Wireless Attack Countermeasures CEH Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A security administrator discovers a rogue access point that is using the same SSID as the corporate network and is also configured with WPA2-Enterprise and a valid certificate. The administrator suspects that the rogue AP is using a compromised certificate. What is the most effective way to mitigate this threat?

   • AIncrease the WIPS deauthentication frequency to disconnect all clients from the rogue AP.
   • BChange the corporate SSID to a new name that the rogue AP is not using.
   • CDisable 802.1X authentication and use WPA2-Personal with a strong passphrase.
   • DRevoke the compromised certificate and update the WIPS rules to block the rogue AP's BSSID.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A network administrator discovers a rogue access point that is not connected to the wired network but is broadcasting a corporate SSID to trick users. The administrator wants to prevent clients from connecting to it. Which action is most effective?

   • ADisable the corporate SSID on all legitimate APs
   • BConduct a site survey to locate the rogue AP physically
   • CAdd the rogue AP's MAC address to a blocklist on the firewall
   • DUse a WIPS to send deauthentication frames to clients attempting to connect to the rogue AP
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A security analyst is deploying a WIDS to monitor for rogue APs. The analyst wants to reduce false positives from neighboring businesses' Wi-Fi networks. Which configuration is most effective?

   • AUse a spectrum analyzer to identify all APs in the area
   • BDisable alerts for APs with weak signal strength
   • CCreate an approved AP list and configure the WIDS to only alert on APs that are not on the list
   • DSet the WIDS to alert on any AP that is not broadcasting the corporate SSID
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A large enterprise has a WIPS deployed, but the security team is concerned that the WIPS may be interfering with legitimate wireless clients that roam between access points. The team wants to maintain protection against rogue APs while minimizing disruption. Which configuration should be used?

   • ADisable active containment and rely solely on passive monitoring.
   • BEnable active containment for all unknown access points immediately upon detection.
   • CUse a longer deauthentication interval to reduce the impact on legitimate clients.
   • DEnable active containment only for access points that are confirmed as rogue by a second sensor.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A security analyst is investigating a potential rogue access point that is broadcasting the same SSID as the corporate network. The analyst wants to confirm whether the device is truly rogue before taking action. Which step should the analyst take first?

   • AChange the wireless encryption protocol to WPA3 to prevent the rogue device from operating.
   • BCompare the MAC address and BSSID of the suspected device against the inventory of authorized access points.
   • CDisable the corporate SSID on all legitimate access points to force clients to reconnect.
   • DImmediately send deauthentication frames to all clients connected to the suspected device.
   Reveal Solution Discussion Select an answer first