GSEC Wireless Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Deploy a Wireshark capture on the wired uplink of the wireless controller to enumerate all BSSIDs in the coverage area.

  Why it's wrong here

  A wired capture on the controller uplink shows management and data traffic after it has been bridged, not raw 802.11 radio frames. Beacons never traverse the wired side, so BSSIDs of neighboring or rogue APs are invisible. This approach also requires physical or logical access to the controller infrastructure and cannot measure the outdoor coverage footprint at the parking lot location.

• ✗

  Use Nmap with the wireless scripts enabled to enumerate BSSIDs by sending 802.11 probe requests from a managed interface.

  Why it's wrong here

  Nmap operates at Layer 3 and above and does not perform 802.11 frame capture or channel scanning. Its scripts target network services on reachable hosts, not radio-layer identifiers like BSSIDs. A managed interface will not expose beacon frames to Nmap, so this approach cannot map coverage or enumerate hidden networks, and it would require IP connectivity that a passive survey does not have.

• ✓

  Use Kismet in monitor mode with a supported adapter to passively capture beacon, probe response, and data frames across channels.

  Why this is correct

  Kismet places the adapter in monitor mode, which captures all 802.11 frames on the channel without associating. Beacons and probe responses reveal BSSIDs, SSIDs, channels, and encryption settings, while hidden networks appear through probe responses and data frames. Because no association occurs, the assessor stays passive and avoids altering or alerting the target network.

• ✗

  Run airodump-ng in managed mode and associate to each detected SSID to confirm its encryption type.

  Why it's wrong here

  Managed mode requires the adapter to join a network before capturing traffic, which breaks the passivity requirement and generates association events on the target. Airodump-ng is designed to run in monitor mode; using it in managed mode limits visibility to the associated BSS only. Associating to each SSID also risks triggering alerts and is unnecessary because encryption details are advertised in beacons.