A company is deploying a new wireless network and wants to ensure that even if an attacker captures the handshake, they cannot crack the password offline. Which feature of WPA3 provides this protection?

SAE (Simultaneous Authentication of Equals)

A legacy industrial control system uses WPA with TKIP because the equipment cannot be upgraded. The security team must decide whether to keep TKIP or find an alternative. Which consideration is most critical?

TKIP is the only option for WPA3 networks

TKIP is deprecated and has known vulnerabilities, so it should be replaced if possible

TKIP is faster than AES-CCMP, so it is preferable for real-time systems

TKIP is still secure if the pre-shared key is long and complex

A multinational corporation is rolling out WPA3-Enterprise across its offices. The security team wants to ensure that each user's traffic is protected even if the RADIUS server's private key is compromised. Which WPA3 feature should they enable?

WPA3-Enterprise with 192-bit security mode

SAE (Simultaneous Authentication of Equals)

A university has a mixed environment with some legacy devices that only support WPA2-PSK and others that support WPA3. The network team wants to maximize security while ensuring all devices can connect. Which configuration is most appropriate?

Use WPA2-Enterprise with 802.1X

Use WPA2/WPA3 mixed mode with AES-CCMP

Use WPA2-PSK with AES-CCMP for all devices

A security analyst is investigating a potential attack on a wireless network that uses WPA with TKIP. The analyst suspects that an attacker is attempting to recover the MIC key. Which characteristic of TKIP makes this attack possible?

TKIP's use of RC4 and the way the MIC key is derived from the PTK allows an attacker to recover the MIC key if they know the PTK

TKIP uses a static MIC key that is shared across all clients

TKIP's MIC is based on a weak algorithm that can be brute-forced

TKIP uses a per-packet key mixing process that is vulnerable to replay attacks

CCIE Security

Domain 3Objective 5

3.5 Wireless Security Technologies CCIE-SECURITY Practice Questions (Page 5)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

10concepts

15%of the exam

Questions 21–25

21application · medium
A company is deploying a new wireless network and wants to ensure that even if an attacker captures the handshake, they cannot crack the password offline. Which feature of WPA3 provides this protection?
Select an answer first
22expert · hard
A legacy industrial control system uses WPA with TKIP because the equipment cannot be upgraded. The security team must decide whether to keep TKIP or find an alternative. Which consideration is most critical?
Select an answer first
23expert · hard
A multinational corporation is rolling out WPA3-Enterprise across its offices. The security team wants to ensure that each user's traffic is protected even if the RADIUS server's private key is compromised. Which WPA3 feature should they enable?
Select an answer first
24expert · hard
A university has a mixed environment with some legacy devices that only support WPA2-PSK and others that support WPA3. The network team wants to maximize security while ensuring all devices can connect. Which configuration is most appropriate?
Select an answer first
25expert · hard
A security analyst is investigating a potential attack on a wireless network that uses WPA with TKIP. The analyst suspects that an attacker is attempting to recover the MIC key. Which characteristic of TKIP makes this attack possible?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.