A security researcher is fuzzing the beacon frame handling of an access point. They want to target the fields that are most likely to cause a buffer overflow in the AP's firmware. Which combination of fields should they focus on?

The beacon interval and capability information fields, with extreme values

The frame control and duration fields, with random values

The BSSID and source address fields, with random MAC addresses

The SSID information element and the vendor-specific information element, both with varying lengths

A wireless security consultant is evaluating tools for fuzzing 802.11 management frames. They need a tool that can be scripted to generate a large number of malformed association request frames with varying information element lengths. Which tool is best suited for this task?

Scapy, because it allows programmatic construction and injection of 802.11 frames

Kismet, because it can detect wireless networks and capture packets

Wireshark, because it can capture and analyze malformed frames

Aircrack-ng, because it includes tools for packet injection

A consultant is performing a fuzzing assessment of a client's wireless infrastructure. The client requires that the assessment not cause a prolonged outage. The consultant plans to use a tool that can send malformed frames. Which tool and approach best balances thoroughness with the constraint of minimizing disruption?

Use Scapy to send a low-rate, targeted set of malformed probe requests during off-peak hours

Use mdk3 to flood the network with authentication frames

Use Wireshark to capture and analyze frames for potential vulnerabilities

Use aireplay-ng to replay captured frames at high rate

A QA engineer is tasked with testing a new Wi-Fi driver for robustness. They want to use a fuzzing technique that does not require a valid captured frame as a starting point and can generate a wide variety of malformed management frames based on the 802.11 specification. Which technique is most appropriate?

Dictionary-based fuzzing using a list of known bad strings

Replay-based fuzzing by resending previously captured frames

Generation-based fuzzing using protocol templates to create frames from scratch

Mutation-based fuzzing using a random byte generator

GIAC Assessing and Auditing Wireless Networks

Domain 6Objective 1

802.11 Fuzzing Attacks GAWN Practice Questions (Page 6)

Part of the Advanced Wireless Attacks domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

7concepts

Questions 26–30

26expert · hard
A security researcher is fuzzing the beacon frame handling of an access point. They want to target the fields that are most likely to cause a buffer overflow in the AP's firmware. Which combination of fields should they focus on?
Select an answer first
27application · medium
A wireless security consultant is evaluating tools for fuzzing 802.11 management frames. They need a tool that can be scripted to generate a large number of malformed association request frames with varying information element lengths. Which tool is best suited for this task?
Select an answer first
28application · medium
A security consultant is performing a wireless penetration test and needs to fuzz 802.11 management frames against a target AP. They want a tool that can generate a wide variety of malformed frames based on the 802.11 specification, not just mutate captured frames. Which tool is best suited?
Select an answer first
29expert · hard
A consultant is performing a fuzzing assessment of a client's wireless infrastructure. The client requires that the assessment not cause a prolonged outage. The consultant plans to use a tool that can send malformed frames. Which tool and approach best balances thoroughness with the constraint of minimizing disruption?
Select an answer first
30application · medium
A QA engineer is tasked with testing a new Wi-Fi driver for robustness. They want to use a fuzzing technique that does not require a valid captured frame as a starting point and can generate a wide variety of malformed management frames based on the 802.11 specification. Which technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

802.11 Fuzzing Attacks GAWN Practice Questions (Page 6)

Questions 26–30

A security researcher is fuzzing the beacon frame handling of an access point. They want to target the fields that are most likely to cause a buffer overflow in the AP's firmware. Which combination of fields should they focus on?

A wireless security consultant is evaluating tools for fuzzing 802.11 management frames. They need a tool that can be scripted to generate a large number of malformed association request frames with varying information element lengths. Which tool is best suited for this task?

A security consultant is performing a wireless penetration test and needs to fuzz 802.11 management frames against a target AP. They want a tool that can generate a wide variety of malformed frames based on the 802.11 specification, not just mutate captured frames. Which tool is best suited?

Keep studying — Advanced Wireless Attacks