A security team is choosing between a WIDS and a WIPS to protect against rogue APs. They have a high-security environment where they want to automatically block rogue APs, but they are concerned about false positives disrupting legitimate devices. What is the best approach?

Deploy a WIPS in monitor-only mode initially, then enable active blocking after tuning the system.

Deploy a WIPS with active blocking enabled from the start to maximize security.

Deploy a WIDS only and rely on manual response to rogue APs.

Deploy both a WIDS and a WIPS on the same network to double the detection capability.

Which of the following best defines a rogue network in the context of wireless security?

A wireless network that uses weak encryption such as WEP

Any wireless network that is not authorized by the organization's security policy

A wireless network that uses the same SSID as a legitimate network

A wireless network that is publicly accessible without a password

A company has a strict policy against rogue APs, but a new employee plugs in a personal wireless router to get better signal in their office. The router is not authorized and is broadcasting an open network. The company has a WIDS that only alerts on APs broadcasting the corporate SSID. What is the most effective improvement to prevent this type of incident?

Increase the signal strength of the corporate APs to reduce the need for personal routers

Configure the WIDS to alert on any unauthorized AP, not just those with the corporate SSID

Implement a policy that requires employees to request approval for any wireless device

Disable the unused Ethernet ports in the office

A WIPS has detected a rogue AP that is broadcasting the corporate SSID with WPA2-PSK. The AP is located in a neighboring building and is not connected to the corporate network. The security team wants to prevent clients from connecting to it. What is the best course of action?

Change the corporate PSK to prevent clients from connecting to the rogue AP

Disable the corporate SSID to prevent clients from seeing it

Use the WIPS to send deauthentication frames to clients that attempt to associate with the rogue AP

Physically locate and confiscate the rogue AP

Which of the following is an effective preventive measure against rogue access points?

Disabling all wireless networking on employee devices

Using a strong password for the corporate Wi-Fi network

Deploying a Wireless Intrusion Prevention System (WIPS) that can automatically block unauthorized access points

Encrypting all traffic with WPA2

GIAC Assessing and Auditing Wireless Networks

Domain 1Objective 4

Rogue Networks GAWN Practice Questions (Page 7)

Part of the Wireless Fundamentals and Threats domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 31–35

31expert · hard
A security team is choosing between a WIDS and a WIPS to protect against rogue APs. They have a high-security environment where they want to automatically block rogue APs, but they are concerned about false positives disrupting legitimate devices. What is the best approach?
Select an answer first
32foundation · easy
Which of the following best defines a rogue network in the context of wireless security?
Select an answer first
33expert · hard
A company has a strict policy against rogue APs, but a new employee plugs in a personal wireless router to get better signal in their office. The router is not authorized and is broadcasting an open network. The company has a WIDS that only alerts on APs broadcasting the corporate SSID. What is the most effective improvement to prevent this type of incident?
Select an answer first
34expert · hard
A WIPS has detected a rogue AP that is broadcasting the corporate SSID with WPA2-PSK. The AP is located in a neighboring building and is not connected to the corporate network. The security team wants to prevent clients from connecting to it. What is the best course of action?
Select an answer first
35foundation · easy
Which of the following is an effective preventive measure against rogue access points?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.