Hotspots GAWN Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A penetration tester is authorized to assess a company's Wi-Fi network, including the guest hotspot. During the assessment, the tester discovers that the guest hotspot is using a captive portal that collects email addresses. The tester wants to test whether the portal is vulnerable to credential harvesting. Which action is most appropriate within the scope of the authorization?

   • ASubmit a test email address to the portal and observe the response, documenting any security issues.
   • BSet up a rogue AP with the same SSID to see if users connect and submit credentials.
   • CAttempt to bypass the captive portal by manipulating the DHCP response.
   • DIntercept the traffic of other users on the hotspot to see if their email addresses are exposed.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A hotel offers free Wi-Fi to guests. Upon connecting, guests are redirected to a web page that requires them to enter their room number and last name before gaining internet access. The hotel manager wants to ensure that guest communications are protected from eavesdropping by other guests on the same network. What is the most effective additional measure the hotel should implement?

   • AImplement a captive portal with HTTPS-only access
   • BProvide a VPN service for guests to use
   • CEnable client isolation on the access points
   • DRequire WPA2-Enterprise with per-user credentials
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A penetration tester is hired to assess the security of a public airport's Wi-Fi hotspot. The contract explicitly authorizes testing of the airport's own access points but does not mention any other networks. During the assessment, the tester detects an unauthorized access point with the same SSID as the airport's network. What is the most appropriate action?

   • AInclude the rogue AP in the assessment because it is part of the airport's SSID and therefore within the scope of the contract.
   • BDocument the rogue AP's existence and report it to the airport, but do not actively test it without additional authorization.
   • CDeauthenticate clients from the rogue AP to protect airport users, since this is a defensive action.
   • DAttempt to connect to the rogue AP to determine if it is harvesting credentials, because this is necessary for the assessment.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is an effective defense against eavesdropping on a public hotspot?

   • AUsing a VPN
   • BUsing a static IP address
   • CDisabling the firewall
   • DTurning off Wi-Fi and using Bluetooth
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A university is deploying a new guest Wi-Fi network. They want to require students to log in with their university credentials, but they are concerned about the security of transmitting those credentials over the air. Which authentication method should they use to ensure the credentials are protected?

   • AWPA2-Enterprise with PEAP-MSCHAPv2, which encrypts the authentication exchange.
   • BWEP with a static key, which provides basic encryption for the authentication process.
   • COpen network with a captive portal that collects credentials over HTTPS.
   • DWPA2-Personal with a shared password, which is simpler and does not require a RADIUS server.
   Reveal Solution Discussion Select an answer first