A penetration tester is evaluating the security of a coffee shop's guest Wi-Fi. The shop uses an open network with a captive portal that requires users to enter their email address to access the internet. The tester wants to demonstrate how an attacker could steal customer email addresses and passwords. Which attack would be most effective?

Set up a honeypot AP with a similar SSID like 'CoffeeShopFree' and hope customers connect to it.

Use a client-side exploit to install malware on a customer's device when they connect to the legitimate network.

Create a rogue AP with the same SSID and a fake captive portal that mimics the legitimate login page.

Use a tool to send deauthentication frames to all clients, then passively capture their traffic on the legitimate network.

A network administrator is troubleshooting a wireless issue where users are frequently disconnected from the corporate Wi-Fi. The administrator suspects a deauthentication attack. Which tool or technique would be most effective in confirming this suspicion?

Use a tool to send deauthentication frames to the AP to test its resilience.

Inspect the client's event logs for disconnection reasons.

Use a wireless packet analyzer in monitor mode to capture deauthentication frames and identify the source MAC address.

Check the AP's logs for authentication failures.

Which of the following is a recommended mitigation against wireless client attacks?

Using the same password for all users

Disabling WPA2 encryption on the network

Using a VPN to encrypt client traffic

Turning off the client's firewall

A network administrator is troubleshooting a wireless network where users report frequent disconnections. The administrator suspects a malicious actor is sending deauthentication frames. Which configuration change would best mitigate this type of attack while maintaining normal operations?

Increase the transmit power of the access points to cover a larger area.

Enable 802.11w (Management Frame Protection) on the access points and clients that support it.

Change the network to use WPA2 with a stronger passphrase.

Disable SSID broadcast to hide the network from attackers.

What information can an attacker obtain by passively capturing wireless client probe requests?

The SSIDs of networks the client has previously connected to

The client's current GPS location

The client's operating system version

GIAC Assessing and Auditing Wireless Networks

Domain 3Objective 1

Wireless Client Attacks GAWN Practice Questions (Page 1)

Part of the Wireless Client and Network Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 3–4 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

9concepts

Questions 1–5

1application · medium
A penetration tester is evaluating the security of a coffee shop's guest Wi-Fi. The shop uses an open network with a captive portal that requires users to enter their email address to access the internet. The tester wants to demonstrate how an attacker could steal customer email addresses and passwords. Which attack would be most effective?
Select an answer first
2application · medium
A network administrator is troubleshooting a wireless issue where users are frequently disconnected from the corporate Wi-Fi. The administrator suspects a deauthentication attack. Which tool or technique would be most effective in confirming this suspicion?
Select an answer first
3foundation · easy
Which of the following is a recommended mitigation against wireless client attacks?
Select an answer first
4application · medium
A network administrator is troubleshooting a wireless network where users report frequent disconnections. The administrator suspects a malicious actor is sending deauthentication frames. Which configuration change would best mitigate this type of attack while maintaining normal operations?
Select an answer first
5foundation · easy
What information can an attacker obtain by passively capturing wireless client probe requests?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.