A penetration tester is assessing a corporate network that uses WPA2-Enterprise with PEAP. The tester wants to capture the credentials of a specific user who is currently connected to the corporate Wi-Fi. The tester has a laptop with a wireless adapter that supports packet injection. Which sequence of actions would be most effective for capturing the user's credentials?

Probe the client with a directed probe request to discover its preferred SSID, then use that information to create a rogue AP with a different SSID.

Passively capture the WPA2 four-way handshake and then perform an offline dictionary attack to recover the user's password.

Send deauthentication frames to the user's client, then set up a rogue AP with the same SSID and a fake RADIUS server to capture the PEAP credentials.

Use a tool to send disassociation frames to the user, then monitor the channel to capture the user's traffic as they reconnect to the legitimate AP.

GIAC Assessing and Auditing Wireless Networks

Domain 3Objective 1

Wireless Client Attacks GAWN Practice Questions (Page 8)

Part of the Wireless Client and Network Attacks domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 3–4 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

9concepts

Questions 36–39

36foundation · easy
Which of the following is a common client-side attack vector that can be delivered over a wireless network?
Select an answer first
37application · medium
A penetration tester is assessing a corporate network that uses WPA2-Enterprise with PEAP. The tester wants to capture the credentials of a specific user who is currently connected to the corporate Wi-Fi. The tester has a laptop with a wireless adapter that supports packet injection. Which sequence of actions would be most effective for capturing the user's credentials?
Select an answer first
38foundation · easy
Which type of network is set up by an attacker to appear as a legitimate free Wi-Fi hotspot to deceive users?
Select an answer first
39foundation · easy
Which type of frame is used to force a wireless client to re-associate with an access point?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

Wireless Client Attacks GAWN Practice Questions (Page 8)

Questions 36–39

Which of the following is a common client-side attack vector that can be delivered over a wireless network?

Which type of network is set up by an attacker to appear as a legitimate free Wi-Fi hotspot to deceive users?

Which type of frame is used to force a wireless client to re-associate with an access point?

Keep studying — Wireless Client and Network Attacks