Wireless Intrusion Prevention Systems (WIPS) provide what network security services? (Choose 2)

Wireless vulnerability assessment

Policy enforcement and compliance management

Configuration distribution for autonomous APs

Wireless vulnerability assessment

Application-layer traffic inspection

Analysis and reporting of AP CPU utilization

Policy enforcement and compliance management

In an effort to optimize WLAN performance, ABC Company has upgraded their WLAN infrastructure from 802.11a/g to 802.11n. 802.11a/g clients are still supported and are used throughout ABC's facility. ABC has always been highly security conscious, but due to budget limitations, they have not yet updated their overlay WIPS solution to 802.11n or 802.11ac.Given ABC's deployment strategy, what security risks would not be detected by the 802.11a/g WIPS?

Rogue AP operating in Greenfield 40 MHz-only mode

Hijacking attack performed by using a rogue 802.11n AP against an 802.11a client

Rogue AP operating in Greenfield 40 MHz-only mode

802.11a STA performing a deauthentication attack against 802.11n APs

802.11n client spoofing the MAC address of an authorized 802.11n client

ABC Company requires the ability to identify and quickly locate rogue devices. ABC has chosen an overlay WIPS solution with sensors that use dipole antennas to perform this task. Use your knowledge of location tracking techniques to answer the question.In what ways can this 802.11-based WIPS platform determine the location of rogue laptops or APs? (Choose 3)

Time Difference of Arrival (TDoA)

Trilateration of RSSI measurements

Time Difference of Arrival (TDoA)

Trilateration of RSSI measurements

Given: Your organization is using EAP as an authentication framework with a specific type that meets the requirements of your corporate policies.Which one of the following statements is true related to this implementation?

The client STAs may communicate over the uncontrolled port in order to authenticate as soon as Open System authentication completes.

The client will be the authenticator in this scenario.

The client STAs must use a different, but complementary, EAP type than the AP STAs.

The client STAs may communicate over the uncontrolled port in order to authenticate as soon as Open System authentication completes.

The client STAs may communicate over the controlled port in order to authenticate as soon as the Open System authentication completes.

Role-Based Access Control (RBAC) allows a WLAN administrator to perform what network function?

Provide two or more user groups connected to the same SSID with different levels of network privileges.

Minimize traffic load on an AP by requiring mandatory admission control for use of the Voice access category.

Allow access to specific files and applications based on the user's WMM access category.

Provide two or more user groups connected to the same SSID with different levels of network privileges.

Allow simultaneous support for multiple EAP types on a single access point.

Given: ABC Company is deploying an IEEE 802.11-compliant wireless security solution using 802.1X/EAP authentication. According to company policy, the security solution must prevent an eavesdropper from decrypting data frames traversing a wireless connection.What security characteristics and/or components play a role in preventing data decryption? (Choose 2)

PLCP Cyclic Redundancy Check (CRC)

Encrypted Passphrase Protocol (EPP)

Given: WLAN attacks are typically conducted by hackers to exploit a specific vulnerability within a network.What statement correctly pairs the type of WLAN attack with the exploited vulnerability? (Choose 3)

RF DoS attacks prevent successful wireless communication on a specific frequency or frequency range.

Hijacking attacks interrupt a user's legitimate connection and introduce a new connection with an evil twin AP.

Social engineering attacks are performed to collect sensitive information from unsuspecting users

Management interface exploit attacks are attacks that use social engineering to gain credentials from managers.

Zero-day attacks are always authentication or encryption cracking attacks.

RF DoS attacks prevent successful wireless communication on a specific frequency or frequency range.

Hijacking attacks interrupt a user's legitimate connection and introduce a new connection with an evil twin AP.

Social engineering attacks are performed to collect sensitive information from unsuspecting users

Association flood attacks are Layer 3 DoS attacks performed against authenticated client stations

Given: A large enterprise is designing a secure, scalable, and manageable 802.11n WLAN that will support thousands of users. The enterprise will support both 802.1X/EAP-TTLS and PEAPv0/MSCHAPv2. Currently, the company is upgrading network servers as well and will replace their existing Microsoft IAS implementation with Microsoft NPS, querying Active Directory for user authentication.For this organization, as they update their WLAN infrastructure, what WLAN controller feature will likely be least valuable?

WPA2-Enterprise authentication/encryption

What WLAN client device behavior is exploited by an attacker during a hijacking attack?

When the RF signal between a client and an access point is disrupted for more than a few seconds, the client device will attempt to associate to an access point with better signal quality.

When the RF signal between a client and an access point is lost, the client will not seek to reassociate with another access point until the 120 second hold down timer has expired.

After the initial association and 4-way handshake, client stations and access points do not need to perform another 4-way handshake, even if connectivity is lost.

As specified by the Wi-Fi Alliance, clients using Open System authentication must allow direct client-to-client connections, even in an infrastructure BSS.

Client drivers scan for and connect to access points in the 2.4 GHz band before scanning the 5 GHz band.

Given: When the CCMP cipher suite is used for protection of data frames, 16 bytes of overhead are added to the Layer 2 frame. 8 of these bytes comprise the MIC.What purpose does the encrypted MIC play in protecting the data frame?

The MIC provides for a cryptographic integrity check against the data payload to ensure that it matches the original transmitted data.

The MIC is used as a first layer of validation to ensure that the wireless receiver does not incorrectly process corrupted signals.

The MIC provides for a cryptographic integrity check against the data payload to ensure that it matches the original transmitted data.

The MIC is a hash computation performed by the receiver against the MAC header to detect replay attacks prior to processing the encrypted payload.

The MIC is a random value generated during the 4-way handshake and is used for key mixing to enhance the strength of the derived PTK.

Given: XYZ Company has recently installed an 802.11ac WLAN. The company needs the ability to control access to network services, such as file shares, intranet web servers, and Internet access based on an employee's job responsibilities.What WLAN security solution meets this requirement?

A WLAN controller with RBAC features

An autonomous AP system with MAC filters

WPA2-Personal with support for LDAP queries

A VPN server with multiple DHCP scopes

A WLAN controller with RBAC features

A WLAN router with wireless VLAN support

Given: Your network includes a controller-based WLAN architecture with centralized data forwarding. The AP builds an encrypted tunnel to the WLAN controller. The WLAN controller is uplinked to the network via a trunked 1 Gbps Ethernet port supporting all necessary VLANs for management, control, and client traffic.What processes can be used to force an authenticated WLAN client's data traffic into a specific VLAN as it exits the WLAN controller interface onto the wired uplink? (Choose 3)

During 802.1X authentication, RADIUS sends a return list attribute to the WLAN controller assigning the user and all traffic to a specific VLAN.

In the WLAN controller's local user database, create a static username-to-VLAN mapping on the WLAN controller to direct data traffic from a specific user to a designated VLAN.

Configure the WLAN controller with static SSID-to-VLAN mappings; the user will be assigned to a VLAN according to the SSID being used.

On the Ethernet switch that connects to the AP, configure the switch port as an access port (not trunking) in the VLAN of supported clients.

During 802.1X authentication, RADIUS sends a return list attribute to the WLAN controller assigning the user and all traffic to a specific VLAN.

In the WLAN controller's local user database, create a static username-to-VLAN mapping on the WLAN controller to direct data traffic from a specific user to a designated VLAN.

Configure the WLAN controller with static SSID-to-VLAN mappings; the user will be assigned to a VLAN according to the SSID being used.

What is the purpose of the Pairwise Transient Key (PTK) in IEEE 802.11 Authentication and Key Management?

The PTK contains keys that are used to encrypt unicast data frames that traverse the wireless medium.

The PTK is a type of master key used as an input to the GMK, which is used for encrypting multicast data frames.

The PTK contains keys that are used to encrypt unicast data frames that traverse the wireless medium.

The PTK is XOR'd with the PSK on the Authentication Server to create the AAA key.

The PTK is used to encrypt the Pairwise Master Key (PMK) for distribution to the 802.1X Authenticator prior to the 4-Way Handshake.

What statements are true about 802.11-2012 Protected Management Frames? (Choose 2)

802.11w frame protection protects against some Layer 2 denial-of-service (DoS) attacks, but it cannot prevent all types of Layer 2 DoS attacks.

Management frame protection protects disassociation and deauthentication frames.

802.11w frame protection protects against some Layer 2 denial-of-service (DoS) attacks, but it cannot prevent all types of Layer 2 DoS attacks.

When frame protection is in use, the PHY preamble and header as well as the MAC header are encrypted with 256- or 512-bit AES.

Authentication, association, and acknowledgment frames are protected if management frame protection is enabled, but deauthentication and disassociation frames are not.

Management frame protection protects disassociation and deauthentication frames.

Which one of the following is a valid reason to avoid the use of EAP-MD5 in production WLANs?

It does not support mutual authentication.

It does not support the outer identity.

It does not support mutual authentication.

It does not support a RADIUS server.

Given: John Smith uses a coffee shop's Internet hot-spot (no authentication or encryption) to transfer funds between his checking and savings accounts at his bank's website. The bank's website uses the HTTPS protocol to protect sensitive account information. While John was using the hot-spot, a hacker was able to obtain John's bank account user ID and password and exploit this information.What likely scenario could have allowed the hacker to obtain John's bank account user ID and password?

John uses the same username and password for banking that he does for email. John used a POP3 email client at the wireless hot-spot to check his email, and the user ID and password were not encrypted.

John's bank is using an expired X.509 certificate on their web server. The certificate is on John's Certificate Revocation List (CRL), causing the user ID and password to be sent unencrypted.

John uses the same username and password for banking that he does for email. John used a POP3 email client at the wireless hot-spot to check his email, and the user ID and password were not encrypted.

John accessed his corporate network with his IPSec VPN software at the wireless hot-spot. An IPSec VPN only encrypts data, so the user ID and password were sent in clear text. John uses the same username and password for banking that he does for his IPSec VPN software.

The bank's web server is using an X.509 certificate that is not signed by a root CA, causing the user ID and password to be sent unencrypted.

Before connecting to the bank's website, John's association to the AP was hijacked. The attacker intercepted the HTTPS public encryption key from the bank's web server and has decrypted John's login credentials in near real-time.

ABC Company uses the wireless network for highly sensitive network traffic. For that reason, they intend to protect their network in all possible ways. They are continually researching new network threats and new preventative measures. They are interested in the security benefits of 802.11w, but would like to know its limitations.What types of wireless attacks are protected by 802.11w? (Choose 2)

Robust management frame replay attacks

Given: You are using a Wireless Aggregator utility to combine multiple packet captures. One capture exists for each of channels 1, 6 and 11. What kind of troubleshooting are you likely performing with such a tool?

Wireless adapter failure analysis.

Narrowband DoS attack detection.

Given: You have a Windows laptop computer with an integrated, dual-band, Wi-Fi compliant adapter. Your laptop computer has protocol analyzer software installed that is capable of capturing and decoding 802.11ac data.What statement best describes the likely ability to capture 802.11ac frames for security testing purposes?

Integrated 802.11ac adapters are not typically compatible with protocol analyzers in Windows laptops. It is often best to use a USB adapter or carefully select a laptop with an integrated adapter that will work.

All integrated 802.11ac adapters will work with most protocol analyzers for frame capture, including the Radio Tap Header.

Integrated 802.11ac adapters are not typically compatible with protocol analyzers in Windows laptops. It is often best to use a USB adapter or carefully select a laptop with an integrated adapter that will work.

Laptops cannot be used to capture 802.11ac frames because they do not support MU-MIMO.

Only Wireshark can be used to capture 802.11ac frames as no other protocol analyzer has implemented the proper frame decodes.

The only method available to capture 802.11ac frames is to perform a remote capture with a compatible access point.

In order to acquire credentials of a valid user on a public hot-spot network, what attacks may be conducted? Choose the single completely correct answer.

Social engineering and/or eavesdropping

MAC denial of service and/or physical theft

Authentication cracking and/or RF DoS

Given: AAA is an architectural framework used to provide three separate security components in a network. Listed below are three phrases that each describe one aspect of the AAA framework.Option-1 --- This AAA function is performed first and validates user identify prior to determining the network resources to which they will be granted access.Option-2 --- This function is used for monitoring and auditing purposes and includes the collection of data that identifies what a user has done while connected.Option-3 --- This function is used to designate permissions to a particular user.What answer correctly pairs the AAA component with the descriptions provided above?

Option-1 -- Authentication Option-2 -- Accounting Option-3 -- Authorization

Option-1 -- Access Control Option-2 -- Authorization Option-3 -- Accounting

Option-1 -- Authentication Option-2 -- Accounting Option-3 -- Association

Option-1 -- Authorization Option-2 -- Access Control Option-3 -- Association

Option-1 -- Authentication Option-2 -- Accounting Option-3 -- Authorization

You have an AP implemented that functions only using 802.11-2012 standard methods for the WLAN communications on the RF side and implementing multiple SSIDs and profiles on the management side configured as follows:1. SSID: Guest -- VLAN 90 -- Security: Open with captive portal authentication -- 2 current clients2. SSID: ABCData -- VLAN 10 -- Security: PEAPv0/EAP-MSCHAPv2 with AES-CCMP -- 5 current clients3. SSID: ABCVoice -- VLAN 60 -- Security: WPA2-Personal -- 2 current clientsTwo client STAs are connected to ABCData and can access a media server that requires authentication at the Application Layer and is used to stream multicast video streams to the clients.What client stations possess the keys that are necessary to decrypt the multicast data packets carrying these videos?

All clients that are associated to the AP using the ABCData SSID

Only the members of the executive team that are part of the multicast group configured on the media server

All clients that are associated to the AP using the ABCData SSID

All clients that are associated to the AP using any SSID

All clients that are associated to the AP with a shared GTK, which includes ABCData and ABCVoice.

You are implementing an 802.11ac WLAN and a WIPS at the same time. You must choose between integrated and overlay WIPS solutions. Which of the following statements is true regarding integrated WIPS solutions?

Many integrated WIPS solutions that detect Voice over Wi-Fi traffic will cease scanning altogether to accommodate the latency sensitive client traffic.

Integrated WIPS always perform better from a client throughput perspective because the same radio that performs the threat scanning also services the clients.

Integrated WIPS use special sensors installed alongside the APs to scan for threats.

Many integrated WIPS solutions that detect Voice over Wi-Fi traffic will cease scanning altogether to accommodate the latency sensitive client traffic.

Integrated WIPS is always more expensive than overlay WIPS.

When used as part of a WLAN authentication solution, what is the role of LDAP?

A data retrieval protocol used by an authentication service such as RADIUS

An IEEE X.500 standard compliant database that participates in the 802.1X port-based access control process

A SQL compliant authentication service capable of dynamic key generation and distribution

A role-based access control protocol for filtering data to/from authenticated stations.

An Authentication Server (AS) that communicates directly with, and provides authentication for, the Supplicant.

Given: ABC Company is implementing a secure 802.11 WLAN at their headquarters (HQ) building in New York and at each of the 10 small, remote branch offices around the United States. 802.1X/EAP is ABC's preferred security solution, where possible. All access points (at the HQ building and all branch offices) connect to a single WLAN controller located at HQ. Each branch office has only a single AP and minimal IT resources.What security best practices should be followed in this deployment scenario?

An encrypted VPN should connect the WLAN controller and each remote controller-based AP, or each remote site should provide an encrypted VPN tunnel to HQ.

APs at HQ and at each branch office should not broadcast the same SSID; instead each branch should have a unique ID for user accounting purposes.

RADIUS services should be provided at branch offices so that authentication server and supplicant credentials are not sent over the Internet.

Remote management of the WLAN controller via Telnet, SSH, HTTP, and HTTPS should be prohibited across the WAN link.

CWNP CWSP-207 Practice Test 1 - Free Online Exam Prep & Questions

What EAP type supports using MS-CHAPv2, EAP-GTC or EAP-TLS for wireless client authentication?

A.

H-REAP

B.

EAP-GTC

C.

EAP-TTLS

D.

PEAP

E.

LEAP

CWNP CWSP-207 Practice Test 1

Question

CWNP CWSP-207 Practice Tests

Practice Tests