Bridging the Air Gap GAWN Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A research lab's sensitive data is stored on a network that is physically isolated from the internet and has no wireless interfaces. An attacker successfully exfiltrates data by placing a small battery-powered device near a workstation that emits a low-power signal mimicking a legitimate wireless keyboard. Which attack vector BEST describes this air gap bridging technique?

   • APhysical access
   • BRogue access point
   • CSocial engineering
   • DWireless signal interception
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A financial firm's trading floor is air-gapped from the corporate network. The security team notices that a WIDS has detected periodic, short-lived wireless transmissions from an unknown device near the trading floor's window. The transmissions occur at irregular intervals and are not associated with any known SSID. Which detection method would be most effective in confirming whether these transmissions are an attempt to bridge the air gap?

   • AReview the corporate firewall logs for any outbound connections from the trading floor's IP range.
   • BDeploy a spectrum analyzer to capture and analyze the RF characteristics of the unknown transmissions.
   • CConduct a physical search of the trading floor for any unauthorized devices.
   • DIncrease the WIDS polling interval to capture more frequent samples of the unknown device.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a primary attack vector for bridging an air gap?

   • ASocial engineering
   • BDenial of service
   • CPassword cracking
   • DMalware infection via email
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A defense contractor maintains a lab with no wireless interfaces, used for processing classified design files. During a routine audit, a WIDS deployed at the facility perimeter reports a new, unapproved SSID broadcasting from inside the lab. The lab's wired network shows a new MAC address that has been actively sending ARP requests. Which action most directly addresses the immediate bridging of the air gap?

   • ARe-run the WIDS site survey to confirm the SSID is not a false positive.
   • BConfigure the lab's firewall to block all outbound traffic from the new MAC address.
   • CDisable the switch port associated with the new MAC address and physically locate the rogue device.
   • DIncrease the transmit power of the lab's existing wireless access points to improve coverage.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A law firm's litigation support network is air-gapped from the internet. An attacker has gained physical access to the building's janitorial closet, which is adjacent to the network's server room. The attacker wants to bridge the air gap to exfiltrate case files. Which attack vector is the attacker most likely to use?

   • AExploit a vulnerability in the network's firewall to gain remote access.
   • BPlant a small wireless device that connects to the air-gapped network via a nearby network port and communicates with an external receiver.
   • CUse social engineering to trick an employee into revealing the network password.
   • DIntercept wireless signals from the air-gapped network's own Wi-Fi.
   Reveal Solution Discussion Select an answer first