You are analyzing a wireless capture to determine if a specific client was involved in an attack. The client's MAC address appears in the capture, but you suspect MAC spoofing. Which additional evidence would most strongly support the conclusion that the MAC address was spoofed?

The client's frames are all addressed to the same AP.

The client's frames use a variety of data rates.

The client's frames show a consistent RSSI throughout the capture.

The sequence numbers in the client's frames are not monotonically increasing.

You are investigating a wireless DoS attack. In the capture, you see a high volume of deauthentication frames with the source MAC address of the legitimate AP, but the AP's firmware logs show no such frames were sent. What does this indicate?

The AP is experiencing a firmware bug that causes it to send deauth frames without logging.

The deauthentication frames were spoofed by an attacker.

The capture contains frames from a neighboring AP with the same MAC address.

The deauthentication frames are actually from the client, not the AP.

During a wireless investigation, you capture traffic from a corporate WPA2-Enterprise network. You observe a client sending an Authentication frame with an open-system algorithm, followed by an Association Request, and then the AP responds with an Association Response containing status code 0. However, the client never completes the 802.1X/EAP exchange. What does this sequence most likely indicate?

The AP is using WEP and the client failed the shared-key authentication.

The client has successfully authenticated and is now able to send data frames to the network.

The client is performing a rogue AP attack by sending unsolicited association frames.

The client is attempting to associate but will not gain network access until the 802.1X authentication completes.

In a wireless capture, a high volume of deauthentication frames from a single MAC address to various clients is most indicative of what?

A beacon frame misconfiguration

A client attempting to associate

GIAC Network Forensic Analyst

Domain 4Objective 2

Wireless Network Analysis GNFA Practice Questions (Page 5)

Part of the Advanced Analysis Techniques domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

9concepts

Questions 21–25

21expert · hard
You are analyzing a wireless capture to determine if a specific client was involved in an attack. The client's MAC address appears in the capture, but you suspect MAC spoofing. Which additional evidence would most strongly support the conclusion that the MAC address was spoofed?
Select an answer first
22application · medium
You are investigating a wireless DoS attack. In the capture, you see a high volume of deauthentication frames with the source MAC address of the legitimate AP, but the AP's firmware logs show no such frames were sent. What does this indicate?
Select an answer first
23foundation · easy
Which 802.11 management frame subtype is transmitted periodically by an access point to advertise its presence and capabilities?
Select an answer first
24application · medium
During a wireless investigation, you capture traffic from a corporate WPA2-Enterprise network. You observe a client sending an Authentication frame with an open-system algorithm, followed by an Association Request, and then the AP responds with an Association Response containing status code 0. However, the client never completes the 802.1X/EAP exchange. What does this sequence most likely indicate?
Select an answer first
25foundation · easy
In a wireless capture, a high volume of deauthentication frames from a single MAC address to various clients is most indicative of what?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Wireless Network Analysis GNFA Practice Questions (Page 5)

Questions 21–25

You are analyzing a wireless capture to determine if a specific client was involved in an attack. The client's MAC address appears in the capture, but you suspect MAC spoofing. Which additional evidence would most strongly support the conclusion that the MAC address was spoofed?

You are investigating a wireless DoS attack. In the capture, you see a high volume of deauthentication frames with the source MAC address of the legitimate AP, but the AP's firmware logs show no such frames were sent. What does this indicate?

Which 802.11 management frame subtype is transmitted periodically by an access point to advertise its presence and capabilities?

In a wireless capture, a high volume of deauthentication frames from a single MAC address to various clients is most indicative of what?

Keep studying — Advanced Analysis Techniques