Wireless Network Security GSEC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A hospital wants to deploy Wi-Fi for medical devices that do not support 802.1X. The devices support WPA2-Personal. The security team wants to minimize the risk of a shared passphrase being compromised. Which additional control is most effective?

   • ADisable SSID broadcast to hide the network.
   • BUse a unique, long passphrase and store it in a secure vault, rotating it regularly.
   • CEnable MAC filtering to allow only the medical devices.
   • DUse WPA3-Personal if the devices support it.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An attacker sets up an unauthorized access point with the same SSID as a legitimate network to trick users into connecting. What type of attack is this?

   • ARogue access point
   • BDeauthentication attack
   • CMAC spoofing
   • DEvil twin
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company's wireless network uses WPA2-Enterprise. An attacker sets up a rogue AP with the same SSID and uses a deauthentication attack to force clients to connect to it. What is the primary risk to the clients?

   • AThe attacker can read the client's traffic because the rogue AP uses the same encryption keys.
   • BThe attacker can decrypt all traffic because WPA2-Enterprise is broken.
   • CThe attacker can capture the client's authentication credentials if the rogue AP is configured to relay them.
   • DThe attacker can permanently disable the client's wireless adapter.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A retail company is upgrading its wireless infrastructure. They want the highest level of wireless security available and need to support a mix of modern laptops and older IoT devices that only support WPA2. Which approach should they take?

   • ADisable encryption and rely on a firewall to protect the network.
   • BEnable WPA3-Enterprise on the network and place legacy devices on a separate VLAN with WPA2.
   • CUse WPA3-Personal with a shared passphrase for all devices.
   • DUse WPA2-Personal for all devices to ensure compatibility.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A hospital uses WPA2-Enterprise with PEAP-MSCHAPv2 for staff Wi-Fi. A security assessment finds that an attacker can perform a rogue AP attack to capture the MSCHAPv2 challenge-response and crack weak passwords. The hospital wants to reduce this risk without replacing the existing RADIUS server. Which change is most effective?

   • AEnforce strong password policies and enable certificate validation on clients.
   • BDisable SSID broadcast to hide the network.
   • CSwitch to WPA2-Personal with a long passphrase.
   • DUse MAC filtering to allow only hospital devices.
   Reveal Solution Discussion Select an answer first