In a wireless capture, you see a beacon frame advertising the SSID 'Corporate' with a BSSID that does not match any of the company's authorized access points. The beacon's supported rates and vendor-specific information elements differ from the legitimate APs. What is the most likely conclusion?

This is a client device in ad-hoc mode using the same SSID.

This is a wireless intrusion prevention system (WIPS) sensor broadcasting a test beacon.

This is a rogue access point configured to impersonate the corporate SSID.

This is a legitimate AP that has been recently added to the network.

You have a pcap containing a WPA2 handshake and encrypted data frames. You have the passphrase. You need to decrypt the data frames in Wireshark, but the decryption is failing. Which of the following is the most likely cause?

The capture does not include the full 4-way handshake, so Wireshark cannot derive the PTK.

The data frames are encrypted with a different encryption protocol, such as WPA3.

The passphrase is incorrect, but Wireshark does not validate it.

The capture was taken on a different channel than the handshake.

You are investigating a possible rogue AP. You have a capture of a beacon with an SSID that matches your corporate network, but the BSSID is not in your inventory. The signal strength is strong in a conference room. You also notice that the beacon's supported rates include 802.11b rates, which your corporate APs do not support. Which combination of evidence most strongly indicates a rogue AP?

The BSSID is not in inventory and the beacon supports 802.11b rates.

The signal strength is strong in a conference room and the SSID matches.

The beacon's SSID is broadcast and the BSSID is not in inventory.

The beacon's channel is different from your corporate APs and the BSSID is not in inventory.

In a wireless capture, you see a client sending an Association Request to an AP. The AP responds with an Association Response that includes a status code of 17, which means 'AP is unable to handle additional associated stations'. What does this indicate?

The AP has reached its maximum number of associated clients.

The AP is not broadcasting its SSID.

The client is using an unsupported authentication method.

The client's authentication was rejected due to an incorrect password.

GIAC Network Forensic Analyst

Domain 4Objective 2

Wireless Network Analysis GNFA Practice Questions (Page 7)

Part of the Advanced Analysis Techniques domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

9concepts

Questions 31–35

31foundation · easy
Which wireless security protocol uses a 4-way handshake to derive session keys during client association?
Select an answer first
32application · medium
In a wireless capture, you see a beacon frame advertising the SSID 'Corporate' with a BSSID that does not match any of the company's authorized access points. The beacon's supported rates and vendor-specific information elements differ from the legitimate APs. What is the most likely conclusion?
Select an answer first
33expert · hard
You have a pcap containing a WPA2 handshake and encrypted data frames. You have the passphrase. You need to decrypt the data frames in Wireshark, but the decryption is failing. Which of the following is the most likely cause?
Select an answer first
34expert · hard
You are investigating a possible rogue AP. You have a capture of a beacon with an SSID that matches your corporate network, but the BSSID is not in your inventory. The signal strength is strong in a conference room. You also notice that the beacon's supported rates include 802.11b rates, which your corporate APs do not support. Which combination of evidence most strongly indicates a rogue AP?
Select an answer first
35application · medium
In a wireless capture, you see a client sending an Association Request to an AP. The AP responds with an Association Response that includes a status code of 17, which means 'AP is unable to handle additional associated stations'. What does this indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Wireless Network Analysis GNFA Practice Questions (Page 7)

Questions 31–35

Which wireless security protocol uses a 4-way handshake to derive session keys during client association?

In a wireless capture, you see a beacon frame advertising the SSID 'Corporate' with a BSSID that does not match any of the company's authorized access points. The beacon's supported rates and vendor-specific information elements differ from the legitimate APs. What is the most likely conclusion?

You have a pcap containing a WPA2 handshake and encrypted data frames. You have the passphrase. You need to decrypt the data frames in Wireshark, but the decryption is failing. Which of the following is the most likely cause?

In a wireless capture, you see a client sending an Association Request to an AP. The AP responds with an Association Response that includes a status code of 17, which means 'AP is unable to handle additional associated stations'. What does this indicate?

Keep studying — Advanced Analysis Techniques