A QA engineer is testing a new Wi-Fi chipset for robustness. They plan to send a large number of malformed probe request frames to a device under test. What is the primary goal of this fuzzing activity?

To verify compliance with IEEE 802.11 standards

To measure the maximum throughput of the chipset

To determine the supported data rates of the device

To identify software bugs that could lead to crashes or memory corruption

What is the key difference between mutation-based and generation-based fuzzing in the context of 802.11 frames?

Mutation-based fuzzing requires a deep understanding of the protocol, while generation-based fuzzing does not

Mutation-based fuzzing is faster but less effective, while generation-based fuzzing is slower but always finds more vulnerabilities

Mutation-based fuzzing is used for management frames, while generation-based fuzzing is used for data frames

Mutation-based fuzzing modifies existing valid frames, while generation-based fuzzing creates frames from scratch based on a specification

A security team is fuzzing a new AP. They need to test the AP's handling of information elements (IEs) in association requests. They have a captured set of valid association requests. Which fuzzing strategy would most efficiently explore the IE parsing logic?

Using a generation-based fuzzer to create association requests with valid headers and systematically mutated IE lengths and values

Replaying captured association requests without modification

Sending association requests with random Type and Subtype values

Randomly flipping bits in the entire frame body of captured frames

A security researcher is testing a new enterprise access point for 802.11 fuzzing vulnerabilities. They want to send malformed association request frames to the AP and observe whether the AP crashes or becomes unresponsive. Which tool is most appropriate for this task?

Scapy to craft and inject association request frames with mutated fields

Aircrack-ng suite's airmon-ng to enable monitor mode and then aireplay-ng to replay captured association frames

mdk3 with the 'a' option to send authentication frames

Wireshark with a custom display filter to capture association requests

GIAC Assessing and Auditing Wireless Networks

Domain 6Objective 1

802.11 Fuzzing Attacks GAWN Practice Questions (Page 9)

Part of the Advanced Wireless Attacks domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

7concepts

Questions 41–45

41application · medium
A QA engineer is testing a new Wi-Fi chipset for robustness. They plan to send a large number of malformed probe request frames to a device under test. What is the primary goal of this fuzzing activity?
Select an answer first
42foundation · easy
What is the key difference between mutation-based and generation-based fuzzing in the context of 802.11 frames?
Select an answer first
43expert · hard
A security team is fuzzing a new AP. They need to test the AP's handling of information elements (IEs) in association requests. They have a captured set of valid association requests. Which fuzzing strategy would most efficiently explore the IE parsing logic?
Select an answer first
44application · medium
A security researcher is testing a new enterprise access point for 802.11 fuzzing vulnerabilities. They want to send malformed association request frames to the AP and observe whether the AP crashes or becomes unresponsive. Which tool is most appropriate for this task?
Select an answer first
45application · medium
An attacker is fuzzing an access point by sending association request frames with an oversized SSID element in the frame body. Which field of the 802.11 frame is being manipulated?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.