A security consultant is hired to perform a wireless security assessment for a client. The consultant plans to capture wireless traffic in the client's office building. Which action is most appropriate from a legal and ethical standpoint?

Obtain written authorization from the client that explicitly permits wireless capture

Inform nearby employees that their traffic may be captured

Capture traffic only from the client's own access points and ignore others

Use a passive sniffer to avoid interfering with the network

An auditor is using a single USB wireless adapter in monitor mode to survey all 2.4 GHz channels for rogue access points. The auditor notices that some beacons from a known AP are captured, but data frames from the same AP are often missed. What is the primary cause of this incomplete capture?

The AP is using a channel that is not allowed in the regulatory domain.

The adapter's driver does not support monitor mode on all channels.

The capture filter is set to only record beacon frames.

The adapter is hopping channels and spends only a short time on each channel.

A wireless administrator is testing the resilience of a WPA2-Enterprise network. The administrator wants to verify that the network is not vulnerable to deauthentication attacks that could disrupt client connections. Which tool and technique should the administrator use to test this?

Use aireplay-ng with the deauth option to send deauthentication frames to a test client.

Use Wireshark to capture and replay deauthentication frames.

Use Kismet to passively monitor for deauthentication frames.

Use airodump-ng to capture the 4-way handshake.

A network administrator is trying to capture wireless traffic on a Linux system. The administrator puts the wireless adapter into monitor mode using iwconfig, but Wireshark does not show any captured frames. The adapter is a common USB model that is known to support monitor mode. Which is the most likely cause of the issue?

The adapter is not connected to a wireless network

Wireshark requires a wired interface to capture wireless traffic

The adapter is not in promiscuous mode

The adapter's driver does not support monitor mode on this kernel version

An auditor is capturing traffic on a WPA2-Enterprise network. The auditor wants to analyze the authentication process. Which frames should the auditor focus on to see the authentication exchange?

Beacon frames from the access point

Data frames carrying HTTP traffic

EAPOL frames exchanged between the client and the access point

GIAC Assessing and Auditing Wireless Networks

Domain 1Objective 2

Sniffing Wireless GAWN Practice Questions (Page 2)

Part of the Wireless Fundamentals and Threats domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 6–10

6application · medium
A security consultant is hired to perform a wireless security assessment for a client. The consultant plans to capture wireless traffic in the client's office building. Which action is most appropriate from a legal and ethical standpoint?
Select an answer first
7application · medium
An auditor is using a single USB wireless adapter in monitor mode to survey all 2.4 GHz channels for rogue access points. The auditor notices that some beacons from a known AP are captured, but data frames from the same AP are often missed. What is the primary cause of this incomplete capture?
Select an answer first
8application · medium
A wireless administrator is testing the resilience of a WPA2-Enterprise network. The administrator wants to verify that the network is not vulnerable to deauthentication attacks that could disrupt client connections. Which tool and technique should the administrator use to test this?
Select an answer first
9expert · hard
A network administrator is trying to capture wireless traffic on a Linux system. The administrator puts the wireless adapter into monitor mode using iwconfig, but Wireshark does not show any captured frames. The adapter is a common USB model that is known to support monitor mode. Which is the most likely cause of the issue?
Select an answer first
10application · medium
An auditor is capturing traffic on a WPA2-Enterprise network. The auditor wants to analyze the authentication process. Which frames should the auditor focus on to see the authentication exchange?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.