WLAN Monitoring, Intrusion Detection and Incident Response
This domain tests how you detect wireless attacks and what you do once you have detected one. Expect questions that describe a symptom observed by a monitoring system and ask for the classification, the next investigative step, or the correct containment order.
Monitoring architectures
An overlay deployment uses dedicated sensors scanning all channels continuously; it gives the best detection fidelity at the cost of hardware. An integrated deployment has APs scan off-channel between serving clients; it is cheaper but coverage is designed for client service, not for eavesdropping, and scanning steals airtime. Spectrum analysis complements both by finding non-802.11 interference and jamming that a Wi-Fi radio cannot characterize.
What gets detected and how it is classified
- Rogue AP classification: authorized devices in inventory; neighbors that are external and low risk; rogues that are unknown and reachable on the wired network, which are the highest priority.
- Evil twin: the same SSID with a different BSSID, often a different security configuration and a stronger signal, frequently paired with a certificate that fails validation.
- Denial of service: deauthentication and disassociation floods, beacon floods, authentication floods, EAPOL-Start floods, and WPS PIN brute force.
- Client-side attacks: misassociation with external APs, ad-hoc or IBSS networks, MAC spoofing, and Karma-style APs that answer every probe request with any SSID.
- Policy violations: open authentication, WEP or TKIP, and unprotected management frames.
Incident response lifecycle
NIST SP 800-61 defines preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Wireless incidents add a physical step: locate the device by triangulating signal strength across sensors or walking the floor with a directional antenna, then contain at the switch port so the device loses its wired path. Preserve packet captures with timestamps and a hash before remediation, because containment destroys evidence.
Worked example
Sensors flag an AP broadcasting the corporate SSID on channel 11, while the site channel plan uses 1, 6, 36, and 52. The BSSID is not in inventory and the signal peaks near a conference room. Sequence: capture the beacon and security information element to compare security configuration, walk the floor with a directional antenna, identify the Ethernet wall port, disable that port, preserve the device configuration and logs, then treat the event as a possible insider incident rather than a simple misconfiguration.
Traps that cost marks
- Deauthenticating a suspected rogue AP before checking whether wireless containment is legally permissible on your premises.
- Labeling a neighbor AP as a rogue without determining whether it is reachable on your wired network.
- Containing first and capturing later, destroying the evidence needed for the post-incident review.