Rogue Networks GAWN Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security team responds to a rogue AP incident. They have contained the AP and conducted a forensic investigation. They found that the rogue AP was configured with the corporate SSID and WPA2 password, which was obtained from a previous phishing attack. What is the most important remediation step?

   • AReconfigure the rogue AP as a legitimate AP to reuse the hardware.
   • BIncrease the signal strength of legitimate APs to prevent future rogue APs.
   • CDisable the corporate SSID for 24 hours to ensure all clients reconnect.
   • DChange the corporate wireless password and update all client devices.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a characteristic of an evil twin attack?

   • AIt uses the same SSID as a legitimate access point to trick users into connecting
   • BIt is a legitimate access point that has been misconfigured
   • CIt creates an ad-hoc network between two devices without an access point
   • DIt is a wireless network that uses no encryption
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company discovers a rogue AP that is broadcasting the corporate SSID and is connected to the internal network. The AP is located in a public area, and the company wants to minimize disruption to legitimate users while responding. What is the best response strategy?

   • ALeave the rogue AP in place and monitor it to gather intelligence on the attacker.
   • BDisable the switch port to isolate the rogue AP, then send a technician to physically remove it.
   • CSend an email to all employees asking them to avoid the rogue AP until IT can investigate.
   • DImmediately change the corporate SSID and password to force clients to reconnect to the legitimate network.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   After a rogue AP is detected and contained, what is the next step in the response process?

   • AConduct a forensic investigation to determine how the rogue AP was installed and what data may have been exposed.
   • BDelete all logs related to the incident to protect user privacy.
   • CImmediately restore the rogue AP to service to avoid disrupting users.
   • DChange the corporate SSID to a new value to prevent future attacks.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A hospital has a WIDS that detects rogue APs, but the security team is overwhelmed by false positives from employee personal hotspots. They want to reduce false positives without missing real rogue APs. Which approach is most effective?

   • ADisable alerts for SSIDs that are not similar to the corporate SSID.
   • BIncrease the signal threshold for alerts so only very strong signals trigger an alert.
   • CIgnore all alerts during business hours when employees are present.
   • DCreate a whitelist of known employee hotspot MAC addresses and suppress alerts for them.
   Reveal Solution Discussion Select an answer first