Wireless Security CNX-001 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A small law firm has a legacy wireless network using WPA2-PSK with a shared passphrase printed on a card at the front desk. The firm's compliance officer requires that each attorney's laptop be authenticated individually so that access can be revoked immediately when an attorney leaves the firm, without changing the passphrase for everyone. The firm has an on-premises Active Directory domain and a Windows Server that can run the Network Policy Server (NPS) role. Which configuration should you implement?

   • AImplement MAC address filtering on the access points to allow only the attorneys' known laptop MAC addresses.
   • BConfigure WPA2-Enterprise with PEAP-MSCHAPv2, using the NPS server as a RADIUS proxy to authenticate against Active Directory.
   • CDeploy WPA3-SAE with a new shared passphrase distributed only to current attorneys.
   • DEnable WPA2-PSK with a longer, more complex passphrase and schedule monthly passphrase rotations.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is deploying a wireless network for a temporary project team. The team will work for 3 months and then be disbanded. The security team wants to use WPA2-Enterprise with a RADIUS server, but the project team members do not have Active Directory accounts. Which approach is the most efficient for this temporary deployment?

   • ACreate temporary Active Directory accounts for the project team members and configure the RADIUS server to authenticate against AD.
   • BConfigure the RADIUS server to use a local user database instead of Active Directory.
   • CUse WPA2-PSK with a shared passphrase for the project team.
   • DDeploy a separate RADIUS server for the project team.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A retail store has a single wireless access point broadcasting two SSIDs: 'Store-Guest' and 'Store-Corporate'. The corporate SSID is used by managers' tablets to access inventory systems. The store manager wants to ensure that a compromised guest device cannot reach the corporate network or the wired inventory servers. Which configuration is the most effective?

   • ADisable the guest SSID and require customers to use a separate physical access point.
   • BPlace each SSID on a separate VLAN and configure a firewall rule to block traffic from the guest VLAN to the corporate VLAN.
   • CUse a stronger encryption protocol, such as WPA3, on both SSIDs.
   • DEnable client isolation on the corporate SSID only.
   Reveal Solution Discussion Select an answer first
5. 9application · hard

   A school district is deploying a wireless network for students. The district wants to use WPA2-Enterprise with PEAP-MSCHAPv2, but the IT team is concerned about the security of MSCHAPv2. Which configuration change would most directly address this concern while maintaining compatibility with student devices that do not support certificates?

   • AUse a RADIUS server that supports EAP-PEAP with a strong server certificate and enforce a minimum password length.
   • BUse a very long and complex password policy for student accounts.
   • CImplement EAP-TTLS with PAP as the inner method.
   • DSwitch to EAP-TLS and deploy client certificates to all student devices.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A hospital is upgrading its wireless infrastructure. The security team must select an encryption protocol that provides the strongest protection against offline dictionary attacks on captured handshakes. The network will use a pre-shared key model for a guest SSID. Which protocol should the team choose?

   • AWPA3 with SAE (Simultaneous Authentication of Equals)
   • BWEP with 128-bit keys
   • CWPA2 with CCMP (AES)
   • DWPA2 with TKIP
   Reveal Solution Discussion Select an answer first