A security analyst needs to capture all wireless traffic in a busy office environment to identify rogue access points. The analyst has a laptop running Kali Linux and a USB wireless adapter that supports monitor mode. After putting the adapter into monitor mode, the analyst notices that only a small subset of nearby access points is visible in Wireshark. Which action would most directly improve the visibility of all nearby access points?

Set the adapter to a fixed channel that has the most active access points

Enable channel hopping on the adapter to cycle through all available channels

Disable the wireless card's power management to prevent it from sleeping

Increase the transmit power of the adapter to boost its ability to receive distant signals

A penetration tester is assessing a WPA2-PSK network and needs to capture a handshake from a client that is already connected. The tester sends deauthentication frames, but the client does not reconnect. The tester confirms that the adapter is in monitor mode and the source MAC is correct. Which additional factor could prevent the client from reconnecting?

The deauthentication frames are being sent on a different channel than the client is using

The access point has MAC filtering enabled

The client is using a static IP address

What is the purpose of channel hopping in wireless sniffing?

To capture traffic on multiple channels by periodically switching the adapter's listening channel

To increase the transmit power of the sniffer

To avoid detection by the target network

GIAC Assessing and Auditing Wireless Networks

Domain 1Objective 2

Sniffing Wireless GAWN Practice Questions (Page 4)

Part of the Wireless Fundamentals and Threats domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 16–20

16application · medium
A security analyst needs to capture all wireless traffic in a busy office environment to identify rogue access points. The analyst has a laptop running Kali Linux and a USB wireless adapter that supports monitor mode. After putting the adapter into monitor mode, the analyst notices that only a small subset of nearby access points is visible in Wireshark. Which action would most directly improve the visibility of all nearby access points?
Select an answer first
17foundation · easy
Which wireless frame type is used by access points to broadcast the SSID and supported data rates?
Select an answer first
18expert · hard
A penetration tester is assessing a WPA2-PSK network and needs to capture a handshake from a client that is already connected. The tester sends deauthentication frames, but the client does not reconnect. The tester confirms that the adapter is in monitor mode and the source MAC is correct. Which additional factor could prevent the client from reconnecting?
Select an answer first
19foundation · easy
Which command is commonly used on Linux to set a wireless interface into monitor mode?
Select an answer first
20foundation · easy
What is the purpose of channel hopping in wireless sniffing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

Sniffing Wireless GAWN Practice Questions (Page 4)

Questions 16–20

Which wireless frame type is used by access points to broadcast the SSID and supported data rates?

Which command is commonly used on Linux to set a wireless interface into monitor mode?

What is the purpose of channel hopping in wireless sniffing?

Keep studying — Wireless Fundamentals and Threats