GSEC Wireless Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Implement MAC address filtering on all wireless access points.

  Why it's wrong here

  MAC filtering is ineffective as a security control because attackers can easily spoof legitimate MAC addresses using simple software tools. It provides no encryption or authentication, only a weak form of access control that is easily bypassed by anyone performing basic wireless traffic analysis or network reconnaissance.

• ✓

  Transition to WPA2-Enterprise utilizing 802.1X authentication with EAP-TLS.

  Why this is correct

  WPA2-Enterprise leverages 802.1X, which requires unique authentication per user, typically via certificates or domain credentials. This approach prevents credential sharing because each session is cryptographically bound to an individual identity, allowing administrators to revoke specific access without impacting the entire wireless network architecture or changing shared passwords.

• ✗

  Increase the PSK complexity to a 64-character alphanumeric string.

  Why it's wrong here

  While complex pre-shared keys are harder to brute-force, they do not solve the fundamental problem of credential sharing. If an employee shares the PSK, the security of the entire network is compromised. Furthermore, complex keys are difficult to manage and update across large fleets of mobile devices.

• ✗

  Enable hidden SSIDs to prevent unauthorized discovery.

  Why it's wrong here

  Hiding the SSID is a form of security through obscurity and does not prevent unauthorized connections. Attackers can easily discover hidden SSIDs by monitoring 802.11 management frames, such as probe requests or association frames, making this an ineffective control for protecting enterprise wireless network access.