose the passphrase.

Disable SSID broadcast.

Why wrong: Hiding the SSID provides minimal security and can cause connectivity issues.

Enable MAC address filtering.

Why wrong: MAC filtering can be easily bypassed by spoofing, so it is not a strong security measure.

The router may not support modern encryption protocols.

Why wrong: While true, this is a compatibility issue, not the most immediate security risk.

The router's firmware is likely outdated and vulnerable to exploits.

Why wrong: This is a separate issue; the WEP encryption itself is the primary risk.

WEP does not support WPA2-PSK, so clients must use a different protocol.

Why wrong: This is a limitation but not the most immediate security threat.

Enable WPA3-SAE for all devices.

Why wrong: WPA3 is not supported by legacy WPA-TKIP devices.

Use WPA2-PSK with TKIP encryption.

Why wrong: TKIP is insecure and should be avoided; it also does not provide the best security for modern devices.

Configure the router for WPA2-PSK with AES and enable WPA-TKIP as a fallback.

Why wrong: Most routers do not allow mixed mode with both simultaneously; they use a transitional security mode that is less secure.

The access point is using a different channel than the others.

Why wrong: Channel differences affect signal interference, not RADIUS authentication.

The RADIUS server certificate has expired.

Why wrong: An expired certificate would cause client authentication failures, not access point-to-RADIUS failures.

The clients are using WPA2-PSK instead of WPA2-Enterprise.

Why wrong: Client misconfiguration would not cause RADIUS server logs to show failures from the access point.

WPA3-Personal with MAC address filtering.

Why wrong: MAC filtering is easily bypassed and does not isolate traffic.

WPA2-Enterprise with a RADIUS server and no guest network.

Why wrong: WPA2-Enterprise is overkill for a small business and does not provide guest isolation.

WEP encryption with a hidden SSID.

Why wrong: WEP is insecure and easily cracked; hiding the SSID does not provide real security or isolation.

The rogue AP may cause radio frequency interference with the corporate WLAN.

Why wrong: While interference is possible, the immediate security risk of unauthorized network access is far more critical.

The rogue AP will consume additional power from the corporate UPS.

Why wrong: Power consumption is a minor operational concern, not a security risk.

The rogue AP's DHCP server may conflict with the corporate DHCP server.

Why wrong: DHCP conflicts can cause IP address issues, but the primary concern is the security breach from an open network.

Use WPA2-PSK with a simple password like 'coffee123'.

Why wrong: This still requires a password, which the owner does not want; it also provides encryption but is not 'no password'.

Enable WPA3-Enterprise with certificate-based authentication.

Why wrong: This is overly complex for a coffee shop and requires certificates, defeating the purpose of easy access.

Use WEP with a shared key printed on a receipt.

Why wrong: WEP is insecure and deprecated; it also requires a key, not a 'no password' scenario.

Enable MAC address filtering on the access point.

Why wrong: MAC filtering is an additional security layer but does not provide certificate-based authentication; it can be easily spoofed.

Upgrade to WPA3-Personal.

Why wrong: WPA3-Personal uses SAE (Simultaneous Authentication of Equals) but still relies on a shared passphrase, not certificates.

Change the encryption from AES to TKIP.

Why wrong: TKIP is a weaker encryption protocol and does not support certificate-based authentication; it is also deprecated.

The laptop's wireless adapter is faulty.

Why wrong: A faulty adapter would likely prevent association entirely; the user can connect but not access resources.

The access point is broadcasting on a congested channel.

Why wrong: Channel congestion would cause slow speeds or disconnections, not a complete inability to access resources after connection.

The laptop has an incorrect IP address from DHCP.

Why wrong: An incorrect IP would cause connectivity issues, but the user is connected to the Wi-Fi; DHCP issues are less likely given other users work.

The router's SSID is hidden.

Why wrong: A hidden SSID would prevent the network from appearing in the list, but the laptops can still connect manually; this is not specific to the security protocol version.

The router is broadcasting on a 5 GHz band only.

Why wrong: While older laptops may lack 5 GHz support, this is a band compatibility issue, not a security protocol issue; the scenario specifically points to the security upgrade.

The laptops have incorrect DNS settings.

Why wrong: Incorrect DNS would cause browsing issues after connection, but would not prevent the initial Wi-Fi association and authentication.

WPA2-PSK with PEAP-MSCHAPv2.

Why wrong: WPA2-PSK uses a pre-shared key, not 802.1X; PEAP-MSCHAPv2 uses passwords, not smart cards.

WPA3-Personal with SAE.

Why wrong: WPA3-Personal is for home/small office; it does not support 802.1X or smart card authentication.

WPA3-Enterprise with EAP-TTLS.

Why wrong: While WPA3-Enterprise is secure, EAP-TTLS typically uses passwords and is less secure than EAP-TLS; also, the question asks for smart card support, which is best with EAP-TLS.

The router's firmware is outdated.

Why wrong: While outdated firmware can cause issues, the sudden change after switching security modes points directly to the authentication method change.

The devices do not support the new encryption cipher.

Why wrong: WPA2-Enterprise still uses AES encryption, which is widely supported; the issue is with authentication, not encryption.

The SSID was changed during the configuration.

Why wrong: Changing the SSID would require reconnecting devices, but the customer only mentioned changing the security mode, not the network name.

WEP

Why wrong: WEP is an outdated and easily cracked protocol; it should never be used in a modern environment.

WPA2-TKIP

Why wrong: TKIP is a legacy encryption method that is no longer considered secure; WPA2 should use AES-CCMP.

WPA2-Enterprise

Why wrong: While secure, WPA2-Enterprise requires a RADIUS server, which adds complexity and cost; the question asks for the strongest standard compatible with the devices, implying a simpler setup.

Change the encryption from AES to TKIP.

Why wrong: TKIP is weaker and also vulnerable to KRACK; this would not improve security.

Enable WPA2-Enterprise with 802.1X.

Why wrong: WPA2-Enterprise still uses the same four-way handshake and is vulnerable to KRACK attacks; it does not address the vulnerability.

Implement MAC address filtering.

Why wrong: MAC filtering is an access control measure, not an encryption protocol; it does not protect against KRACK attacks.

Update the wireless adapter driver.

Why wrong: Driver updates are a valid step, but since other identical laptops connect fine, the issue is more likely configuration-specific.

Change the router's security protocol to WPA3.

Why wrong: Changing the protocol would affect all users and is not a targeted fix for a single device.

Disable the firewall on the laptop.

Why wrong: Firewalls typically block inbound traffic, not outbound connections; disabling it is unlikely to fix a connection failure at the Wi-Fi association stage.