I85PREP
⌘ K
CWSP study materials
CWSP study resources

CWSP (CWNP) practice questions

One question at a time. Build your CWSP understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1WLAN authentication, keying and protected access

What is the primary purpose of WPA3-Enterprise 192-bit mode?

  1. To provide backward compatibility with WPA2 devices
  2. To deliver the highest level of wireless security using CNSA suite ciphers for sensitive environments Correct answer.
  3. To simplify passphrase management for home users
  4. To reduce encryption overhead for IoT devices

Explanation

WPA3-Enterprise 192-bit mode provides the highest level of wireless security by mandating CNSA (Commercial National Security Algorithm) suite ciphers. This includes GCMP-256 encryption, 384-bit ECDSA certificates, SHA-384 for key derivation, and BIP-GMAC-256 for management frame protection. It is designed for government, defense, finance, and other environments handling classified or highly sensitive data.

Question 2WLAN authentication, keying and protected access

What is a deauthentication attack?

  1. A legitimate process for disconnecting clients
  2. An attack where forged deauthentication frames are sent to disconnect clients from an AP, potentially enabling further attacks Correct answer.
  3. A method for cracking WPA3 passwords
  4. An AP firmware exploit

Explanation

A deauthentication attack involves an attacker sending forged 802.11 deauthentication management frames to disconnect clients from their associated AP. This can be used as a denial-of-service attack, or to force clients to reconnect and capture the authentication handshake for offline cracking. Protected Management Frames (PMF/802.11w), mandatory in WPA3, mitigates this attack by authenticating management frames.

Question 3WLAN authentication, keying and protected access

What does PMF (Protected Management Frames) protect against?

  1. Data frame eavesdropping
  2. Spoofing and forging of management frames such as deauthentication and disassociation Correct answer.
  3. RF interference from non-Wi-Fi sources
  4. Brute-force password attacks

Explanation

Protected Management Frames (PMF), standardized in 802.11w and mandatory in WPA3, cryptographically protects certain management frames (deauthentication, disassociation, and robust action frames) from being spoofed or forged by attackers. PMF uses BIP (Broadcast/Multicast Integrity Protocol) for broadcast frames and encrypts unicast management frames with existing session keys, preventing deauthentication attacks and management frame injection.

Question 4WLAN authentication, keying and protected access

What is an evil twin attack?

  1. Two APs configured with the same channel
  2. An attacker creates a fake AP with the same SSID as a legitimate network to trick users into connecting and intercepting their traffic Correct answer.
  3. A misconfigured AP broadcasting two SSIDs
  4. Two users sharing the same credentials

Explanation

An evil twin attack involves an attacker setting up a rogue AP that mimics a legitimate network by broadcasting the same SSID (and sometimes MAC address). Unsuspecting users connect to the attacker's AP, which then forwards traffic to the real network while intercepting all communications (man-in-the-middle). The attacker can capture credentials, inject malicious content, or steal sensitive data. Enterprise 802.1X mutual authentication helps prevent this attack.

Question 5WLAN authentication, keying and protected access

What is the role of the Pairwise Master Key (PMK) in WPA2/WPA3 key hierarchy?

  1. It directly encrypts data frames
  2. It serves as the master key from which the Pairwise Transient Key (PTK) is derived during the 4-way handshake Correct answer.
  3. It authenticates management frames
  4. It encrypts the RADIUS shared secret

Explanation

The PMK is the top-level key in the pairwise key hierarchy. In WPA2/WPA3-Personal, it is derived from the passphrase using PBKDF2. In Enterprise mode, it is derived from the EAP authentication exchange. The PMK itself never encrypts data directly. Instead, it feeds into the 4-way handshake along with nonces from both sides and MAC addresses to derive the session-specific PTK, which contains the actual encryption and integrity keys.

Question 6WLAN authentication, keying and protected access

What is the purpose of VLAN segmentation in wireless security?

  1. To increase wireless signal range
  2. To isolate different types of wireless traffic into separate broadcast domains for security and traffic management Correct answer.
  3. To encrypt wireless data frames
  4. To balance client loads across APs

Explanation

VLAN segmentation assigns different wireless SSIDs/user groups to separate VLANs, creating isolated broadcast domains. This limits the blast radius of security incidents, separates guest traffic from corporate traffic, enforces different security policies per group, and prevents lateral movement between network segments. Dynamic VLAN assignment via RADIUS attributes allows per-user segmentation based on authentication results.

Question 7WLAN authentication, keying and protected access

What wireless security vulnerability does the KRACK (Key Reinstallation Attack) exploit?

  1. A flaw in WPA3-SAE authentication
  2. A vulnerability in the WPA2 4-way handshake that allows key reinstallation through replay of handshake messages Correct answer.
  3. A weakness in RADIUS server software
  4. A flaw in 802.11 beacon frame processing

Explanation

KRACK (Key Reinstallation Attack), disclosed in 2017, exploits a vulnerability in the WPA2 4-way handshake. By manipulating and replaying handshake messages, an attacker can force the client to reinstall an already-in-use key, resetting nonces and allowing packet decryption and injection. The vulnerability affects the protocol specification itself, not specific implementations. It was mitigated through software patches and is addressed by WPA3's redesigned handshake.

Question 8WLAN authentication, keying and protected access

What is RF jamming and how does it differ from a deauthentication attack?

  1. They are the same attack using different names
  2. RF jamming floods the spectrum with noise to prevent all wireless communication; deauthentication attacks target specific clients or APs using forged management frames Correct answer.
  3. RF jamming only affects 5 GHz; deauthentication affects 2.4 GHz
  4. RF jamming requires network credentials; deauthentication does not

Explanation

RF jamming is a physical layer attack that generates high-power RF noise to overwhelm legitimate wireless signals, creating a denial of service for all devices in the affected area regardless of protocol or security. It is difficult to prevent and is illegal in most jurisdictions. Deauthentication attacks operate at the MAC layer, sending forged management frames to disconnect specific clients. While deauth attacks can be mitigated with PMF, RF jamming requires physical detection and removal of the jamming device.

Question 9WLAN authentication, keying and protected access

What is the PTK (Pairwise Transient Key) composed of in WPA2/WPA3?

  1. A single encryption key
  2. Multiple keys including KCK (Key Confirmation Key), KEK (Key Encryption Key), and TK (Temporal Key), each serving a specific security function Correct answer.
  3. The passphrase encrypted with AES
  4. A hash of the SSID

Explanation

The PTK is derived during the 4-way handshake and is composed of three sub-keys: KCK (Key Confirmation Key) used to verify integrity of EAPOL-Key frames during the handshake, KEK (Key Encryption Key) used to encrypt the GTK during delivery, and TK (Temporal Key) used for actual data frame encryption (CCMP or GCMP). The PTK is unique per client session, derived from the PMK, AP nonce (ANonce), client nonce (SNonce), and both MAC addresses.

Question 10WLAN authentication, keying and protected access

What wireless security considerations are specific to IoT device deployments?

  1. IoT devices require no special security considerations
  2. IoT devices often lack enterprise security capabilities (no 802.1X supplicant), have limited processing power for strong encryption, may use default credentials, and require network segmentation to isolate them from critical systems Correct answer.
  3. IoT devices are inherently secure
  4. IoT devices should always use WPA3-Enterprise

Explanation

IoT devices present unique wireless security challenges: many lack 802.1X supplicant software and can only use PSK authentication, have limited CPU/memory for strong encryption, ship with default or hardcoded credentials, rarely receive security updates, and may use insecure protocols. Security best practices include VLAN segmentation to isolate IoT traffic, MAC authentication with profiling, dedicated SSIDs with restricted access policies, monitoring for anomalous behavior, and maintaining an inventory of all connected IoT devices.

Question 11WLAN authentication, keying and protected access

What is the purpose of 802.11w (Management Frame Protection) in preventing wireless attacks?

  1. It encrypts all data frames
  2. It authenticates and protects unicast and broadcast management frames against spoofing, preventing deauthentication and disassociation attacks Correct answer.
  3. It accelerates roaming between APs
  4. It provides QoS for management traffic

Explanation

802.11w provides cryptographic protection for management frames. Unicast robust management frames are encrypted and integrity-protected using the same key as data frames. Broadcast robust management frames use the Broadcast/Multicast Integrity Protocol (BIP) with a separate IGTK (Integrity Group Temporal Key). This prevents attackers from injecting forged deauthentication or disassociation frames, which are the basis of many wireless DoS attacks. 802.11w is mandatory for WPA3 certification.

Question 12WLAN authentication, keying and protected access

What is the significance of the GTK (Group Temporal Key) in WPA2/WPA3?

  1. It encrypts unicast traffic between a specific client and AP
  2. It encrypts broadcast and multicast traffic sent from the AP to all associated clients in the BSS Correct answer.
  3. It authenticates management frames
  4. It protects the RADIUS shared secret

Explanation

The Group Temporal Key (GTK) is used to encrypt broadcast and multicast traffic in a BSS. All clients associated with the same AP share the same GTK. It is delivered to each client during the 4-way handshake (encrypted with that client's KEK). When a client disassociates, the AP generates a new GTK and distributes it to remaining clients via the Group Key Handshake to prevent the departing client from decrypting future broadcast traffic.

Question 13WLAN authentication, keying and protected access

What is the Transition Security Network (TSN) mode and when is it used?

  1. A completely new security protocol
  2. A mixed-mode operation that allows both WPA2 and WPA3 clients to connect to the same BSS during the migration period Correct answer.
  3. A temporary security configuration for testing
  4. A backup authentication method

Explanation

Transition Security Network (TSN) mode, also called WPA3-Transition mode, allows a BSS to support both WPA2 and WPA3 clients simultaneously during the migration to WPA3. WPA3 clients use SAE while WPA2 clients use PSK, both on the same SSID. This provides backward compatibility but reduces the security level because WPA2-PSK remains vulnerable to offline dictionary attacks. Organizations should plan to disable TSN mode once all clients support WPA3.

Question 14WLAN authentication, keying and protected access

What is the purpose of the IGTK (Integrity Group Temporal Key)?

  1. To encrypt unicast data frames
  2. To provide integrity protection for broadcast management frames in 802.11w/PMF using the BIP protocol Correct answer.
  3. To generate the PTK during the 4-way handshake
  4. To authenticate RADIUS messages

Explanation

The IGTK (Integrity Group Temporal Key) is used specifically by the BIP (Broadcast/Multicast Integrity Protocol) to protect broadcast robust management frames in 802.11w/PMF. While unicast management frames are protected using the existing pairwise keys, broadcast management frames cannot use pairwise keys (since all clients need to process them). The IGTK provides integrity protection (not encryption) for these frames, preventing spoofed broadcast deauthentication attacks.

Question 15WLAN authentication, keying and protected access

What are the security implications of WPA3 Transition mode and how can they be exploited?

  1. Transition mode has no security implications
  2. An attacker can perform a downgrade attack by spoofing a WPA2-only AP with the same SSID, forcing WPA3-capable clients to fall back to WPA2-PSK where offline dictionary attacks are possible Correct answer.
  3. Transition mode is more secure than pure WPA3
  4. Transition mode only affects IoT devices

Explanation

WPA3 Transition mode allows both WPA2-PSK and WPA3-SAE clients on the same network. An attacker can exploit this by creating a rogue AP that advertises the same SSID with only WPA2-PSK support. WPA3-capable clients may downgrade to WPA2-PSK to connect, exposing them to offline dictionary attacks against the captured 4-way handshake. This is called a downgrade attack. Mitigation requires client-side configuration to refuse WPA2 connections when WPA3 is expected, and organizations should minimize the transition period.

Question 16WLAN authentication, keying and protected access

What is the Dragonblood vulnerability family and how does it affect WPA3?

  1. A physical hardware vulnerability in Wi-Fi chipsets
  2. A set of vulnerabilities in the WPA3-SAE Dragonfly handshake including side-channel attacks, downgrade attacks, and denial-of-service vectors Correct answer.
  3. A vulnerability in RADIUS server software
  4. A flaw in 802.11ax modulation

Explanation

Dragonblood (disclosed 2019) is a family of vulnerabilities in the WPA3-SAE Dragonfly handshake. It includes timing-based side-channel attacks that leak information about the password during the commit exchange, cache-based side-channel attacks against specific implementations, downgrade attacks forcing WPA2 fallback in transition mode, and DoS attacks via resource exhaustion from excessive commit frames. The Wi-Fi Alliance issued implementation guidelines and protocol updates to mitigate these vulnerabilities, but they highlighted the complexity of secure protocol implementation.

Question 17WLAN authentication, keying and protected access

What is the security risk of MAC address filtering as a wireless access control mechanism?

  1. MAC filtering provides strong security
  2. MAC addresses can be easily spoofed by an attacker who sniffs authorized MAC addresses from wireless frames, which are always transmitted in cleartext even on encrypted networks Correct answer.
  3. MAC filtering is only ineffective on 5 GHz networks
  4. MAC filtering is secure when combined with WEP

Explanation

MAC address filtering provides negligible security because 802.11 frame headers (including source and destination MAC addresses) are always transmitted in cleartext, even on encrypted networks. An attacker using a wireless adapter in monitor mode can observe authorized MAC addresses and then spoof (clone) a valid MAC address to bypass the filter. MAC filtering adds administrative overhead without meaningful security benefit and should never be relied upon as a security control.

Question 18WLAN authentication, keying and protected access

What is 802.11i and how does it relate to WPA2?

  1. 802.11i is a physical layer standard unrelated to security
  2. 802.11i is the IEEE amendment that defines the Robust Security Network (RSN) architecture, and WPA2 is the Wi-Fi Alliance's certification program based on the full 802.11i specification Correct answer.
  3. WPA2 was developed before 802.11i
  4. 802.11i only applies to enterprise networks

Explanation

802.11i is the IEEE amendment (ratified 2004) that defines the Robust Security Network (RSN) architecture for wireless security. It specifies CCMP-AES encryption, 802.1X/EAP authentication, the 4-way handshake, and key management hierarchy. WPA2 is the Wi-Fi Alliance's certification program that tests device compliance with the full 802.11i specification. WPA (the predecessor) implemented a subset of draft 802.11i using TKIP, while WPA2 requires the complete specification including AES-CCMP.

Question 19WLAN authentication, keying and protected access

What is the OWE (Opportunistic Wireless Encryption) protocol and what problem does it solve?

  1. OWE is the same as WPA3-Personal
  2. OWE provides unauthenticated encryption for open networks, establishing encrypted connections without requiring a passphrase, protecting users from passive eavesdropping on public Wi-Fi Correct answer.
  3. OWE replaces WPA3-Enterprise
  4. OWE provides authentication without encryption

Explanation

OWE (defined in RFC 8110 and also called Wi-Fi Enhanced Open) provides encryption on networks that would otherwise be open and unencrypted (like public hotspots). Using a Diffie-Hellman key exchange, OWE establishes unique per-client encryption keys without requiring a passphrase or authentication. While it does not authenticate users (anyone can still connect), it protects against passive eavesdropping - a significant improvement over completely open networks where all traffic is visible to any nearby observer.

Question 20WLAN authentication, keying and protected access

What is a man-in-the-middle (MitM) attack in the context of wireless security?

  1. A physical attack on networking equipment
  2. An attacker positions themselves between the client and AP (or authentication server), intercepting and potentially modifying communications in both directions without either party's knowledge Correct answer.
  3. An attack that targets only the network administrator
  4. A denial-of-service attack that floods the network

Explanation

A wireless MitM attack involves an attacker positioning their device between the client and the legitimate AP or authentication server. Common wireless MitM techniques include evil twin APs (same SSID as legitimate network), ARP poisoning after association, and rogue RADIUS servers. The attacker can intercept, read, and modify all traffic including authentication credentials. Mutual authentication (EAP-TLS with proper certificate validation) and certificate pinning are the primary defenses against wireless MitM attacks.

Question 21WLAN authentication, keying and protected access

What is the purpose of WLAN segmentation using role-based access control (RBAC)?

  1. To assign different frequencies to different users
  2. To dynamically assign network access permissions and policies based on the authenticated user's role, restricting each user to only the resources they need Correct answer.
  3. To separate wired and wireless traffic
  4. To limit the number of APs each user can connect to

Explanation

RBAC in wireless networks applies the principle of least privilege by assigning network permissions based on user roles (employee, contractor, guest, executive, etc.). After 802.1X authentication, the RADIUS server returns role-based attributes that determine VLAN assignment, downloadable ACLs, bandwidth limits, QoS policies, and application access. This creates micro-segmentation where even users on the same SSID have different network access based on their identity and role.

Question 22WLAN authentication, keying and protected access

What is the security implication of using hidden SSIDs?

  1. Hidden SSIDs provide strong security by preventing unauthorized users from discovering the network
  2. Hidden SSIDs provide no meaningful security because the SSID is still transmitted in probe requests, probe responses, and association frames, and hiding it actually increases client exposure by forcing devices to actively probe for the network Correct answer.
  3. Hidden SSIDs are more secure than WPA3
  4. Hiding the SSID encrypts all network traffic

Explanation

Hiding the SSID from beacon frames provides no real security benefit. The SSID is still transmitted in cleartext in probe request frames (from clients searching for the network), probe response frames, and association request/response frames. An attacker with a protocol analyzer can easily discover hidden SSIDs. Worse, clients configured for hidden SSIDs continuously broadcast probe requests with the SSID wherever they go, enabling tracking and revealing the hidden network name to any observer.

Question 23WLAN authentication, keying and protected access

What is the concept of 'defense in depth' applied to wireless network security?

  1. Using only the strongest single security control
  2. Implementing multiple, overlapping layers of security controls so that if one layer is compromised, additional layers continue to protect the network Correct answer.
  3. Installing security equipment deep within the network
  4. Using the deepest encryption algorithm available

Explanation

Defense in depth for wireless security means implementing multiple, overlapping security layers: strong authentication (802.1X/EAP-TLS), robust encryption (WPA3 with GCMP), network segmentation (VLANs), WIDS/WIPS monitoring, NAC for device posture assessment, firewall and IPS between wireless and wired networks, endpoint security on client devices, security awareness training for users, physical security for AP locations, and incident response procedures. If any single layer fails, the remaining layers provide continued protection.

Question 24WLAN authentication, keying and protected access

What is the security risk of using WEP encryption in modern wireless networks?

  1. WEP is still considered secure for home networks
  2. WEP is fundamentally broken - its RC4 encryption with static initialization vectors can be cracked in minutes using freely available tools, providing no meaningful protection for wireless traffic Correct answer.
  3. WEP is only insecure on 5 GHz networks
  4. WEP is insecure but acceptable for guest networks

Explanation

WEP (Wired Equivalent Privacy) is completely broken and provides no meaningful security. Vulnerabilities include: the 24-bit Initialization Vector (IV) space is too small, causing IV reuse and enabling statistical attacks; the RC4 key scheduling algorithm has known weaknesses; the CRC-32 integrity check can be manipulated; and the shared key is static. Tools like aircrack-ng can recover a WEP key from captured traffic in minutes. WEP should never be used - it was superseded by WPA2/WPA3 over 20 years ago.

Question 25WLAN authentication, keying and protected access

What is the purpose of a WLAN controller's access control list (ACL) in wireless security?

  1. To list all authorized APs
  2. To define traffic filtering rules that restrict which network resources authenticated wireless clients can access based on IP addresses, ports, protocols, and application types Correct answer.
  3. To control which clients can associate to the WLAN
  4. To manage administrator access to the controller

Explanation

WLAN controller ACLs provide Layer 3-4 traffic filtering for wireless clients after authentication. ACLs can restrict access based on source/destination IP, TCP/UDP ports, protocols, and direction. They are commonly used to: restrict guest users to internet-only access, limit contractors to specific application servers, enforce microsegmentation for IoT devices, and block peer-to-peer traffic. ACLs can be statically assigned per SSID, dynamically pushed via RADIUS attributes, or applied based on user role through downloadable ACLs.

Question 26WLAN authentication, keying and protected access

What are the key differences between WPA2-Personal (PSK) and WPA2-Enterprise (802.1X) security models?

  1. They provide the same security level with different names
  2. WPA2-Personal uses a shared passphrase for all users with no individual accountability; WPA2-Enterprise provides per-user authentication via 802.1X/RADIUS with unique credentials, dynamic key generation, and centralized access management Correct answer.
  3. WPA2-Enterprise is only for large organizations
  4. WPA2-Personal is more secure because the key is simpler

Explanation

WPA2-Personal (PSK) uses a single shared passphrase for all users - anyone with the passphrase can connect and there is no per-user identification or accountability. If the passphrase is compromised, it must be changed on all devices. WPA2-Enterprise uses 802.1X/RADIUS for per-user authentication with unique credentials, generating unique PMKs and encryption keys per session. It provides centralized credential management, user accountability through logging, dynamic VLAN assignment, and the ability to revoke individual access without affecting other users.

Question 27WLAN authentication, keying and protected access

What is the 'hole196' vulnerability in WPA2?

  1. A physical hole in the AP chassis
  2. An insider threat where an authenticated WPA2 user can exploit the shared GTK to inject broadcast frames and potentially perform ARP poisoning attacks against other clients in the same BSS Correct answer.
  3. A vulnerability in the 802.11 PHY layer
  4. A buffer overflow in AP firmware

Explanation

The hole196 vulnerability (named after page 196 of the 802.11 standard) is an insider threat in WPA2 where a legitimately authenticated user exploits the shared Group Temporal Key (GTK). Since all clients in a BSS share the same GTK, any authenticated user can craft and inject broadcast/multicast frames. An attacker can use this to perform ARP poisoning, redirecting other clients' traffic through their device for man-in-the-middle attacks. Mitigation includes client isolation, IDS monitoring, and using individual VLAN assignment.

Question 28WLAN authentication, keying and protected access

What security considerations apply to wireless mesh network deployments?

  1. Mesh networks require no special security considerations
  2. Mesh backhaul links between APs must be encrypted (WPA3/SAE or 802.1X), mesh topology must be validated to prevent rogue mesh nodes, management traffic must be authenticated, and the expanded attack surface of outdoor mesh nodes requires physical security measures Correct answer.
  3. Mesh networks are inherently secure
  4. Only the root AP needs security configuration

Explanation

Wireless mesh networks introduce unique security challenges: backhaul links between mesh APs must use strong encryption (WPA3-SAE or 802.1X for mesh peering) to prevent traffic interception; mesh authentication prevents rogue APs from joining the mesh topology; management traffic between mesh nodes must be authenticated and integrity-protected; outdoor mesh nodes are physically exposed and may be tampered with; the multiple hop paths create additional attack surface; and mesh routing protocols must be secured against injection attacks. IEEE 802.11s defines security mechanisms for mesh networking.

Question 29WLAN authentication, keying and protected access

What is the security purpose of client isolation in a wireless network?

  1. To improve wireless performance
  2. To prevent wireless clients from communicating directly with each other at Layer 2, blocking peer-to-peer attacks such as ARP spoofing, port scanning, and exploitation between devices on the same SSID Correct answer.
  3. To isolate clients from the internet
  4. To separate 2.4 GHz and 5 GHz clients

Explanation

Client isolation (also called peer-to-peer blocking or station separation) prevents direct Layer 2 communication between wireless clients associated to the same AP or SSID. Without client isolation, clients can directly attack each other through ARP spoofing, port scanning, vulnerability exploitation, and data theft. Client isolation is essential for guest networks and public hotspots where untrusted devices share the same wireless network. It forces all client-to-client traffic through the gateway where firewall rules can be applied.

Question 30WLAN authentication, keying and protected access

What is the security significance of proper AP placement and physical security?

  1. AP location only affects coverage, not security
  2. Improperly secured APs can be physically accessed for console/USB attacks, factory reset to bypass security, cable disconnected and replaced with rogue devices, or stolen; physical security also controls RF leakage to minimize external attack surface Correct answer.
  3. Physical security only matters for outdoor APs
  4. APs are too small to be a physical security concern

Explanation

Physical AP security is a critical but often overlooked aspect of wireless security. Unsecured APs can be: physically accessed to connect to console ports or USB ports for configuration extraction, factory reset to remove security settings, disconnected and replaced with rogue APs (evil twin on the same switch port), stolen for credential extraction from stored configuration, or have their Ethernet cable tapped for network access. Best practices include ceiling mounting in locked enclosures, using cable locks, disabling unused ports, and placing APs in areas with physical access controls.

Question 31WLAN authentication, keying and protected access

How does Wi-Fi Protected Access (WPA) differ from WPA2 in its encryption implementation?

  1. WPA and WPA2 use identical encryption
  2. WPA uses TKIP (Temporal Key Integrity Protocol) with RC4 encryption as a transitional upgrade from WEP; WPA2 mandates CCMP with AES encryption, providing significantly stronger security Correct answer.
  3. WPA2 uses TKIP; WPA uses AES
  4. WPA is more secure than WPA2

Explanation

WPA was a transitional standard implementing part of the draft 802.11i specification. It used TKIP (Temporal Key Integrity Protocol), which improved upon WEP by adding per-packet key mixing, a message integrity check (Michael MIC), and a rekeying mechanism - but still used the vulnerable RC4 cipher. WPA2 implemented the full 802.11i specification, mandating CCMP (Counter Mode with CBC-MAC Protocol) with AES-128 encryption, providing a fundamentally stronger cryptographic foundation. TKIP is now deprecated and should not be used.

Question 32WLAN authentication, keying and protected access

What are the security risks of using pre-shared keys (PSK) in enterprise wireless environments?

  1. PSK is perfectly secure for enterprise use
  2. PSK lacks individual user accountability, the shared key is difficult to change when employees leave, is vulnerable to offline dictionary attacks if the handshake is captured, and provides no per-user key derivation - making 802.1X/EAP significantly more appropriate for enterprise environments Correct answer.
  3. PSK risks only apply to WEP
  4. PSK is more secure than 802.1X for enterprise

Explanation

PSK in enterprise environments creates several security risks: no individual accountability (all users share the same credential), no way to revoke individual access without changing the key for everyone, susceptible to offline dictionary attacks if the 4-way handshake is captured, former employees retain access until the key is changed, the key may be shared informally among unauthorized users, no per-user encryption keys (all users share the same PMK), and no integration with directory services for centralized management. Enterprise environments should use 802.1X/EAP for per-user authentication and key management.

Question 33WLAN authentication, keying and protected access

What is the impact of quantum computing on current wireless security protocols?

  1. Quantum computing has no impact on wireless security
  2. Quantum computers could break RSA and ECC-based algorithms used in EAP-TLS certificates and key exchanges; NIST post-quantum cryptography standards (Kyber/Dilithium) will need to be integrated into future wireless security protocols Correct answer.
  3. Quantum computing only affects wired networks
  4. Current wireless protocols are already quantum-resistant

Explanation

Quantum computing threatens the asymmetric cryptography underpinning wireless security: RSA and ECC used in EAP-TLS certificates, Diffie-Hellman key exchanges in SAE/OWE, and digital signatures. Shor's algorithm on a sufficiently powerful quantum computer could factor these in polynomial time. NIST has standardized post-quantum cryptographic algorithms (ML-KEM/Kyber for key encapsulation, ML-DSA/Dilithium for signatures) that will need to be integrated into EAP methods, certificate chains, and key exchange protocols. The transition timeline is estimated at 10-20 years, but organizations should begin planning now.

Question 34WLAN authentication, keying and protected access

What is the principle of least privilege as applied to wireless network access?

  1. Giving all users maximum access to simplify management
  2. Granting each wireless user or device only the minimum network access required to perform their function, implemented through VLANs, ACLs, RBAC, and dynamic RADIUS authorization Correct answer.
  3. Using the minimum number of APs possible
  4. Limiting the wireless transmit power to the minimum

Explanation

Least privilege in wireless security means each user and device receives only the network access necessary for their role. Implementation methods include: VLAN segmentation based on user role (via RADIUS), downloadable ACLs restricting access to specific servers/services, role-based access control (RBAC) with granular permission sets, time-based access restrictions, device-type based policies (IoT devices restricted to their control servers), and micro-segmentation for high-security environments. This limits the blast radius if any credential is compromised.

Question 35WLAN authentication, keying and protected access

What is Enhanced Open (OWE) transition mode and how does it work?

  1. It replaces WPA3 for open networks
  2. OWE transition mode allows an AP to simultaneously advertise an open BSS (for legacy clients) and an OWE BSS (for capable clients) with the same SSID, enabling gradual migration to encrypted open networks Correct answer.
  3. Transition mode provides authentication for open networks
  4. OWE transition mode works the same as WPA3 transition mode

Explanation

OWE transition mode uses two BSSs sharing the same SSID: one open BSS for legacy clients that do not support OWE, and one OWE BSS for capable clients. The AP advertises both, and OWE-capable clients automatically connect to the encrypted BSS while legacy clients use the open BSS. This enables gradual migration without requiring all clients to support OWE simultaneously. Over time, as client support increases, the open BSS can be deprecated. Like WPA3 transition mode, this is a temporary measure with the legacy BSS remaining vulnerable.

Question 36WLAN authentication, keying and protected access

What does 802.1X provide in a wireless security architecture?

  1. Data encryption for wireless frames
  2. Port-based network access control using EAP for authentication Correct answer.
  3. Wireless channel management
  4. Quality of Service prioritization

Explanation

802.1X is a port-based network access control standard that provides an authentication framework for wireless (and wired) networks. It uses EAP (Extensible Authentication Protocol) to carry authentication credentials between the supplicant (client), authenticator (AP), and authentication server (RADIUS). 802.1X ensures that only authenticated users gain network access, and it generates per-user encryption keys.

Question 37WLAN authentication, keying and protected access

What are the three roles in the 802.1X authentication framework?

  1. Client, server, and router
  2. Supplicant, authenticator, and authentication server Correct answer.
  3. User, administrator, and auditor
  4. Sender, receiver, and relay

Explanation

802.1X is a port-based access-control framework with supplicant, authenticator and authentication-service roles. Actual identity, server trust and keying depend on the selected EAP and WLAN security method. The framework alone does not universally authenticate a person, generate every encryption key or authorize every destination.

Question 38WLAN authentication, keying and protected access

What is the primary function of RADIUS in wireless security?

  1. To encrypt wireless data frames
  2. To provide centralized authentication, authorization, and accounting (AAA) services Correct answer.
  3. To manage wireless channel assignments
  4. To detect rogue access points

Explanation

RADIUS (Remote Authentication Dial-In User Service) provides centralized AAA services for wireless networks: Authentication (verifying user credentials), Authorization (determining access permissions and VLAN assignments), and Accounting (logging access events). RADIUS enables per-user authentication with unique credentials, dynamic policy enforcement, and detailed audit trails essential for enterprise security and compliance.

Question 39WLAN authentication, keying and protected access

Which EAP method provides mutual authentication using digital certificates on both client and server?

  1. EAP-MD5
  2. PEAP
  3. EAP-TLS Correct answer.
  4. LEAP

Explanation

EAP-TLS (Transport Layer Security) provides the strongest mutual authentication by requiring digital certificates on both the client (supplicant) and the authentication server. Both sides verify each other's identity through certificate validation, eliminating vulnerabilities associated with password-based methods. The downside is the operational overhead of deploying and managing certificates on every client device through a PKI infrastructure.

Question 40WLAN authentication, keying and protected access

What is the difference between PEAP and EAP-TTLS in terms of inner authentication methods?

  1. They support identical inner methods
  2. PEAP typically uses MSCHAPv2 as the inner method; EAP-TTLS supports a wider range of inner methods including PAP, CHAP, MSCHAPv2, and EAP methods Correct answer.
  3. PEAP supports more methods than EAP-TTLS
  4. Neither supports inner authentication

Explanation

Both PEAP and EAP-TTLS create a TLS tunnel using a server certificate, then authenticate the user through an inner method within the tunnel. PEAP is most commonly paired with MSCHAPv2 as the inner method. EAP-TTLS is more flexible, supporting legacy authentication protocols (PAP, CHAP, MS-CHAP, MSCHAPv2) and other EAP methods within the tunnel. This flexibility makes EAP-TTLS useful in heterogeneous environments with diverse authentication requirements.

Question 41WLAN authentication, keying and protected access

How does SAE (Simultaneous Authentication of Equals) in WPA3 protect against offline dictionary attacks?

  1. By using longer passphrases
  2. By using a zero-knowledge proof (Dragonfly key exchange) where the passphrase is never transmitted and each exchange uses unique ephemeral keys Correct answer.
  3. By requiring certificate-based authentication
  4. By limiting the number of connection attempts

Explanation

SAE uses the Dragonfly key exchange, a password-authenticated key exchange (PAKE) protocol based on zero-knowledge proofs. Neither side ever transmits the passphrase or its hash. Each authentication generates unique ephemeral keys through elliptic curve Diffie-Hellman exchanges. An attacker capturing the SAE exchange cannot perform offline brute-force attempts because each authentication is cryptographically independent. They would need to attempt each password guess through a live interaction with the AP.

Question 42WLAN authentication, keying and protected access

What is the purpose of dynamic VLAN assignment in 802.1X authenticated wireless networks?

  1. To assign VLANs based on AP location
  2. To automatically place authenticated users into specific VLANs based on RADIUS attributes returned during authentication, enabling per-user network segmentation Correct answer.
  3. To rotate VLANs for load balancing
  4. To encrypt VLAN tags in wireless frames

Explanation

Dynamic VLAN assignment uses RADIUS attributes (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID) returned during 802.1X authentication to place each user into a specific VLAN based on their identity, role, or group membership. This enables per-user network segmentation without requiring separate SSIDs: a single SSID can route employees to the corporate VLAN, contractors to a restricted VLAN, and guests to an isolated VLAN.

Question 43WLAN authentication, keying and protected access

What is the purpose of a RADIUS accounting proxy?

  1. To provide load balancing for authentication
  2. To forward accounting records to centralized accounting servers for compliance logging and billing while potentially aggregating records from multiple RADIUS servers Correct answer.
  3. To encrypt RADIUS traffic
  4. To manage AP configurations

Explanation

A RADIUS accounting proxy receives RADIUS Accounting-Request messages from authenticators (APs) and forwards them to one or more centralized accounting servers. This enables centralized audit logging for compliance requirements, usage tracking for billing, and security event correlation. The proxy can also provide redundancy, load distribution, and format translation between different RADIUS implementations in multi-vendor environments.

Question 44WLAN authentication, keying and protected access

What is certificate pinning in the context of wireless security?

  1. Physically attaching a certificate to a device
  2. Configuring the client to trust only a specific server certificate or CA certificate, preventing acceptance of fraudulent certificates in man-in-the-middle attacks Correct answer.
  3. Encrypting certificates with a PIN code
  4. Storing certificates on a smart card

Explanation

Certificate pinning configures the 802.1X supplicant to trust only a specific RADIUS server certificate or a specific CA certificate, rather than accepting any valid certificate. Without pinning, an attacker could use a valid certificate from any trusted CA to impersonate the RADIUS server in an evil twin attack. Proper certificate validation and pinning is critical for PEAP and EAP-TTLS deployments where only the server presents a certificate during the TLS tunnel establishment.

Question 45WLAN authentication, keying and protected access

What is the purpose of EAP chaining in wireless authentication?

  1. To chain multiple APs together
  2. To authenticate both the user and the device in a single EAP session, ensuring both machine and user credentials are validated Correct answer.
  3. To link multiple RADIUS servers
  4. To extend wireless coverage

Explanation

EAP chaining (supported by EAP-TEAP/EAP-FASTv2) authenticates both the machine and the user within a single EAP transaction. The device first presents its machine certificate, then the user provides credentials, and both must be valid for access to be granted. This ensures that only authorized users on authorized devices can access the network, preventing scenarios where a valid user connects from an unmanaged personal device. RADIUS attributes can enforce policies based on the combined machine+user identity.

Question 46WLAN authentication, keying and protected access

How does 802.1X authentication differ when using EAP-TLS versus PEAP-MSCHAPv2?

  1. They provide identical security levels
  2. EAP-TLS requires certificates on both client and server for mutual authentication; PEAP-MSCHAPv2 uses a server certificate for the TLS tunnel but relies on username/password for client authentication inside the tunnel Correct answer.
  3. EAP-TLS is faster than PEAP
  4. PEAP is more secure than EAP-TLS

Explanation

EAP-TLS provides the strongest authentication by requiring X.509 certificates on both the client and server. Each side cryptographically proves its identity, eliminating password-related vulnerabilities. PEAP-MSCHAPv2 creates a TLS tunnel using only a server certificate, then authenticates the client inside the tunnel using a username and password via MSCHAPv2. While PEAP is easier to deploy (no client certificates needed), it is vulnerable to password-based attacks if the client does not properly validate the server certificate.

Question 47WLAN authentication, keying and protected access

What is the role of a PKI (Public Key Infrastructure) in wireless security?

  1. To manage wireless channel assignments
  2. To issue, manage, and revoke digital certificates used for EAP-TLS authentication, server identity verification, and encrypted communications Correct answer.
  3. To assign IP addresses via DHCP
  4. To monitor RF spectrum

Explanation

PKI provides the infrastructure for managing digital certificates in wireless security: issuing certificates to RADIUS servers and clients for EAP-TLS, managing certificate lifecycles (renewal, revocation via CRL/OCSP), establishing trust hierarchies with root and intermediate CAs, and enabling certificate-based authentication that eliminates password vulnerabilities. A well-designed PKI is essential for the most secure wireless deployments but requires significant planning and operational resources.

Question 48WLAN authentication, keying and protected access

What is the purpose of a Change of Authorization (CoA) in RADIUS?

  1. To change the RADIUS shared secret
  2. To dynamically modify a user's authorization attributes (such as VLAN or ACL) after initial authentication, without requiring re-authentication Correct answer.
  3. To change the AP's channel assignment
  4. To update the user's password

Explanation

RADIUS Change of Authorization (CoA), defined in RFC 5176, allows the RADIUS server to dynamically push authorization changes to the authenticator (AP/switch) for already-authenticated sessions. This enables real-time policy enforcement: if a security event is detected, the RADIUS server can quarantine a user by changing their VLAN, applying restrictive ACLs, or disconnecting them entirely - all without requiring the user to re-authenticate. CoA is essential for dynamic security response.

Question 49WLAN authentication, keying and protected access

How does EAP-TEAP (Tunnel Extensible Authentication Protocol) improve upon PEAP and EAP-FAST?

  1. It uses weaker encryption for compatibility
  2. EAP-TEAP standardizes the tunnel-based approach with support for certificate-based machine auth and password-based user auth in a single session (EAP chaining), certificate provisioning within the tunnel, and improved cryptographic negotiation Correct answer.
  3. EAP-TEAP only works with RADIUS
  4. EAP-TEAP eliminates the need for TLS

Explanation

EAP-TEAP (RFC 7170) is the IETF standardization of tunnel-based EAP, improving upon PEAP and the Cisco-proprietary EAP-FAST. Key improvements include standardized EAP chaining (machine + user auth in one session), in-band certificate provisioning for zero-touch enrollment, support for multiple inner authentication methods, channel binding to prevent MitM attacks, and updated cryptographic negotiation. EAP-TEAP is positioned as the long-term replacement for PEAP in enterprise deployments.

Question 50WLAN authentication, keying and protected access

How does a RADIUS server determine which VLAN to assign to a wireless user during 802.1X authentication?

  1. The AP determines the VLAN based on signal strength
  2. The RADIUS server returns Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID attributes in the Access-Accept message, based on the user's group membership or identity in the directory Correct answer.
  3. VLANs are randomly assigned for security
  4. The client requests a specific VLAN during authentication

Explanation

During 802.1X authentication, the RADIUS server evaluates the user's credentials against the directory (Active Directory, LDAP) and applies authorization policies based on group membership, device type, time of day, or other attributes. The Access-Accept message includes three RADIUS attributes for VLAN assignment: Tunnel-Type (13=VLAN), Tunnel-Medium-Type (6=802), and Tunnel-Private-Group-ID (the VLAN ID or name). The authenticator (AP) then places the client's traffic on the specified VLAN.