An auditor is analyzing a Wireshark capture from a WPA2-PSK network. The auditor wants to identify the client devices that are associated with the access point. Which combination of frames would provide the most reliable information?

Probe request and response frames

Data frames from the AP to the client

Association request and response frames

Which of the following best describes the principle of capturing wireless frames during a passive sniffing session?

The sniffer must associate with the access point to receive all frames

The sniffer listens to all frames transmitted on the monitored channel within range

The sniffer captures only frames addressed to its own MAC address

The sniffer must use a directional antenna to capture frames from a specific client

During a wireless penetration test, an auditor captures traffic from a WPA2-PSK network. The auditor wants to recover the pre-shared key by performing an offline dictionary attack. Which type of frame must the auditor capture to successfully perform this attack?

A beacon frame from the access point

An authentication frame from the client

The four-way handshake between the client and the access point

A network administrator is troubleshooting a wireless issue and needs to capture traffic from a specific access point that is operating on channel 6. The administrator's laptop has an internal wireless card that does not support monitor mode. Which approach would allow the capture?

Use the internal card in managed mode and capture with Wireshark

Use a software-based sniffer that does not require special hardware

Use the internal card in promiscuous mode

Use an external USB adapter that supports monitor mode and set it to channel 6

A security consultant needs to perform a wireless penetration test that requires injecting deauthentication frames and capturing WPA2 handshakes. The consultant has a laptop with an internal Intel Wi-Fi adapter and a USB adapter that supports monitor mode but not packet injection. What should the consultant do to meet the testing requirements?

Capture the handshake passively without injection by waiting for a client to reconnect.

Use the internal adapter for injection and the USB adapter for monitoring.

Use a different USB adapter that supports both monitor mode and packet injection.

Use aireplay-ng with the USB adapter to send deauthentication frames.

GIAC Assessing and Auditing Wireless Networks

Domain 1Objective 2

Sniffing Wireless GAWN Practice Questions (Page 5)

Part of the Wireless Fundamentals and Threats domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 21–25

21expert · hard
An auditor is analyzing a Wireshark capture from a WPA2-PSK network. The auditor wants to identify the client devices that are associated with the access point. Which combination of frames would provide the most reliable information?
Select an answer first
22foundation · easy
Which of the following best describes the principle of capturing wireless frames during a passive sniffing session?
Select an answer first
23application · medium
During a wireless penetration test, an auditor captures traffic from a WPA2-PSK network. The auditor wants to recover the pre-shared key by performing an offline dictionary attack. Which type of frame must the auditor capture to successfully perform this attack?
Select an answer first
24application · medium
A network administrator is troubleshooting a wireless issue and needs to capture traffic from a specific access point that is operating on channel 6. The administrator's laptop has an internal wireless card that does not support monitor mode. Which approach would allow the capture?
Select an answer first
25application · medium
A security consultant needs to perform a wireless penetration test that requires injecting deauthentication frames and capturing WPA2 handshakes. The consultant has a laptop with an internal Intel Wi-Fi adapter and a USB adapter that supports monitor mode but not packet injection. What should the consultant do to meet the testing requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.