A security analyst is capturing traffic on a WPA2-PSK network. The analyst wants to determine the SSID of the network from the captured frames. Which frame type would contain the SSID in plaintext?

EAPOL frames during the handshake

Data frames carrying encrypted payload

Beacon frames from the access point

A security analyst is analyzing a Wireshark capture from a monitor-mode adapter. The analyst wants to identify all access points and clients in the area. Which type of wireless frame should the analyst focus on to quickly list BSSIDs and SSIDs?

RTS/CTS frames used for medium reservation.

Beacon frames from access points.

Data frames between clients and the AP.

An auditor is using a single monitor-mode adapter to capture traffic on a specific channel for a forensic investigation. The auditor needs to ensure that all frames on that channel are captured, including those from hidden SSIDs. What is the best approach?

Enable channel hopping to capture frames from other channels that might contain the hidden SSID.

Disable channel hopping and lock the adapter to the target channel.

Use a directional antenna to focus on the AP's signal.

Set the adapter to a wider channel width to capture adjacent channels.

A penetration tester is assessing a WPA2-Enterprise network. The tester needs to capture the authentication exchange of a specific user but does not want to disrupt the user's session. The tester's adapter supports monitor mode and packet injection. Which approach would be the most effective and least intrusive?

Send a deauthentication frame to force the user to reauthenticate

Passively capture EAPOL frames while the user authenticates naturally

Perform a rogue AP attack to capture the user's credentials

Use packet injection to send EAPOL frames to the user

Which of the following is a common characteristic of wireless adapters recommended for wireless sniffing and injection?

They are based on chipsets with well-documented Linux driver support

They have built-in Bluetooth capabilities

They are always USB 3.0 for maximum speed

They use proprietary drivers that only work with Windows

GIAC Assessing and Auditing Wireless Networks

Domain 1Objective 2

Sniffing Wireless GAWN Practice Questions (Page 1)

Part of the Wireless Fundamentals and Threats domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 1–5

1application · medium
A security analyst is capturing traffic on a WPA2-PSK network. The analyst wants to determine the SSID of the network from the captured frames. Which frame type would contain the SSID in plaintext?
Select an answer first
2application · easy
A security analyst is analyzing a Wireshark capture from a monitor-mode adapter. The analyst wants to identify all access points and clients in the area. Which type of wireless frame should the analyst focus on to quickly list BSSIDs and SSIDs?
Select an answer first
3expert · hard
An auditor is using a single monitor-mode adapter to capture traffic on a specific channel for a forensic investigation. The auditor needs to ensure that all frames on that channel are captured, including those from hidden SSIDs. What is the best approach?
Select an answer first
4expert · hard
A penetration tester is assessing a WPA2-Enterprise network. The tester needs to capture the authentication exchange of a specific user but does not want to disrupt the user's session. The tester's adapter supports monitor mode and packet injection. Which approach would be the most effective and least intrusive?
Select an answer first
5foundation · easy
Which of the following is a common characteristic of wireless adapters recommended for wireless sniffing and injection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.