Winter Special Flat 65% Limited Time Discount offer - Ends in 0d 00h 00m 00s - Coupon code: suredis

CWNP CWSP-207 Certified Wireless Security Professional (CWSP) Exam Practice Test

Demo: 27 questions
Total 119 questions

Certified Wireless Security Professional (CWSP) Questions and Answers

Question 1

What elements should be addressed by a WLAN security policy? (Choose 2)

Options:

A.

Enabling encryption to prevent MAC addresses from being sent in clear text

B.

How to prevent non-IT employees from learning about and reading the user security policy

C.

End-user training for password selection and acceptable network use

D.

The exact passwords to be used for administration interfaces on infrastructure devices

E.

Social engineering recognition and mitigation techniques

Question 2

As the primary security engineer for a large corporate network, you have been asked to author a new security policy for the wireless network. While most client devices support 802.1X authentication, some legacy devices still only support passphrase/PSK-based security methods.

When writing the 802.11 security policy, what password-related items should be addressed?

Options:

A.

MSCHAPv2 passwords used with EAP/PEAPv0 should be stronger than typical WPA2-PSK passphrases.

B.

Password complexity should be maximized so that weak WEP IV attacks are prevented.

C.

Static passwords should be changed on a regular basis to minimize the vulnerabilities of a PSK-based authentication.

D.

Certificates should always be recommended instead of passwords for 802.11 client authentication.

E.

EAP-TLS must be implemented in such scenarios.

Question 3

As a part of a large organization’s security policy, how should a wireless security professional address the problem of rogue access points?

Options:

A.

Use a WPA2-Enterprise compliant security solution with strong mutual authentication and encryption for network access of corporate devices.

B.

Hide the SSID of all legitimate APs on the network so that intruders cannot copy this parameter on rogue APs.

C.

Conduct thorough manual facility scans with spectrum analyzers to detect rogue AP RF signatures.

D.

A trained employee should install and configure a WIPS for rogue detection and response measures.

E.

Enable port security on Ethernet switch ports with a maximum of only 3 MAC addresses on each port.

Question 4

In what deployment scenarios would it be desirable to enable peer-to-peer traffic blocking?

Options:

A.

In home networks in which file and printer sharing is enabled

B.

At public hot-spots in which many clients use diverse applications

C.

In corporate Voice over Wi-Fi networks with push-to-talk multicast capabilities

D.

In university environments using multicast video training sourced from professor’s laptops

Question 5

Given: ABC Hospital wishes to create a strong security policy as a first step in securing their 802.11 WLAN.

Before creating the WLAN security policy, what should you ensure you possess?

Options:

A.

Awareness of the exact vendor devices being installed

B.

Management support for the process

C.

End-user training manuals for the policies to be created

D.

Security policy generation software

Question 6

What policy would help mitigate the impact of peer-to-peer attacks against wireless-enabled corporate laptop computers when the laptops are also used on public access networks such as wireless hot-spots?

Options:

A.

Require Port Address Translation (PAT) on each laptop.

B.

Require secure applications such as POP, HTTP, and SSH.

C.

Require VPN software for connectivity to the corporate network.

D.

Require WPA2-Enterprise as the minimal WLAN security solution.

Question 7

For a WIPS system to identify the location of a rogue WLAN device using location patterning (RF fingerprinting), what must be done as part of the WIPS installation?

Options:

A.

All WIPS sensors must be installed as dual-purpose (AP/sensor) devices.

B.

A location chipset (GPS) must be installed with it.

C.

At least six antennas must be installed in each sensor.

D.

The RF environment must be sampled during an RF calibration process.

Question 8

Given: XYZ Hospital plans to improve the security and performance of their Voice over Wi-Fi implementation and will be upgrading to 802.11n phones with 802.1X/EAP authentication. XYZ would like to support fast secure roaming for the phones and will require the ability to troubleshoot reassociations that are delayed or dropped during inter-channel roaming.

What portable solution would be recommended for XYZ to troubleshoot roaming problems?

Options:

A.

WIPS sensor software installed on a laptop computer

B.

Spectrum analyzer software installed on a laptop computer

C.

An autonomous AP mounted on a mobile cart and configured to operate in monitor mode

D.

Laptop-based protocol analyzer with multiple 802.11n adapters

Question 9

Given: You view a protocol analyzer capture decode with the following protocol frames listed in the following order (excluding the ACK frames):

1) 802.11 Probe Request and 802.11 Probe Response

2) 802.11 Auth and another 802.11 Auth

2) 802.11 Assoc Req and 802.11 Assoc Rsp

4) EAPOL-Start

5) EAP Request and EAP Response

6) EAP Request and EAP Response

7) EAP Request and EAP Response

8) EAP Request and EAP Response

9) EAP Request and EAP Response

10) EAP Success

19) EAPOL-Key (4 frames in a row)

What are you seeing in the capture file? (Choose 4)

Options:

A.

WPA2-Enterprise authentication

B.

WPA2-Personal authentication

C.

802.11 Open System authentication

D.

802.1X with Dynamic WEP

E.

Wi-Fi Protected Setup with PIN

F.

Active Scanning

G.

4-Way Handshake

Question 10

What wireless authentication technologies may build a TLS tunnel between the supplicant and the authentication server before passing client authentication credentials to the authentication server? (Choose 3)

Options:

A.

EAP-MD5

B.

EAP-TLS

C.

LEAP

D.

PEAPv0/MSCHAPv2

E.

EAP-TTLS

Question 11

Given: Fred works primarily from home and public wireless hot-spots rather than commuting to the office. He frequently accesses the office network remotely from his Mac laptop using the local 802.11 WLAN.

In this remote scenario, what single wireless security practice will provide the greatest security for Fred?

Options:

A.

Use an IPSec VPN for connectivity to the office network

B.

Use only HTTPS when agreeing to acceptable use terms on public networks

C.

Use enterprise WIPS on the corporate office network

D.

Use WIPS sensor software on the laptop to monitor for risks and attacks

E.

Use 802.1X/PEAPv0 to connect to the corporate office network from public hot-spots

F.

Use secure protocols, such as FTP, for remote file transfers.

Question 12

Given: Your network includes a controller-based WLAN architecture with centralized data forwarding. The AP builds an encrypted tunnel to the WLAN controller. The WLAN controller is uplinked to the network via a trunked 1 Gbps Ethernet port supporting all necessary VLANs for management, control, and client traffic.

What processes can be used to force an authenticated WLAN client's data traffic into a specific VLAN as it exits the WLAN controller interface onto the wired uplink? (Choose 3)

Options:

A.

On the Ethernet switch that connects to the AP, configure the switch port as an access port (not trunking) in the VLAN of supported clients.

B.

During 802.1X authentication, RADIUS sends a return list attribute to the WLAN controller assigning the user and all traffic to a specific VLAN.

C.

In the WLAN controller’s local user database, create a static username-to-VLAN mapping on the WLAN controller to direct data traffic from a specific user to a designated VLAN.

D.

Configure the WLAN controller with static SSID-to-VLAN mappings; the user will be assigned to a VLAN according to the SSID being used.

Question 13

What is the purpose of the Pairwise Transient Key (PTK) in IEEE 802.11 Authentication and Key Management?

Options:

A.

The PTK is a type of master key used as an input to the GMK, which is used for encrypting multicast data frames.

B.

The PTK contains keys that are used to encrypt unicast data frames that traverse the wireless medium.

C.

The PTK is XOR'd with the PSK on the Authentication Server to create the AAA key.

D.

The PTK is used to encrypt the Pairwise Master Key (PMK) for distribution to the 802.1X Authenticator prior to the 4-Way Handshake.

Question 14

What is one advantage of using EAP-TTLS instead of EAP-TLS as an authentication mechanism in an 802.11 WLAN?

Options:

A.

EAP-TTLS sends encrypted supplicant credentials to the authentication server, but EAP-TLS uses unencrypted user credentials.

B.

EAP-TTLS supports client certificates, but EAP-TLS does not.

C.

EAP-TTLS does not require an authentication server, but EAP-TLS does.

D.

EAP-TTLS does not require the use of a certificate for each STA as authentication credentials, but EAP-TLS does.

Question 15

You have an AP implemented that functions only using 802.11-2012 standard methods for the WLAN communications on the RF side and implementing multiple SSIDs and profiles on the management side configured as follows:

1. SSID: Guest – VLAN 90 – Security: Open with captive portal authentication – 2 current clients

2. SSID: ABCData – VLAN 10 – Security: PEAPv0/EAP-MSCHAPv2 with AES-CCMP – 5 current clients

3. SSID: ABCVoice – VLAN 60 – Security: WPA2-Personal – 2 current clients

Two client STAs are connected to ABCData and can access a media server that requires authentication at the Application Layer and is used to stream multicast video streams to the clients.

What client stations possess the keys that are necessary to decrypt the multicast data packets carrying these videos?

Options:

A.

Only the members of the executive team that are part of the multicast group configured on the media server

B.

All clients that are associated to the AP using the ABCData SSID

C.

All clients that are associated to the AP using any SSID

D.

All clients that are associated to the AP with a shared GTK, which includes ABCData and ABCVoice.

Question 16

Given: You are using WEP as an encryption solution. You are using VLANs for network segregation.

Why can you not establish an RSNA?

Options:

A.

RSNA connections require TKIP or CCMP.

B.

RSNA connections require BIP and do not support TKIP, CCMP or WEP.

C.

RSNA connections require CCMP and do not support TKIP or WEP.

D.

RSNA connections do not work in conjunction with VLANs.

Question 17

When used as part of a WLAN authentication solution, what is the role of LDAP?

Options:

A.

A data retrieval protocol used by an authentication service such as RADIUS

B.

An IEEE X.500 standard compliant database that participates in the 802.1X port-based access control process

C.

A SQL compliant authentication service capable of dynamic key generation and distribution

D.

A role-based access control protocol for filtering data to/from authenticated stations.

E.

An Authentication Server (AS) that communicates directly with, and provides authentication for, the Supplicant.

Question 18

Given: ABC Company has a WLAN controller using WPA2-Enterprise with PEAPv0/MS-CHAPv2 and AES-CCMP to secure their corporate wireless data. They wish to implement a guest WLAN for guest users to have Internet access, but want to implement some security controls. The security requirements for the hot-spot include:

  • Cannot access corporate network resources
  • Network permissions are limited to Internet access
  • All stations must be authenticated

What security controls would you suggest? (Choose the single best answer.)

Options:

A.

Implement separate controllers for the corporate and guest WLANs.

B.

Use a WIPS to deauthenticate guest users when their station tries to associate with the corporate WLAN.

C.

Configure access control lists (ACLs) on the guest WLAN to control data types and destinations.

D.

Require guest users to authenticate via a captive portal HTTPS login page and place the guest WLAN and the corporate WLAN on different VLANs.

E.

Force all guest users to use a common VPN protocol to connect.

Question 19

Given: One of the security risks introduced by WPA2-Personal is an attack conducted by an authorized network user who knows the passphrase. In order to decrypt other users’ traffic, the attacker must obtain certain information from the 4-way handshake of the other users.

In addition to knowing the Pairwise Master Key (PMK) and the supplicant’s address (SA), what other three inputs must be collected with a protocol analyzer to recreate encryption keys? (Choose 3)

Options:

A.

Authenticator nonce

B.

Supplicant nonce

C.

Authenticator address (BSSID)

D.

GTKSA

E.

Authentication Server nonce

Question 20

Given: John Smith uses a coffee shop's Internet hot-spot (no authentication or encryption) to transfer funds between his checking and savings accounts at his bank's website. The bank’s website uses the HTTPS protocol to protect sensitive account information. While John was using the hot-spot, a hacker was able to obtain John’s bank account user ID and password and exploit this information.

What likely scenario could have allowed the hacker to obtain John’s bank account user ID and password?

Options:

A.

John's bank is using an expired X.509 certificate on their web server. The certificate is on John's Certificate Revocation List (CRL), causing the user ID and password to be sent unencrypted.

B.

John uses the same username and password for banking that he does for email. John used a POP3 email client at the wireless hot-spot to check his email, and the user ID and password were not encrypted.

C.

John accessed his corporate network with his IPSec VPN software at the wireless hot-spot. An IPSec VPN only encrypts data, so the user ID and password were sent in clear text. John uses the same username and password for banking that he does for his IPSec VPN software.

D.

The bank’s web server is using an X.509 certificate that is not signed by a root CA, causing the user ID and password to be sent unencrypted.

E.

Before connecting to the bank’s website, John’s association to the AP was hijacked. The attacker intercepted the HTTPS public encryption key from the bank’s web server and has decrypted John’s login credentials in near real-time.

Question 21

What type of WLAN attack is prevented with the use of a per-MPDU TKIP sequence counter (TSC)?

Options:

A.

Weak-IV

B.

Forgery

C.

Replay

D.

Bit-flipping

E.

Session hijacking

Question 22

Given: You have a Windows laptop computer with an integrated, dual-band, Wi-Fi compliant adapter. Your laptop computer has protocol analyzer software installed that is capable of capturing and decoding 802.11ac data.

What statement best describes the likely ability to capture 802.11ac frames for security testing purposes?

Options:

A.

All integrated 802.11ac adapters will work with most protocol analyzers for frame capture, including the Radio Tap Header.

B.

Integrated 802.11ac adapters are not typically compatible with protocol analyzers in Windows laptops. It is often best to use a USB adapter or carefully select a laptop with an integrated adapter that will work.

C.

Laptops cannot be used to capture 802.11ac frames because they do not support MU-MIMO.

D.

Only Wireshark can be used to capture 802.11ac frames as no other protocol analyzer has implemented the proper frame decodes.

E.

The only method available to capture 802.11ac frames is to perform a remote capture with a compatible access point.

Question 23

What software and hardware tools are used together to hijack a wireless station from the authorized wireless network onto an unauthorized wireless network? (Choose 2)

Options:

A.

RF jamming device and a wireless radio card

B.

A low-gain patch antenna and terminal emulation software

C.

A wireless workgroup bridge and a protocol analyzer

D.

DHCP server software and access point software

E.

MAC spoofing software and MAC DoS software

Question 24

Given: The Aircrack-ng WLAN software tool can capture and transmit modified 802.11 frames over the wireless network. It comes pre-installed on Kali Linux and some other Linux distributions.

What are three uses for such a tool? (Choose 3)

Options:

A.

Transmitting a deauthentication frame to disconnect a user from the AP.

B.

Auditing the configuration and functionality of a WIPS by simulating common attack sequences

C.

Probing the RADIUS server and authenticator to expose the RADIUS shared secret

D.

Cracking the authentication or encryption processes implemented poorly in some WLANs

Question 25

Given: ABC Corporation is evaluating the security solution for their existing WLAN. Two of their supported solutions include a PPTP VPN and 802.1X/LEAP. They have used PPTP VPNs because of their wide support in server and desktop operating systems. While both PPTP and LEAP adhere to the minimum requirements of the corporate security policy, some individualshave raised concerns about MS-CHAPv2 (and similar) authentication and the known fact that MS-CHAPv2 has proven vulnerable in improper implementations.

As a consultant, what do you tell ABC Corporation about implementing MS-CHAPv2 authentication? (Choose 2)

Options:

A.

MS-CHAPv2 is compliant with WPA-Personal, but not WPA2-Enterprise.

B.

MS-CHAPv2 is subject to offline dictionary attacks.

C.

LEAP’s use of MS-CHAPv2 is only secure when combined with WEP.

D.

MS-CHAPv2 is only appropriate for WLAN security when used inside a TLS-encrypted tunnel.

E.

MS-CHAPv2 uses AES authentication, and is therefore secure.

F.

When implemented with AES-CCMP encryption, MS-CHAPv2 is very secure.

Question 26

Given: WLAN attacks are typically conducted by hackers to exploit a specific vulnerability within a network.

What statement correctly pairs the type of WLAN attack with the exploited vulnerability? (Choose 3)

Options:

A.

Management interface exploit attacks are attacks that use social engineering to gain credentials from managers.

B.

Zero-day attacks are always authentication or encryption cracking attacks.

C.

RF DoS attacks prevent successful wireless communication on a specific frequency or frequency range.

D.

Hijacking attacks interrupt a user’s legitimate connection and introduce a new connection with an evil twin AP.

E.

Social engineering attacks are performed to collect sensitive information from unsuspecting users

F.

Association flood attacks are Layer 3 DoS attacks performed against authenticated client stations

Question 27

A WLAN is implemented using WPA-Personal and MAC filtering.

To what common wireless network attacks is this network potentially vulnerable? (Choose 3)

Options:

A.

Offline dictionary attacks

B.

MAC Spoofing

C.

ASLEAP

D.

DoS

Demo: 27 questions
Total 119 questions