Wireless Network Analysis GNFA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   You have a pcap file containing a WPA2 handshake between a client and an AP. You need to decrypt the data frames for analysis. What is the minimum information you must have to successfully decrypt the traffic?

   • AThe PMKID and the AP's BSSID.
   • BThe pre-shared key (PSK) and the four-way handshake frames.
   • CThe AP's MAC address and the client's MAC address.
   • DThe SSID and the AP's channel.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   You are reconstructing the movement of a suspect's device through a building. You have captures from three APs with overlapping coverage. The suspect's device was associated with AP1, then AP2, then AP3 over a 10-minute period. However, you notice that the RSSI values from AP1 remain strong even after the device associates with AP2. What is the most likely explanation?

   • AThe capture from AP1 is corrupted and the RSSI values are unreliable.
   • BThe device is using multiple radios and connected to two APs simultaneously.
   • CThe device physically moved back and forth between the APs.
   • DThe device is still within range of AP1 and the association to AP2 is due to load balancing.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   You are performing a wireless security assessment and discover an unknown AP broadcasting an SSID that resembles your company's SSID but with a typo. The AP is using WPA2 and has a strong signal inside the building. What is the most likely classification of this AP?

   • AA rogue AP set up by an attacker to lure users into connecting.
   • BAn AP that was misconfigured by your own IT department.
   • CA client device acting as a soft AP.
   • DA legitimate AP from a neighboring business with a similar name.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A user reports that their laptop repeatedly disconnects from the corporate Wi-Fi. In a packet capture taken from the user's laptop in monitor mode, you see a burst of Deauthentication frames from the AP's BSSID to the user's MAC address, followed by the client re-associating. The pattern repeats every few seconds. What is the most likely explanation?

   • AThe AP is legitimately disconnecting the client due to an incorrect password.
   • BThe client is roaming between two APs with the same SSID.
   • CAn attacker is spoofing the AP's BSSID to send forged deauthentication frames.
   • DThe AP is performing a firmware update and temporarily dropping clients.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In wireless capture analysis, what does a beacon frame with the same SSID but a different BSSID and a much stronger signal strength typically indicate?

   • AA client roaming to another AP
   • BA rogue access point
   • CA normal AP channel change
   • DA beacon interval misconfiguration
   Reveal Solution Discussion Select an answer first