Which sequence of 802.11 management frames is typically exchanged during a successful client association with an access point?

Probe Request/Response, then Association Request/Response only

Authentication Request/Response, then Association Request/Response

Association Request/Response, then Authentication Request/Response

During a site survey, you capture a beacon frame with the same SSID as your corporate network but a different BSSID. The signal strength is consistently strong in a parking lot area. What additional evidence would most strongly indicate a rogue AP?

The beacon's supported data rates are lower than your corporate APs.

The beacon's SSID is broadcast rather than hidden.

The beacon is on a different channel than your corporate APs.

The beacon advertises an open authentication method.

You have a pcap file containing a WPA2 handshake between a client and an AP. You need to determine whether the passphrase is weak and recover it for forensic purposes. Which approach is most appropriate?

Replay the handshake to the AP to observe the passphrase in the response.

Use aircrack-ng with a dictionary or rule-based attack against the 4-way handshake.

Decrypt the traffic by deriving the PTK from the passphrase and the captured nonces.

Use the MIC from the handshake to brute-force the PMK directly.

You are analyzing a wireless capture and need to identify the type of frame that is used by a client to discover nearby access points. Which frame type and subtype should you look for?

Management frame, subtype Beacon

Management frame, subtype Probe Request

Control frame, subtype Request-to-Send (RTS)

GIAC Network Forensic Analyst

Domain 4Objective 2

Wireless Network Analysis GNFA Practice Questions (Page 4)

Part of the Advanced Analysis Techniques domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

9concepts

Questions 16–20

16foundation · easy
When capturing wireless traffic with tcpdump, which option is used to specify the wireless interface?
Select an answer first
17foundation · easy
Which sequence of 802.11 management frames is typically exchanged during a successful client association with an access point?
Select an answer first
18application · medium
During a site survey, you capture a beacon frame with the same SSID as your corporate network but a different BSSID. The signal strength is consistently strong in a parking lot area. What additional evidence would most strongly indicate a rogue AP?
Select an answer first
19application · medium
You have a pcap file containing a WPA2 handshake between a client and an AP. You need to determine whether the passphrase is weak and recover it for forensic purposes. Which approach is most appropriate?
Select an answer first
20application · medium
You are analyzing a wireless capture and need to identify the type of frame that is used by a client to discover nearby access points. Which frame type and subtype should you look for?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.