A security analyst is reviewing WIDS logs and notices that a legitimate access point is sending deauthentication frames to a specific client. The analyst suspects that the AP is malfunctioning or has been compromised. Which additional data would help determine the cause?

Verify that the AP is not overloaded with too many connected clients.

Check if the client's device has a faulty wireless driver.

Check the AP's firmware version and recent configuration changes.

Look for a rogue AP with a spoofed MAC address that is sending the deauth frames.

A security analyst is investigating a possible wireless compromise. The WIDS logs show a deauthentication attack targeting a specific client, followed by the client associating with a different AP that has the same SSID. The analyst suspects an evil twin attack. Which additional evidence would most strongly confirm this suspicion?

The client's traffic after reassociation is being captured by the attacker's device, as shown by packet capture analysis.

The legitimate AP's signal strength is lower than the evil twin's signal strength.

The client's device shows a warning about an untrusted certificate during the connection.

The evil twin AP has a different BSSID and is broadcasting on a different channel than the legitimate AP.

A security analyst is tasked with identifying all wireless networks within a large industrial complex. The analyst has a limited budget and needs to cover a large outdoor area. Which approach is most efficient and effective?

Perform a single wardriving pass with a vehicle-mounted antenna and GPS

Use a drone with a Wi-Fi sniffer to fly over the complex

Deploy a distributed WIDS with sensors on every building

Ask employees to report any Wi-Fi networks they see on their phones

GIAC Global Industrial Cyber Security Professional

Domain 2Objective 3

Wireless Technologies & Compromises GICSP Practice Questions (Page 5)

Part of the Threats, Vulnerabilities, and Compromises domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

5concepts

Questions 21–25

21expert · hard
A security analyst is reviewing WIDS logs and notices that a legitimate access point is sending deauthentication frames to a specific client. The analyst suspects that the AP is malfunctioning or has been compromised. Which additional data would help determine the cause?
Select an answer first
22expert · hard
A security analyst is investigating a possible wireless compromise. The WIDS logs show a deauthentication attack targeting a specific client, followed by the client associating with a different AP that has the same SSID. The analyst suspects an evil twin attack. Which additional evidence would most strongly confirm this suspicion?
Select an answer first
23expert · hard
A security analyst is tasked with identifying all wireless networks within a large industrial complex. The analyst has a limited budget and needs to cover a large outdoor area. Which approach is most efficient and effective?
Select an answer first
24foundation · easy
Which wireless reconnaissance technique involves an attacker driving or walking around an area with a wireless-enabled device to discover and map wireless networks, often logging SSIDs, channels, and GPS coordinates?
Select an answer first
25foundation · easy
Which attack exploits a weakness in WPA2's key reinstallation process, allowing an attacker to replay and decrypt packets by tricking a client into reinstalling an already-in-use session key?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.

Wireless Technologies & Compromises GICSP Practice Questions (Page 5)

Questions 21–25

A security analyst is reviewing WIDS logs and notices that a legitimate access point is sending deauthentication frames to a specific client. The analyst suspects that the AP is malfunctioning or has been compromised. Which additional data would help determine the cause?

A security analyst is tasked with identifying all wireless networks within a large industrial complex. The analyst has a limited budget and needs to cover a large outdoor area. Which approach is most efficient and effective?

Which wireless reconnaissance technique involves an attacker driving or walking around an area with a wireless-enabled device to discover and map wireless networks, often logging SSIDs, channels, and GPS coordinates?

Which attack exploits a weakness in WPA2's key reinstallation process, allowing an attacker to replay and decrypt packets by tricking a client into reinstalling an already-in-use session key?

Keep studying — Threats, Vulnerabilities, and Compromises