Rogue Networks GAWN Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   During a routine scan, a security analyst identifies an unauthorized access point that is broadcasting a corporate SSID and is connected to the internal network. The analyst has confirmed it is not an authorized device. What is the first step in the response process?

   • AConduct a forensic analysis of the rogue AP's firmware to determine its origin.
   • BDocument the incident in the ticketing system before taking any action.
   • CNotify all employees to change their passwords immediately.
   • DIsolate the rogue AP by disabling the switch port it is connected to.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team is evaluating tools to detect rogue access points. They need a solution that can monitor the airspace continuously and alert on unauthorized devices. Which approach best meets this requirement?

   • AConduct a quarterly site survey using a handheld spectrum analyzer.
   • BReview switch logs for unknown MAC addresses on a daily basis.
   • CUse a laptop with a wireless card and NetStumbler to scan the area once a week.
   • DDeploy a wireless intrusion prevention system (WIPS) with sensors throughout the facility.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the purpose of the remediation phase in a rogue network incident response?

   • ATo inform all users about the incident and provide training
   • BTo identify the attacker and press criminal charges
   • CTo eliminate the root cause and restore the network to a secure state
   • DTo document the incident for compliance reporting
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   After detecting a rogue access point, what is the first step in responding to the incident?

   • AReboot the rogue AP to restore it to normal operation
   • BContain the rogue AP by disconnecting it from the network or blocking its signals
   • CImmediately delete all logs related to the rogue AP
   • DNotify all employees about the rogue AP via email
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   After a rogue AP incident, the security team wants to ensure that the same type of incident does not recur. They have identified that the rogue AP was connected to an unmanaged switch in a public area. What is the most effective remediation?

   • ADisable the physical port that was used
   • BReplace the unmanaged switch with a managed switch that supports 802.1X and port security
   • CConduct a security awareness training session
   • DMove the switch to a locked room
   Reveal Solution Discussion Select an answer first