Wireless Attack Countermeasures CEH Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company has a flat wireless network where all devices are on the same VLAN. They have experienced a malware infection that spread from a compromised laptop to other devices on the same subnet. They want to redesign the network to limit the blast radius. Which approach is most effective?

   • ASegment the wireless network into multiple VLANs based on device type and user role, with firewall rules between them
   • BImplement MAC address filtering on all access points
   • CUse a stronger encryption protocol like WPA3
   • DDisable SSID broadcast to make the network less discoverable
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   During a site survey, a security analyst finds an unauthorized access point plugged into the wired network in a conference room. The analyst needs to identify the switch port it is connected to so the port can be disabled. Which technique is most effective?

   • AUse a spectrum analyzer to locate the AP's physical position
   • BUse the switch's MAC address table to locate the port associated with the AP's MAC address
   • CUse a wireless packet sniffer to capture the AP's BSSID and then search the switch logs
   • DDeploy a WIPS to automatically block the rogue AP
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company wants to provide wireless access to contractors who should only be able to reach the internet, not internal resources. The contractors will use their own devices. Which approach should be used?

   • AUse the same SSID as employees but with a different pre-shared key.
   • BDisable SSID broadcast and provide the SSID to contractors manually.
   • CUse MAC address filtering to allow only contractor devices.
   • DCreate a guest SSID on a separate VLAN with a firewall rule that allows only outbound internet traffic.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is a benefit of using network segmentation for wireless networks?

   • AIt limits the ability of an attacker to move laterally from a compromised wireless device to other network segments.
   • BIt prevents all denial-of-service attacks.
   • CIt automatically encrypts all wireless traffic.
   • DIt eliminates the need for wireless intrusion detection.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the main difference between a Wireless Intrusion Detection System (WIDS) and a Wireless Intrusion Prevention System (WIPS)?

   • AA WIDS uses encryption, while a WIPS uses authentication.
   • BA WIDS is software-based, while a WIPS is hardware-based.
   • CA WIDS only monitors and alerts, while a WIPS can actively block or contain threats.
   • DA WIDS is used for wired networks, while a WIPS is used for wireless networks.
   Reveal Solution Discussion Select an answer first