What is a primary limitation when sniffing encrypted wireless traffic (e.g., WPA2)?

The signal strength is not available

The data payload is encrypted and cannot be read without the encryption keys

When analyzing a captured wireless frame in Wireshark, which field would you examine to determine the signal strength of the transmitting device?

The Frame Check Sequence (FCS) field

A technician is trying to put a wireless adapter into monitor mode on a Linux system. The technician runs 'airmon-ng start wlan0' and receives an error indicating that the interface is busy. What is the most likely cause and solution?

The adapter does not support monitor mode; replace the adapter.

The adapter is not plugged in; check the USB connection.

The system is missing firmware; install the required firmware.

The interface is managed by NetworkManager; stop NetworkManager before starting monitor mode.

A security analyst needs to capture all wireless traffic in a busy office lobby to identify rogue access points. The analyst has a laptop with an internal Wi-Fi adapter and a USB adapter that supports monitor mode. After putting the USB adapter into monitor mode and starting Wireshark, the analyst sees only a few beacon frames and no data frames. What is the most likely reason for the incomplete capture?

The internal adapter is interfering with the USB adapter's reception.

The capture filter is set to only display beacon frames.

Wireshark cannot capture wireless frames when the adapter is in monitor mode.

The adapter is not set to the correct channel and is not hopping across channels.

Why is it necessary to capture the WPA/WPA2 4-way handshake during a wireless assessment?

To decrypt the data traffic in real time

To perform an offline dictionary attack to recover the passphrase

To determine the MAC address of the access point

To identify the encryption algorithm used

GIAC Assessing and Auditing Wireless Networks

Domain 1Objective 2

Sniffing Wireless GAWN Practice Questions (Page 9)

Part of the Wireless Fundamentals and Threats domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 41–45

41foundation · easy
What is a primary limitation when sniffing encrypted wireless traffic (e.g., WPA2)?
Select an answer first
42foundation · easy
When analyzing a captured wireless frame in Wireshark, which field would you examine to determine the signal strength of the transmitting device?
Select an answer first
43application · medium
A technician is trying to put a wireless adapter into monitor mode on a Linux system. The technician runs 'airmon-ng start wlan0' and receives an error indicating that the interface is busy. What is the most likely cause and solution?
Select an answer first
44application · medium
A security analyst needs to capture all wireless traffic in a busy office lobby to identify rogue access points. The analyst has a laptop with an internal Wi-Fi adapter and a USB adapter that supports monitor mode. After putting the USB adapter into monitor mode and starting Wireshark, the analyst sees only a few beacon frames and no data frames. What is the most likely reason for the incomplete capture?
Select an answer first
45foundation · easy
Why is it necessary to capture the WPA/WPA2 4-way handshake during a wireless assessment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.