Black Friday Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70special

CWNP CWSP-207 Certified Wireless Security Professional (CWSP) Exam Practice Test

Page: 1 / 12
Total 119 questions

Certified Wireless Security Professional (CWSP) Questions and Answers

Testing Engine

  • Product Type: Testing Engine
$37.5  $124.99

PDF Study Guide

  • Product Type: PDF Study Guide
$33  $109.99
Question 1

What drawbacks initially prevented the widespread acceptance and use of Opportunistic Key Caching (OKC)?

Options:

A.

Sharing cached keys between controllers during inter-controller roaming created vulnerabilities that exposed the keys to attackers.

B.

Because OKC is not defined by any standards or certification body, client support was delayed and sporadic early on.

C.

Key exchanges during fast roams required processor-intensive cryptography, which was prohibitive for legacy devices supporting only TKIP.

D.

The Wi-Fi Alliance continually delayed the creation of a client certification for OKC, even though it was defined by IEEE 802.11r.

Question 2

Role-Based Access Control (RBAC) allows a WLAN administrator to perform what network function?

Options:

A.

Minimize traffic load on an AP by requiring mandatory admission control for use of the Voice access category.

B.

Allow access to specific files and applications based on the user's WMM access category.

C.

Provide two or more user groups connected to the same SSID with different levels of network privileges.

D.

Allow simultaneous support for multiple EAP types on a single access point.

Question 3

Given: You support a coffee shop and have recently installed a free 802.11ac wireless hot-spot for the benefit of your customers. You want to minimize legal risk in the event that the hot-spot is used for illegal Internet activity.

What option specifies the best approach to minimize legal risk at this public hot-spot while maintaining an open venue for customer Internet access?

Options:

A.

Configure WPA2-Enterprise security on the access point

B.

Block TCP port 25 and 80 outbound on the Internet router

C.

Require client STAs to have updated firewall and antivirus software

D.

Allow only trusted patrons to use the WLAN

E.

Use a WIPS to monitor all traffic and deauthenticate malicious stations

F.

Implement a captive portal with an acceptable use disclaimer

Question 4

Given: ABC Company secures their network with WPA2-Personal authentication and AES-CCMP encryption.

What part of the 802.11 frame is always protected from eavesdroppers by this type of security?

Options:

A.

All MSDU contents

B.

All MPDU contents

C.

All PPDU contents

D.

All PSDU contents

Question 5

Given: You are using WEP as an encryption solution. You are using VLANs for network segregation.

Why can you not establish an RSNA?

Options:

A.

RSNA connections require TKIP or CCMP.

B.

RSNA connections require BIP and do not support TKIP, CCMP or WEP.

C.

RSNA connections require CCMP and do not support TKIP or WEP.

D.

RSNA connections do not work in conjunction with VLANs.

Question 6

When using a tunneled EAP type, such as PEAP, what component is protected inside the TLS tunnel so that it is not sent in clear text across the wireless medium?

Options:

A.

X.509 certificates

B.

User credentials

C.

Server credentials

D.

RADIUS shared secret

Question 7

What are the three roles of the 802.1X framework, as defined by the 802.1X standard, that are performed by the client STA, the AP (or WLAN controller), and the RADIUS server? (Choose 3)

Options:

A.

Enrollee

B.

Registrar

C.

AAA Server

D.

Authentication Server

E.

Supplicant

F.

Authenticator

G.

Control Point

Question 8

What wireless security protocol provides mutual authentication without using an X.509 certificate?

Options:

A.

EAP-FAST

B.

EAP-MD5

C.

EAP-TLS

D.

PEAPv0/EAP-MSCHAPv2

E.

EAP-TTLS

F.

PEAPv1/EAP-GTC

Question 9

In the basic 4-way handshake used in secure 802.11 networks, what is the purpose of the ANonce and SNonce? (Choose 2)

Options:

A.

They are used to pad Message 1 and Message 2 so each frame contains the same number of bytes.

B.

The IEEE 802.11 standard requires that all encrypted frames contain a nonce to serve as a Message Integrity Check (MIC).

C.

They are added together and used as the GMK, from which the GTK is derived.

D.

They are input values used in the derivation of the Pairwise Transient Key.

E.

They allow the participating STAs to create dynamic keys while avoiding sending unicast encryption keys across the wireless medium.

Question 10

Given: You have implemented strong authentication and encryption mechanisms for your enterprise 802.11 WLAN using 802.1X/EAP with AES-CCMP.

For users connecting within the headquarters office, what other security solution will provide continuous monitoring of both clients and APs with 802.11-specific tracking?

Options:

A.

IPSec VPN client and server software

B.

Internet firewall software

C.

Wireless intrusion prevention system

D.

WLAN endpoint agent software

E.

RADIUS proxy server

Question 11

You must locate non-compliant 802.11 devices. Which one of the following tools will you use and why?

Options:

A.

A spectrum analyzer, because it can show the energy footprint of a device using WPA differently from a device using WPA2.

B.

A spectrum analyzer, because it can decode the PHY preamble of a non-compliant device.

C.

A protocol analyzer, because it can be used to view the spectrum energy of non-compliant 802.11 devices, which is always different from compliant devices.

D.

A protocol analyzer, because it can be used to report on security settings and regulatory or rule compliance

Question 12

What security vulnerabilities may result from a lack of staging, change management, and installation procedures for WLAN infrastructure equipment? (Choose 2)

Options:

A.

The WLAN system may be open to RF Denial-of-Service attacks

B.

WIPS may not classify authorized, rogue, and neighbor APs accurately

C.

Authentication cracking of 64-bit Hex WPA-Personal PSK

D.

Management interface exploits due to the use of default usernames and passwords for AP management

E.

AES-CCMP encryption keys may be decrypted

Question 13

You have been recently hired as the wireless network administrator for an organization spread across seven locations. They have deployed more than 100 APs, but they have not been managedin either an automated or manual process for more than 18 months. Given this length of time, what is one of the first things you should evaluate from a security perspective?

Options:

A.

The channel widths configured

B.

The channels in use

C.

The VLANs in use

D.

The firmware revision

Question 14

Given: XYZ Hospital plans to improve the security and performance of their Voice over Wi-Fi implementation and will be upgrading to 802.11n phones with 802.1X/EAP authentication. XYZ would like to support fast secure roaming for the phones and will require the ability to troubleshoot reassociations that are delayed or dropped during inter-channel roaming.

What portable solution would be recommended for XYZ to troubleshoot roaming problems?

Options:

A.

WIPS sensor software installed on a laptop computer

B.

Spectrum analyzer software installed on a laptop computer

C.

An autonomous AP mounted on a mobile cart and configured to operate in monitor mode

D.

Laptop-based protocol analyzer with multiple 802.11n adapters

Question 15

What preventative measures are performed by a WIPS against intrusions?

Options:

A.

EAPoL Reject frame flood against a rogue AP

B.

Evil twin attack against a rogue AP

C.

Deauthentication attack against a classified neighbor AP

D.

ASLEAP attack against a rogue AP

E.

Uses SNMP to disable the switch port to which rogue APs connect

Question 16

The following numbered items show some of the contents of each of the four frames exchanged during the 4-way handshake:

1. Encrypted GTK sent

2. Confirmation of temporal key installation

3. Anonce sent from authenticator to supplicant

4. Snonce sent from supplicant to authenticator, MIC included

Arrange the frames in the correct sequence beginning with the start of the 4-way handshake.

Options:

A.

2, 3, 4, 1

B.

1, 2, 3, 4

C.

4, 3, 1, 2

D.

3, 4, 1, 2

Question 17

For a WIPS system to identify the location of a rogue WLAN device using location patterning (RF fingerprinting), what must be done as part of the WIPS installation?

Options:

A.

All WIPS sensors must be installed as dual-purpose (AP/sensor) devices.

B.

A location chipset (GPS) must be installed with it.

C.

At least six antennas must be installed in each sensor.

D.

The RF environment must be sampled during an RF calibration process.

Question 18

In an effort to optimize WLAN performance, ABC Company has upgraded their WLAN infrastructure from 802.11a/g to 802.11n. 802.11a/g clients are still supported and are used throughout ABC’s facility. ABC has always been highly security conscious, but due to budget limitations, they have not yet updated their overlay WIPS solution to 802.11n or 802.11ac.

Given ABC’s deployment strategy, what security risks would not be detected by the 802.11a/g WIPS?

Options:

A.

Hijacking attack performed by using a rogue 802.11n AP against an 802.11a client

B.

Rogue AP operating in Greenfield 40 MHz-only mode

C.

802.11a STA performing a deauthentication attack against 802.11n APs

D.

802.11n client spoofing the MAC address of an authorized 802.11n client

Question 19

Given: John Smith uses a coffee shop's Internet hot-spot (no authentication or encryption) to transfer funds between his checking and savings accounts at his bank's website. The bank’s website uses the HTTPS protocol to protect sensitive account information. While John was using the hot-spot, a hacker was able to obtain John’s bank account user ID and password and exploit this information.

What likely scenario could have allowed the hacker to obtain John’s bank account user ID and password?

Options:

A.

John's bank is using an expired X.509 certificate on their web server. The certificate is on John's Certificate Revocation List (CRL), causing the user ID and password to be sent unencrypted.

B.

John uses the same username and password for banking that he does for email. John used a POP3 email client at the wireless hot-spot to check his email, and the user ID and password were not encrypted.

C.

John accessed his corporate network with his IPSec VPN software at the wireless hot-spot. An IPSec VPN only encrypts data, so the user ID and password were sent in clear text. John uses the same username and password for banking that he does for his IPSec VPN software.

D.

The bank’s web server is using an X.509 certificate that is not signed by a root CA, causing the user ID and password to be sent unencrypted.

E.

Before connecting to the bank’s website, John’s association to the AP was hijacked. The attacker intercepted the HTTPS public encryption key from the bank’s web server and has decrypted John’s login credentials in near real-time.

Question 20

Given: Many computer users connect to the Internet at airports, which often have 802.11n access points with a captive portal for authentication.

While using an airport hot-spot with this security solution, to what type of wireless attack is a user susceptible? (Choose 2)

Options:

A.

Man-in-the-Middle

B.

Wi-Fi phishing

C.

Management interface exploits

D.

UDP port redirection

E.

IGMP snooping

Question 21

Given: You have a Windows laptop computer with an integrated, dual-band, Wi-Fi compliant adapter. Your laptop computer has protocol analyzer software installed that is capable of capturing and decoding 802.11ac data.

What statement best describes the likely ability to capture 802.11ac frames for security testing purposes?

Options:

A.

All integrated 802.11ac adapters will work with most protocol analyzers for frame capture, including the Radio Tap Header.

B.

Integrated 802.11ac adapters are not typically compatible with protocol analyzers in Windows laptops. It is often best to use a USB adapter or carefully select a laptop with an integrated adapter that will work.

C.

Laptops cannot be used to capture 802.11ac frames because they do not support MU-MIMO.

D.

Only Wireshark can be used to capture 802.11ac frames as no other protocol analyzer has implemented the proper frame decodes.

E.

The only method available to capture 802.11ac frames is to perform a remote capture with a compatible access point.

Question 22

Which of the following security attacks cannot be detected by a WIPS solution of any kind? (Choose 2)

Options:

A.

Rogue APs

B.

DoS

C.

Eavesdropping

D.

Social engineering

Question 23

In order to acquire credentials of a valid user on a public hot-spot network, what attacks may be conducted? Choose the single completely correct answer.

Options:

A.

Social engineering and/or eavesdropping

B.

RF DoS and/or physical theft

C.

MAC denial of service and/or physical theft

D.

Authentication cracking and/or RF DoS

E.

Code injection and/or XSS

Question 24

An attack is under way on the network. The attack is preventing users from accessing resources required for business operations, but the attacker has not gained access to any files or data. What kind of attack is described?

Options:

A.

Man-in-the-middle

B.

Hijacking

C.

ASLEAP

D.

DoS

Question 25

Given: WLAN attacks are typically conducted by hackers to exploit a specific vulnerability within a network.

What statement correctly pairs the type of WLAN attack with the exploited vulnerability? (Choose 3)

Options:

A.

Management interface exploit attacks are attacks that use social engineering to gain credentials from managers.

B.

Zero-day attacks are always authentication or encryption cracking attacks.

C.

RF DoS attacks prevent successful wireless communication on a specific frequency or frequency range.

D.

Hijacking attacks interrupt a user’s legitimate connection and introduce a new connection with an evil twin AP.

E.

Social engineering attacks are performed to collect sensitive information from unsuspecting users

F.

Association flood attacks are Layer 3 DoS attacks performed against authenticated client stations

Question 26

You are configuring seven APs to prevent common security attacks. The APs are to be installed in a small business and to reduce costs, the company decided to install all consumer-grade wireless routers. The wireless routers will connect to a switch, which connects directly to the Internet connection providing 50 Mbps of Internet bandwidth that will be shared among 53 wireless clients and 17 wired clients.

To ensure the wireless network is as secure as possible from common attacks, what security measure can you implement given only the hardware referenced?

Options:

A.

WPA-Enterprise

B.

802.1X/EAP-PEAP

C.

WPA2-Enterprise

D.

WPA2-Personal

Question 27

ABC Company uses the wireless network for highly sensitive network traffic. For that reason, they intend to protect their network in all possible ways. They are continually researching new network threats and new preventative measures. They are interested in the security benefits of 802.11w, but would like to know its limitations.

What types of wireless attacks are protected by 802.11w? (Choose 2)

Options:

A.

RF DoS attacks

B.

Layer 2 Disassociation attacks

C.

Robust management frame replay attacks

D.

Social engineering attacks

Question 28

As the primary security engineer for a large corporate network, you have been asked to author a new security policy for the wireless network. While most client devices support 802.1X authentication, some legacy devices still only support passphrase/PSK-based security methods.

When writing the 802.11 security policy, what password-related items should be addressed?

Options:

A.

MSCHAPv2 passwords used with EAP/PEAPv0 should be stronger than typical WPA2-PSK passphrases.

B.

Password complexity should be maximized so that weak WEP IV attacks are prevented.

C.

Static passwords should be changed on a regular basis to minimize the vulnerabilities of a PSK-based authentication.

D.

Certificates should always be recommended instead of passwords for 802.11 client authentication.

E.

EAP-TLS must be implemented in such scenarios.

Question 29

As a part of a large organization’s security policy, how should a wireless security professional address the problem of rogue access points?

Options:

A.

Use a WPA2-Enterprise compliant security solution with strong mutual authentication and encryption for network access of corporate devices.

B.

Hide the SSID of all legitimate APs on the network so that intruders cannot copy this parameter on rogue APs.

C.

Conduct thorough manual facility scans with spectrum analyzers to detect rogue AP RF signatures.

D.

A trained employee should install and configure a WIPS for rogue detection and response measures.

E.

Enable port security on Ethernet switch ports with a maximum of only 3 MAC addresses on each port.

Question 30

What policy would help mitigate the impact of peer-to-peer attacks against wireless-enabled corporate laptop computers when the laptops are also used on public access networks such as wireless hot-spots?

Options:

A.

Require Port Address Translation (PAT) on each laptop.

B.

Require secure applications such as POP, HTTP, and SSH.

C.

Require VPN software for connectivity to the corporate network.

D.

Require WPA2-Enterprise as the minimal WLAN security solution.

Question 31

In what deployment scenarios would it be desirable to enable peer-to-peer traffic blocking?

Options:

A.

In home networks in which file and printer sharing is enabled

B.

At public hot-spots in which many clients use diverse applications

C.

In corporate Voice over Wi-Fi networks with push-to-talk multicast capabilities

D.

In university environments using multicast video training sourced from professor’s laptops

Question 32

What elements should be addressed by a WLAN security policy? (Choose 2)

Options:

A.

Enabling encryption to prevent MAC addresses from being sent in clear text

B.

How to prevent non-IT employees from learning about and reading the user security policy

C.

End-user training for password selection and acceptable network use

D.

The exact passwords to be used for administration interfaces on infrastructure devices

E.

Social engineering recognition and mitigation techniques

Question 33

Given: ABC Hospital wishes to create a strong security policy as a first step in securing their 802.11 WLAN.

Before creating the WLAN security policy, what should you ensure you possess?

Options:

A.

Awareness of the exact vendor devices being installed

B.

Management support for the process

C.

End-user training manuals for the policies to be created

D.

Security policy generation software

Page: 1 / 12
Total 119 questions