CWSP-205

CWSP-205 practice questions, page 4 of 5, with answer review and explanations.

Question 16

Given: In XYZs small business, two autonomous 802.11ac APs and 12 client devices are in use with WPA2-Personal. What statement about the WLAN security of this company is true?

  1. Intruders may obtain the passphrase with an offline dictionary attack and gain network access, but will be unable to decrypt the data traffic of other users.
  2. A successful attack against all unicast traffic on the network would require a weak passphrase dictionary attack and the capture of the latest 4-Way Handshake for each client.
  3. An unauthorized wireless client device cannot associate, but can eavesdrop on some data because WPA2-Personal does not encrypt multicast or broadcast traffic.
  4. An unauthorized WLAN user with a protocol analyzer can decode data frames of authorized users if he captures the BSSID, client MAC address, and a users 4-Way Handshake.
  5. Because WPA2-Personal uses Open System authentication followed by a 4-Way Handshake, hijacking attacks are easily performed.

Question 17

Given: The Aircrack-ng WLAN software tool can capture and transmit modified 802.11 frames over the wireless network. It comes pre-installed on Kali Linux and some other Linux distributions. What are three uses for such a tool? (Choose 3)

  1. Transmitting a deauthentication frame to disconnect a user from the AP.
  2. Auditing the configuration and functionality of a WIPS by simulating common attack sequences
  3. Probing the RADIUS server and authenticator to expose the RADIUS shared secret
  4. Cracking the authentication or encryption processes implemented poorly in some WLANs

Question 18

Given: You manage a wireless network that services 200 wireless users. Your facility requires 20 access points, and you have installed an IEEE 802.11-compliant implementation of 802.1X/LEAP with AES-CCMP as an authentication and encryption solution. In this configuration, the wireless network is initially susceptible to what type of attacks? (Choose 2)

  1. Encryption cracking
  2. Offline dictionary attacks
  3. Layer 3 peer-to-peer
  4. Application eavesdropping
  5. Session hijacking
  6. Layer 1 DoS

Question 19

Given: ABC Corporation is evaluating the security solution for their existing WLAN. Two of their supported solutions include a PPTP VPN and 802.1X/LEAP. They have used PPTP VPNs because of their wide support in server and desktop operating systems. While both PPTP and LEAP adhere to the minimum requirements of the corporate security policy, some individuals have raised concerns about MS-CHAPv2 (and similar) authentication and the known fact that MS-CHAPv2 has proven vulnerable in improper implementations. As a consultant, what do you tell ABC Corporation about implementing MS-CHAPv2 authentication? (Choose 2)

  1. MS-CHAPv2 is compliant with WPA-Personal, but not WPA2-Enterprise.
  2. MS-CHAPv2 is subject to offline dictionary attacks.
  3. LEAP’s use of MS-CHAPv2 is only secure when combined with WEP.
  4. MS-CHAPv2 is only appropriate for WLAN security when used inside a TLS-encrypted tunnel.
  5. MS-CHAPv2 uses AES authentication, and is therefore secure.
  6. When implemented with AES-CCMP encryption, MS-CHAPv2 is very secure.

Question 20

You perform a protocol capture using Wireshark and a compatible 802.11 adapter in Linux. When viewing the capture, you see an auth req frame and an auth rsp frame. Then you see an assoc req frame and an assoc rsp frame. Shortly after, you see DHCP communications and then ISAKMP protocol packets. What security solution is represented?

  1. 802.1X/EAP-TTLS
  2. Open 802.11 authentication with IPSec
  3. 802.1X/PEAPv0/MS-CHAPv2
  4. WPA2-Personal with AES-CCMP
  5. EAP-MD5