Rogue Networks GAWN Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An attacker sets up an evil twin access point in a coffee shop. What is the most likely security threat to a user who connects to it?

   • AThe attacker can intercept the user's wireless traffic, including login credentials and personal data
   • BThe attacker will install malware on the user's device automatically without any user interaction
   • CThe attacker will cause the user's device to overheat due to excessive signal strength
   • DThe attacker will block the user's access to the internet, causing a denial of service
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company wants to reduce the risk of employees creating ad-hoc networks to share files. Which policy or control is most effective?

   • APhysically secure all access points
   • BConfigure client devices to disable ad-hoc mode and enforce this via group policy
   • CUse WPA2-Enterprise on the corporate wireless network
   • DDeploy a WIDS that monitors for ad-hoc networks
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team is using a wireless monitoring tool that reports an unknown AP with a MAC address that is not in the authorized list. The AP is broadcasting a non-corporate SSID and is not connected to the corporate network. What should the team do?

   • AImmediately disconnect it from the network
   • BChange the corporate SSID to avoid confusion
   • CDocument it as a rogue AP and monitor for any changes in behavior
   • DIgnore it because it is not connected to the corporate network
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An employee plugs a personal wireless router into the corporate network to get better Wi-Fi in their office. According to the organization's security policy, this device is not approved. How should this network be classified?

   • AAs a guest network because it provides additional connectivity
   • BAs an evil twin because it mimics the corporate SSID
   • CAs a rogue network because it is not authorized by the organization
   • DAs a legitimate network because it was installed by an employee
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's WIDS alerts on an unknown access point with the same SSID as the corporate network but with a different BSSID and stronger signal in the lobby. The corporate APs are all managed and accounted for. What should the security team do first to confirm this is an evil twin?

   • ACompare the BSSID of the unknown AP against the list of authorized APs and check its vendor OUI.
   • BRun a site survey to determine if the unknown AP is causing channel interference.
   • CImmediately disconnect the unknown AP from the network by disabling the switch port it is connected to.
   • DChange the corporate SSID and pre-shared key to force clients to reconnect to the legitimate network.
   Reveal Solution Discussion Select an answer first