How does an attacker actively collect client probe requests?

By jamming the wireless channel to force clients to resend probes

By physically stealing the client device

By sending probe responses to encourage clients to reveal their preferred networks

By sending deauthentication frames to disconnect clients

A company wants to protect its employees from wireless client attacks, including evil twin and man-in-the-middle attacks. The company uses WPA2-Enterprise with certificates. The security team is considering additional measures. Which combination of measures would provide the most comprehensive protection?

Enable MAC address filtering and use a hidden SSID.

Use WPA3 with SAE and disable 802.11w.

Use a longer WPA2 passphrase and disable SSID broadcast.

Require clients to validate the server certificate, use a VPN for corporate traffic, and enable client isolation on the access points.

A security consultant is testing the wireless network of a small business. The business uses a WPA2-PSK network with a single AP. The consultant wants to demonstrate how an attacker could lure clients to a rogue AP and capture their traffic. Which technique would be most effective?

Set up a rogue AP with the same SSID and use deauthentication frames to force clients to disconnect from the legitimate AP.

Passively capture probe requests from clients to identify the SSID they are searching for, then set up a rogue AP with a different SSID.

Use a tool to crack the WPA2-PSK passphrase and then connect to the legitimate AP as a legitimate client.

Send disassociation frames to the legitimate AP to disable it, then wait for clients to connect to the rogue AP.

What is the purpose of sending deauthentication frames in a wireless attack?

To improve the encryption of the wireless connection

To authenticate clients to the network

To disconnect clients from a legitimate access point

To increase the signal strength of the access point

Which technique is commonly used by an attacker to make a rogue access point more attractive to wireless clients?

Placing the rogue AP in a Faraday cage

Disabling all encryption on the rogue AP

Setting the rogue AP to use a stronger signal than the legitimate AP

Using a different SSID than the legitimate network

GIAC Assessing and Auditing Wireless Networks

Domain 3Objective 1

Wireless Client Attacks GAWN Practice Questions (Page 3)

Part of the Wireless Client and Network Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 3–4 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

9concepts

Questions 11–15

11foundation · easy
How does an attacker actively collect client probe requests?
Select an answer first
12expert · hard
A company wants to protect its employees from wireless client attacks, including evil twin and man-in-the-middle attacks. The company uses WPA2-Enterprise with certificates. The security team is considering additional measures. Which combination of measures would provide the most comprehensive protection?
Select an answer first
13application · medium
A security consultant is testing the wireless network of a small business. The business uses a WPA2-PSK network with a single AP. The consultant wants to demonstrate how an attacker could lure clients to a rogue AP and capture their traffic. Which technique would be most effective?
Select an answer first
14foundation · easy
What is the purpose of sending deauthentication frames in a wireless attack?
Select an answer first
15foundation · easy
Which technique is commonly used by an attacker to make a rogue access point more attractive to wireless clients?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.