A manufacturing plant has an air-gapped control network for its robotic systems. The plant manager wants to allow wireless monitoring of the robots for maintenance, but the security team is concerned about bridging the air gap. The plant has a tight budget and cannot afford a full WIDS deployment. Which mitigation strategy provides the BEST balance of enabling wireless maintenance while minimizing the risk of air gap bridging?

Implementing a policy that requires maintenance workers to sign a waiver acknowledging the risks

Installing a Faraday cage around the entire control network

Deploying a dedicated wireless network for maintenance with strong encryption and a separate VLAN, and disabling all other wireless interfaces on the control network

Using a low-power wireless signal that only covers the immediate maintenance area

A military base has an air-gapped network for classified data. The security team deploys a WIDS to monitor for wireless bridging attempts. Which WIDS capability is most important for detecting a rogue access point that is configured to use a legitimate-looking SSID?

The ability to decrypt all wireless traffic to inspect for data exfiltration.

The ability to perform spectrum analysis to detect non-standard signals.

The ability to compare the detected AP's MAC address and behavior against a list of authorized APs.

The ability to block all wireless signals in the area.

A university's research network is air-gapped from the internet. The security team deploys a WIDS to monitor for unauthorized wireless activity. Which WIDS feature is MOST useful for detecting a client misassociation attack where a researcher's laptop accidentally connects to a rogue AP that is also connected to the internet?

Logging all DHCP requests from wireless clients

Performing RF spectrum analysis to detect non-802.11 interference

Monitoring association and disassociation frames to identify clients connecting to unauthorized APs

Monitoring the signal strength of all wireless clients

A data center hosts an air-gapped network for a client's proprietary database. The facility manager wants to implement a mitigation that will detect and alert on any attempt to bridge the air gap via a rogue access point. Which control should the manager implement?

Enforce a policy that prohibits wireless devices in the data center.

Deploy a wireless intrusion detection system (WIDS) that monitors the airspace for unauthorized APs.

Install RF-shielding material around the server racks.

Configure the network's firewall to block all wireless traffic.

A military base has a classified network that is air-gapped. The base commander wants to ensure that no wireless signals can enter or leave the classified area. Which combination of controls would provide the MOST comprehensive mitigation against air gap bridging?

Deploying a WIDS and conducting regular site surveys

RF shielding of the facility and a policy that prohibits personal wireless devices

Installing Faraday cages around individual workstations

Using MAC address filtering on all wired network ports

GIAC Assessing and Auditing Wireless Networks

Domain 3Objective 3

Bridging the Air Gap GAWN Practice Questions (Page 1)

Part of the Wireless Client and Network Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 3–4 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

5concepts

Questions 1–5

1expert · hard
A manufacturing plant has an air-gapped control network for its robotic systems. The plant manager wants to allow wireless monitoring of the robots for maintenance, but the security team is concerned about bridging the air gap. The plant has a tight budget and cannot afford a full WIDS deployment. Which mitigation strategy provides the BEST balance of enabling wireless maintenance while minimizing the risk of air gap bridging?
Select an answer first
2application · medium
A military base has an air-gapped network for classified data. The security team deploys a WIDS to monitor for wireless bridging attempts. Which WIDS capability is most important for detecting a rogue access point that is configured to use a legitimate-looking SSID?
Select an answer first
3application · medium
A university's research network is air-gapped from the internet. The security team deploys a WIDS to monitor for unauthorized wireless activity. Which WIDS feature is MOST useful for detecting a client misassociation attack where a researcher's laptop accidentally connects to a rogue AP that is also connected to the internet?
Select an answer first
4application · medium
A data center hosts an air-gapped network for a client's proprietary database. The facility manager wants to implement a mitigation that will detect and alert on any attempt to bridge the air gap via a rogue access point. Which control should the manager implement?
Select an answer first
5application · medium
A military base has a classified network that is air-gapped. The base commander wants to ensure that no wireless signals can enter or leave the classified area. Which combination of controls would provide the MOST comprehensive mitigation against air gap bridging?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

Bridging the Air Gap GAWN Practice Questions (Page 1)

Questions 1–5

A military base has an air-gapped network for classified data. The security team deploys a WIDS to monitor for wireless bridging attempts. Which WIDS capability is most important for detecting a rogue access point that is configured to use a legitimate-looking SSID?

A data center hosts an air-gapped network for a client's proprietary database. The facility manager wants to implement a mitigation that will detect and alert on any attempt to bridge the air gap via a rogue access point. Which control should the manager implement?

A military base has a classified network that is air-gapped. The base commander wants to ensure that no wireless signals can enter or leave the classified area. Which combination of controls would provide the MOST comprehensive mitigation against air gap bridging?

Keep studying — Wireless Client and Network Attacks