A security analyst is tasked with identifying unauthorized Wi-Fi networks in and around a corporate campus. The analyst needs to map the physical location of access points and detect rogue devices. Which combination of tools and techniques should be used?

Run a network sniffer on the wired backbone to discover wireless clients

Use a spectrum analyzer to detect all RF emissions and correlate with GPS coordinates

Perform wardriving with a Wi-Fi adapter in monitor mode and GPS logging, then analyze the captured packets

Deploy a wireless intrusion prevention system (WIPS) and rely solely on its alerts

A university campus has a wireless intrusion detection system (WIDS) that alerts on a high number of authentication failures from a single MAC address across multiple access points. What is the most likely cause, and what should the administrator do?

An attacker is attempting to brute-force the WPA2 password; temporarily suspend the MAC address and investigate

A rogue access point is attempting to authenticate; block the MAC address

A client is experiencing a deauthentication attack; reboot the access points

A client has a misconfigured profile; ignore the alert

A security analyst is responding to a wireless incident where an attacker used a deauthentication attack to force a client to connect to a rogue AP. The analyst has identified the rogue AP's MAC address and location. Which action should the analyst take to prevent further damage?

Add the rogue AP's MAC address to the WIPS blacklist and physically remove the device.

Disable all wireless access until the investigation is complete.

Send a broadcast message to all users warning them about the rogue AP.

Change the corporate SSID and password to prevent the rogue AP from mimicking it.

GIAC Global Industrial Cyber Security Professional

Domain 2Objective 3

Wireless Technologies & Compromises GICSP Practice Questions (Page 6)

Part of the Threats, Vulnerabilities, and Compromises domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

5concepts

Questions 26–30

26application · medium
A security analyst is tasked with identifying unauthorized Wi-Fi networks in and around a corporate campus. The analyst needs to map the physical location of access points and detect rogue devices. Which combination of tools and techniques should be used?
Select an answer first
27foundation · easy
Which wireless security protocol provides the strongest protection against offline dictionary attacks by using Simultaneous Authentication of Equals (SAE) instead of a pre-shared key?
Select an answer first
28application · medium
A university campus has a wireless intrusion detection system (WIDS) that alerts on a high number of authentication failures from a single MAC address across multiple access points. What is the most likely cause, and what should the administrator do?
Select an answer first
29application · medium
A security analyst notices a sudden increase in deauthentication frames on the wireless network. Several users report that their devices are disconnecting and reconnecting repeatedly. Which type of attack is most likely occurring?
Select an answer first
30expert · hard
A security analyst is responding to a wireless incident where an attacker used a deauthentication attack to force a client to connect to a rogue AP. The analyst has identified the rogue AP's MAC address and location. Which action should the analyst take to prevent further damage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.

Wireless Technologies & Compromises GICSP Practice Questions (Page 6)

Questions 26–30

A security analyst is tasked with identifying unauthorized Wi-Fi networks in and around a corporate campus. The analyst needs to map the physical location of access points and detect rogue devices. Which combination of tools and techniques should be used?

Which wireless security protocol provides the strongest protection against offline dictionary attacks by using Simultaneous Authentication of Equals (SAE) instead of a pre-shared key?

A university campus has a wireless intrusion detection system (WIDS) that alerts on a high number of authentication failures from a single MAC address across multiple access points. What is the most likely cause, and what should the administrator do?

A security analyst notices a sudden increase in deauthentication frames on the wireless network. Several users report that their devices are disconnecting and reconnecting repeatedly. Which type of attack is most likely occurring?

A security analyst is responding to a wireless incident where an attacker used a deauthentication attack to force a client to connect to a rogue AP. The analyst has identified the rogue AP's MAC address and location. Which action should the analyst take to prevent further damage?

Keep studying — Threats, Vulnerabilities, and Compromises