A penetration tester is using a fuzzing tool to test an access point's handling of probe request frames. The tool allows them to define a template with valid fields and then automatically generate variations by inserting random data into the SSID field. Which fuzzing technique is being used?

Generation-based fuzzing, because the tool generates frames from a template

Dictionary-based fuzzing, because the tool uses a list of known bad SSIDs

Replay-based fuzzing, because the tool replays captured frames

Mutation-based fuzzing, because the tool starts with a valid frame and mutates it

A company has experienced repeated denial-of-service incidents where an attacker sends malformed probe request frames to crash the access points. The security team wants to implement a detection mechanism that can identify such attacks without requiring changes to the access point firmware. Which approach is most effective?

Deploy a wireless intrusion detection system (WIDS) that monitors for abnormal frame patterns and rate anomalies

Increase the transmit power of access points to reduce the attacker's signal strength

Disable the broadcasting of SSIDs on all access points

Enable MAC address filtering on the access points to block unknown devices

After a series of unexplained client disconnections, a network administrator suspects an 802.11 fuzzing attack. Which defensive measure is most likely to reduce the risk of future fuzzing-related vulnerabilities?

Increasing the beacon interval to reduce management traffic

Regularly updating access point and client firmware

Using a longer WPA2 pre-shared key

A wireless auditor needs to fuzz the authentication frame handling of a legacy access point. They have a valid authentication frame captured from the target network. Which tool and technique would allow them to systematically alter specific fields (e.g., authentication algorithm number, transaction sequence number) while keeping the rest of the frame intact?

Use a spectrum analyzer to generate malformed authentication frames

Use Scapy to parse the captured frame, modify the desired fields in a loop, and inject the modified frames

Use a Wi-Fi adapter's vendor utility to replay the captured frame with random bit flips

Use a packet capture tool like Wireshark to edit the frame and resend it

GIAC Assessing and Auditing Wireless Networks

Domain 6Objective 1

802.11 Fuzzing Attacks GAWN Practice Questions (Page 5)

Part of the Advanced Wireless Attacks domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

7concepts

Questions 21–25

21application · medium
A penetration tester is using a fuzzing tool to test an access point's handling of probe request frames. The tool allows them to define a template with valid fields and then automatically generate variations by inserting random data into the SSID field. Which fuzzing technique is being used?
Select an answer first
22application · medium
A company has experienced repeated denial-of-service incidents where an attacker sends malformed probe request frames to crash the access points. The security team wants to implement a detection mechanism that can identify such attacks without requiring changes to the access point firmware. Which approach is most effective?
Select an answer first
23foundation · easy
Which 802.11 management frame subtype is often fuzzed to test a device's authentication handling?
Select an answer first
24application · medium
After a series of unexplained client disconnections, a network administrator suspects an 802.11 fuzzing attack. Which defensive measure is most likely to reduce the risk of future fuzzing-related vulnerabilities?
Select an answer first
25application · medium
A wireless auditor needs to fuzz the authentication frame handling of a legacy access point. They have a valid authentication frame captured from the target network. Which tool and technique would allow them to systematically alter specific fields (e.g., authentication algorithm number, transaction sequence number) while keeping the rest of the frame intact?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

802.11 Fuzzing Attacks GAWN Practice Questions (Page 5)

Questions 21–25

A penetration tester is using a fuzzing tool to test an access point's handling of probe request frames. The tool allows them to define a template with valid fields and then automatically generate variations by inserting random data into the SSID field. Which fuzzing technique is being used?

Which 802.11 management frame subtype is often fuzzed to test a device's authentication handling?

After a series of unexplained client disconnections, a network administrator suspects an 802.11 fuzzing attack. Which defensive measure is most likely to reduce the risk of future fuzzing-related vulnerabilities?

Keep studying — Advanced Wireless Attacks