CWSP (ABWM) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Deauthentication frame

A management frame with subtype 0x0C that terminates a station's authentication and association. Reason code 7 indicates a Class 3 frame received from a nonassociated station.

Evil twin access point

A rogue AP advertising the same SSID as a legitimate network, often cloning the BSSID and channel, so that client devices associate to it and expose traffic to interception.

PMKID offline attack

A WPA2-Personal attack that captures the PMKID from the first EAPOL message of the 4-Way Handshake and tests passphrase guesses offline without requiring a client to connect.

WPS Pixie Dust attack

An offline attack against WPS that uses the M1, M2, and M3 registration messages to recover the enrollee's nonce and derive the PIN on vulnerable chipsets without online guessing.

Frame Control field

The first two bytes of the 802.11 MAC header, containing protocol version, type, subtype, ToDS, FromDS, more fragments, retry, power management, more data, protected frame, and order bits.

Sequence Control field

A two-byte 802.11 header field split into a 4-bit fragment number and a 12-bit sequence number, used with the retry bit to detect duplicate and fragmented frames.

RSN Information Element

Element ID 48 in beacons and probe responses that advertises RSN version, group cipher suite, pairwise cipher suites, AKM suites, and RSN capabilities such as PMF and preauthentication.

Capability Information field

A two-byte field in beacons, probe responses, and association requests whose flags include ESS, IBSS, CF-Pollable, and Privacy, where Privacy set means confidentiality is required.

WIPS containment

Active prevention in which a sensor transmits spoofed deauthentication or disassociation frames, using the rogue AP's client MACs or spoofing the AP BSSID, to break the unauthorized connection.

Rogue AP classification

WIPS categorization of detected radios into authorized, rogue (unauthorized and wired-connected), neighbor, external/interfering, ad-hoc, and unknown, which determines whether containment is permitted.

WIPS sensor placement

Positioning sensors so coverage overlaps across the monitored area; three or more sensors hearing a device enable triangulation or multilateration for physical location of a rogue device.

Signature versus anomaly detection

Signature detection matches known attack frame patterns and tool behaviors; anomaly detection baselines normal RF and traffic behavior and alerts on statistical deviation from that baseline.

EAP-TLS

An EAP method requiring X.509 certificates on both the supplicant and the authentication server, providing mutual authentication and deriving keying material without a tunneled inner method.

PEAP

A tunneled EAP method where the server presents a certificate, a TLS tunnel is built, and an inner method such as EAP-MSCHAPv2 (PEAPv0) or EAP-GTC (PEAPv1) authenticates the user.

EAP-MD5

A legacy EAP method providing only one-way challenge-response authentication with no mutual authentication and no key derivation, so it is unusable with WPA2-Enterprise or 802.11i.

RADIUS EAP-Message attribute

Attribute 79, which encapsulates EAP packets between the authenticator and the RADIUS server; attribute 80, Message-Authenticator, must accompany it to protect integrity and prevent replay.

4-Way Handshake

The RSN exchange that confirms PMK possession and installs keys: message 1 carries ANonce, message 2 SNonce plus MIC, message 3 the GTK plus MIC, message 4 an acknowledgement MIC.

FT key hierarchy

802.11r derives PMK-R0 from the MSK at the R0KH, then PMK-R1 per R1KH, then the PTK; the FTIE carries nonces and key holder IDs and the MDIE names the mobility domain.

Opportunistic Key Caching

A vendor-specific fast roaming method where the client and AP reuse a cached PMK to derive a new pairwise key without a full 802.1X exchange; it predates and is not standardized like 802.11r.

802.11w PMF

Protected Management Frames, which protect unicast deauthentication and disassociation with the PTK and group management frames with BIP, and add SA Query to detect association mismatch.

IPsec ESP

Encapsulating Security Payload, IP protocol 50, which provides confidentiality plus optional integrity and authentication of packet contents, unlike AH which provides integrity only.

L2TP over IPsec

A Layer 2 VPN combining L2TP tunneling on UDP 1701 with IPsec ESP encryption, where IKE uses UDP 500 and NAT traversal uses UDP 4500 to carry the tunnel across NAT devices.

RadSec

RADIUS over TLS, transporting RADIUS authentication on TCP 2083 inside a TLS session so that credentials and attributes are encrypted rather than protected only by a shared secret.

CAPWAP tunnels

The control and data protocol between lightweight APs and a wireless controller, using UDP 5246 for control and UDP 5247 for data, optionally with DTLS encryption of control traffic.

Anchor controller

A DMZ-resident controller to which guest WLAN client traffic is tunneled from the foreign controller, keeping guest traffic off internal VLANs and outside the protected network perimeter.

BYOD onboarding

A provisioning workflow using an open or preshared-key SSID to enroll a device certificate via SCEP or EST, after which the device joins the corporate SSID using 802.1X EAP-TLS.

PCI DSS wireless scanning

Requirement 11.1 mandates quarterly scans for rogue wireless access points, or continuous wireless IDS/IPS monitoring, together with an inventory of authorized wireless devices.

NIST SP 800-153

A guideline publication covering WLAN security configuration, monitoring, and assessment practices, including recommended controls for 802.11i-based and legacy wireless deployments.

Radio Resource Management

A controller feature set that automatically assigns channels through dynamic channel assignment and adjusts AP transmit power through transmit power control within regulatory limits.

WLC logical interfaces

Controller interfaces including management (AP communication and in-band management), dynamic VLAN-mapped interfaces for WLANs, a virtual interface for web authentication, and an out-of-band service port.

NAC posture assessment

Pre-admission evaluation of endpoint state such as patch level, antimalware currency, disk encryption, and host firewall status before the device is placed into an authorized VLAN.

PCI log retention

The requirement to retain audit trail history for at least twelve months, with the most recent three months immediately available for analysis, covering wireless and authentication event logs.