Network Security Fundamentals and the Threat Landscape
Core concepts
Start with the CIA triad (confidentiality, integrity, availability) and map every control you meet back to it. Know the difference between threats (potential causes), vulnerabilities (weaknesses), and risk (likelihood × impact). Understand attack categories: reconnaissance, spoofing, on-path (man-in-the-middle), denial of service, credential attacks, and wireless-specific attacks such as rogue APs, evil twins, deauthentication floods, and WPA handshake capture. Be able to classify a control as preventive, detective, or corrective.
Wireless-specific threats
Distinguish a rogue AP (unauthorized AP on the corporate network) from a neighbor AP (external, not your asset) and an evil twin (impersonating your SSID). Know that deauth frames are unencrypted management frames in legacy WLANs and that management frame protection mitigates spoofed deauths. Understand why open/PSK networks leak the handshake and why 802.1X with per-user credentials resists shared-key compromise.
Traps to watch
Questions often swap confidentiality (encryption) with integrity (hashing) or availability (DoS). A "rogue AP" answer is wrong when the scenario describes an external SSID that merely overlaps yours. Do not confuse authentication (proving identity) with authorization (what you may do).
Rule of thumb
If a scenario asks what a control prevents, name the CIA property it protects and the attack stage it blocks; that framing eliminates distractor answers.