An analyst is using Kismet to perform a wireless survey. The analyst notices that Kismet is reporting a large number of access points, but Wireshark, when capturing on the same adapter, shows only a few. The analyst is using the same adapter and channel settings for both tools. Which is the most likely explanation for the discrepancy?

Kismet is using a different network interface than Wireshark

Kismet is performing channel hopping while Wireshark is locked to a single channel

Wireshark is not in monitor mode

Kismet is detecting APs from a different frequency band

An auditor is using aircrack-ng to capture traffic from a target network. The auditor wants to capture a WPA2 handshake from a client that is already connected. The auditor runs aireplay-ng to send deauthentication frames, but the client does not reconnect. Which is the most likely reason for this failure?

The adapter is not in monitor mode

The deauthentication frames are not being sent from the correct source MAC address

The target network is using WPA3

The client is not associated with the access point

A consultant is performing a wireless assessment for a client. The client's office is in a shared building with other tenants. The consultant's scope of work only authorizes testing of the client's own wireless network. During the assessment, the consultant captures traffic that includes frames from neighboring networks. Which action is most appropriate?

Analyze the neighboring traffic to identify potential security risks to the client

Ignore and do not analyze frames from neighboring networks

Use the neighboring traffic to improve the client's network security

Report the neighboring traffic to the client as part of the assessment

An analyst is using Kismet to perform a wireless survey. The analyst wants to identify all access points and clients, including those that are not actively transmitting data. Which Kismet feature is most useful for this purpose?

The ability to log all observed MAC addresses and SSIDs.

The ability to decrypt WPA2 traffic in real time.

The ability to inject deauthentication frames.

The ability to perform active scanning by sending probe requests.

What is the purpose of sending deauthentication frames in wireless security testing?

To increase the signal strength of the access point

To force clients to disconnect from the access point, which can be used to capture handshakes

To encrypt the wireless traffic

GIAC Assessing and Auditing Wireless Networks

Domain 1Objective 2

Sniffing Wireless GAWN Practice Questions (Page 7)

Part of the Wireless Fundamentals and Threats domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 31–35

31expert · hard
An analyst is using Kismet to perform a wireless survey. The analyst notices that Kismet is reporting a large number of access points, but Wireshark, when capturing on the same adapter, shows only a few. The analyst is using the same adapter and channel settings for both tools. Which is the most likely explanation for the discrepancy?
Select an answer first
32application · medium
An auditor is using aircrack-ng to capture traffic from a target network. The auditor wants to capture a WPA2 handshake from a client that is already connected. The auditor runs aireplay-ng to send deauthentication frames, but the client does not reconnect. Which is the most likely reason for this failure?
Select an answer first
33expert · hard
A consultant is performing a wireless assessment for a client. The client's office is in a shared building with other tenants. The consultant's scope of work only authorizes testing of the client's own wireless network. During the assessment, the consultant captures traffic that includes frames from neighboring networks. Which action is most appropriate?
Select an answer first
34application · medium
An analyst is using Kismet to perform a wireless survey. The analyst wants to identify all access points and clients, including those that are not actively transmitting data. Which Kismet feature is most useful for this purpose?
Select an answer first
35foundation · easy
What is the purpose of sending deauthentication frames in wireless security testing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

Sniffing Wireless GAWN Practice Questions (Page 7)

Questions 31–35

An analyst is using Kismet to perform a wireless survey. The analyst wants to identify all access points and clients, including those that are not actively transmitting data. Which Kismet feature is most useful for this purpose?

What is the purpose of sending deauthentication frames in wireless security testing?

Keep studying — Wireless Fundamentals and Threats