I85PREP
⌘ K
OffSec Wireless Professional study materials
OffSec Wireless Professional study resources

OffSec Wireless Professional practice questions

One question at a time. Build your OffSec Wireless Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which 802.11 amendment introduced operation in the 6 GHz band for Wi-Fi, and under what marketing name is it sold?

  1. 802.11ax, marketed as Wi-Fi 6E Correct answer.
  2. 802.11ad, marketed as WiGig
  3. 802.11n, marketed as Wi-Fi 4
  4. 802.11ac, marketed as Wi-Fi 5

Explanation

The 6 GHz extension is delivered through 802.11ax operating in the newly opened 5925-7125 MHz range, and the industry labels that capability Wi-Fi 6E. Earlier amendments such as 802.11ac are limited to 5 GHz, and 802.11ad uses 60 GHz. This distinction matters when scoping a wireless assessment, because 6 GHz-only client behavior and reduced interference change the attack surface.

Question 2Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

In an 802.11 infrastructure BSS, which device is responsible for transmitting beacon frames and enforcing the basic service set identifier?

  1. The distribution system
  2. The station
  3. The access point Correct answer.
  4. The portal

Explanation

The access point is the central coordinator of an infrastructure BSS: it emits beacons, manages association, and defines the BSSID used by clients. The distribution system is the backbone that links APs, and the portal bridges to non-802.11 networks. Stations are the clients, so they consume beacons rather than originate them on the serving channel.

Question 3Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which frame type carries the SSID and supported rate information that a client uses to discover available networks without first associating?

  1. Beacon frame Correct answer.
  2. Block acknowledgement frame
  3. Association request frame
  4. PS-Poll frame

Explanation

Beacon frames are broadcast periodically by the AP and carry the SSID, supported rates, security parameters, and capability information needed for passive discovery. Association requests are sent by the client after discovery, and PS-Poll and Block Ack relate to power saving and data acknowledgement. Passive scanning therefore depends entirely on beacon content.

Question 4Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

What is the primary purpose of the 802.11 association process?

  1. To encrypt the wireless link with a session key
  2. To authenticate the client against a RADIUS server
  3. To bind a client to a specific AP and establish the parameters for data exchange Correct answer.
  4. To assign an IP address to the client

Explanation

Association creates the logical link between a station and an AP, after which the two sides exchange data using agreed capabilities. Encryption keys are handled by the security handshake (for example 802.1X or the 4-way handshake), and IP addressing comes from DHCP. Authentication of credentials happens before or during association, but association itself is the binding step.

Question 5Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which 802.11 channelization fact is correct for the 2.4 GHz band?

  1. Channels 1, 6, and 11 are commonly used as non-overlapping 20 MHz channels in North America Correct answer.
  2. Channels are spaced 20 MHz apart and never overlap
  3. The band provides 11 non-overlapping 80 MHz channels
  4. All 14 channels are non-overlapping 40 MHz channels

Explanation

In the 2.4 GHz band, channels are spaced 5 MHz apart while a 20 MHz channel occupies roughly five channel numbers, so 1, 6, and 11 are the classic non-overlapping set in North America. Wider 40 MHz channels are impractical there, and 80 MHz channels exist only in 5 GHz and 6 GHz. This spacing is why 2.4 GHz is congested and why co-channel interference analysis matters during surveys.

Question 6Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which 802.11 topology describes two or more stations communicating directly without an access point?

  1. Extended service set
  2. Independent BSS (IBSS) Correct answer.
  3. Infrastructure BSS
  4. Mesh BSS

Explanation

An IBSS, commonly called ad hoc mode, has no AP; stations communicate peer-to-peer and one station assumes beaconing duties. An infrastructure BSS requires an AP, and an ESS joins multiple BSSs through a distribution system. Mesh BSS uses forwarding mesh stations, which is a different structure from simple ad hoc peering.

Question 7Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which organization is responsible for ratifying the 802.11 family of wireless LAN standards?

  1. IETF
  2. IEEE Correct answer.
  3. Wi-Fi Alliance
  4. ITU-R

Explanation

The IEEE develops and ratifies the 802.11 standards through its 802.11 working group. The Wi-Fi Alliance performs interoperability certification rather than standards ratification, and the IETF handles Internet protocols. The ITU-R manages spectrum allocation internationally but does not write 802.11 MAC and PHY specifications.

Question 8Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which security architecture is defined by WPA3-Personal?

  1. 802.1X with EAP-TLS
  2. Simultaneous Authentication of Equals (SAE) Correct answer.
  3. WEP with 128-bit keys
  4. Pre-shared key with TKIP

Explanation

WPA3-Personal replaces the PSK handshake with SAE, a password-authenticated key exchange that resists offline dictionary attacks and provides forward secrecy. TKIP belongs to WPA and WEP is obsolete, while 802.1X with EAP-TLS describes WPA3-Enterprise. Recognizing this distinction is essential when assessing whether captured handshakes can be cracked offline.

Question 9Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

A station moves from the coverage area of one AP to another within the same ESS. Which mechanism enables it to reattach to the new AP while retaining its IP address?

  1. Roaming via reassociation within the same distribution system Correct answer.
  2. A new DHCP lease negotiation on every AP transition
  3. A full 802.1X reauthentication on every transition
  4. Switching from infrastructure mode to ad hoc mode

Explanation

Within an ESS, the distribution system lets a station reassociate to a new AP while keeping its layer-3 identity, so upper-layer sessions survive the move. DHCP renegotiation and full reauthentication are not required by the transition itself, though fast-roaming mechanisms may be used to speed the security exchange. Ad hoc mode is a different topology and would break the ESS model.

Question 10Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which PHY feature introduced by 802.11n increases throughput by transmitting multiple spatial streams over multiple antennas?

  1. Frequency-hopping spread spectrum
  2. Direct sequence spread spectrum
  3. MIMO with spatial multiplexing Correct answer.
  4. Orthogonal frequency-division multiplexing only

Explanation

802.11n introduced MIMO, and spatial multiplexing sends independent data streams on parallel spatial paths to multiply throughput. OFDM was already used by 802.11a/g, and DSSS and FHSS belong to older 802.11-1997 PHYs. When evaluating throughput claims in a report, the number of supported spatial streams is a key differentiator.

Question 11Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

What does the 802.11 RTS/CTS exchange primarily mitigate?

  1. The exposed terminal problem only
  2. The hidden node problem Correct answer.
  3. Frame corruption caused by weak encryption
  4. Channel overlap between 2.4 GHz and 5 GHz bands

Explanation

RTS/CTS reserves the medium by having the AP broadcast a CTS that all stations in range can hear, which addresses the hidden node case where two clients cannot detect each other. It does not solve band overlap or encryption issues, and it can worsen the exposed node problem by reserving airtime unnecessarily. Analysts often look at RTS/CTS thresholds when diagnosing throughput anomalies.

Question 12Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which 802.11ac feature allows an AP to transmit to multiple client devices simultaneously on the downlink?

  1. Multi-user MIMO Correct answer.
  2. Channel bonding to 160 MHz
  3. Short guard interval
  4. Single-user beamforming

Explanation

802.11ac introduced downlink multi-user MIMO, letting an AP form simultaneous streams to several clients in the same channel. Beamforming and 160 MHz bonding improve per-link performance but do not create simultaneous multi-client transmissions, and the short guard interval only reduces symbol overhead. This matters when estimating realistic per-client throughput in dense deployments.

Question 13Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

During a survey you observe a client sending a probe request with a wildcard SSID. What does this indicate?

  1. The client is requesting a DHCP lease
  2. The client is attempting to associate with a hidden network only
  3. The client is actively scanning for any available network Correct answer.
  4. The client is performing a passive scan on all channels

Explanation

A wildcard (zero-length) SSID in a probe request means the station is actively scanning and will accept probe responses from any network. Directed probes carry a specific SSID and are used when the client remembers a preferred network. Passive scanning relies on beacons and does not transmit probe requests at all.

Question 14Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which statement correctly describes the relationship between an ESS and its constituent BSSs?

  1. An ESS is an ad hoc network without any distribution system
  2. An ESS is a BSS that uses only 6 GHz channels
  3. An ESS is a single BSS with multiple APs on different channels
  4. An ESS is a set of BSSs connected through a common distribution system sharing one SSID Correct answer.

Explanation

An extended service set is formed when multiple BSSs are joined by a distribution system and present the same SSID to clients, enabling seamless coverage. A BSS is a single AP coverage cell, and an IBSS has no distribution system. Band choice is independent of the ESS concept.

Question 15Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which 802.11 management frame is used by a client to notify the AP that it is ending its association while retaining its authenticated state?

  1. Deauthentication frame
  2. Disassociation frame Correct answer.
  3. Probe response frame
  4. Authentication frame

Explanation

A disassociation frame terminates the association while leaving the authentication state intact, and a deauthentication frame ends the authenticated state itself. Authentication frames establish the state, and probe responses answer discovery requests. Forged deauthentication and disassociation frames are a classic denial-of-service technique because these management frames are unauthenticated in legacy deployments.

Question 16Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which mechanism does 802.11ax use to improve efficiency in dense deployments with many small frames?

  1. Wider 160 MHz channels for every client
  2. OFDMA resource units and trigger-based uplink scheduling Correct answer.
  3. Mandatory use of 60 GHz directional links
  4. Removal of the CSMA/CA contention mechanism

Explanation

802.11ax introduces OFDMA, dividing a channel into resource units so multiple clients transmit in the same time window, and trigger frames schedule uplink transmissions. It retains CSMA/CA for channel access and does not mandate 60 GHz. This design targets efficiency for many low-throughput devices such as IoT sensors.

Question 17Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

A wireless assessment requires capturing all management and data frames on a channel, including frames not addressed to the capture device. Which configuration achieves this?

  1. Ad hoc mode joined to the target SSID
  2. Master mode operating as a rogue AP
  3. Monitor mode on an adapter tuned to the target channel Correct answer.
  4. Managed mode with promiscuous mode enabled

Explanation

Monitor mode passes raw 802.11 frames to the capture stack, including management frames and traffic not addressed to the adapter, and the radio must be tuned to the channel of interest. Managed mode with promiscuous mode typically filters at the driver and may not deliver 802.11 headers reliably. Ad hoc and master modes participate in the network rather than passively observing it.

Question 18Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which statement about the 4-way handshake in WPA2-Personal is accurate?

  1. It uses SAE to prevent offline dictionary attacks
  2. It transmits the PSK in cleartext to the client during association
  3. It requires a RADIUS server to complete
  4. It derives fresh session keys from the PSK and nonces, and a captured handshake enables offline guessing of the passphrase Correct answer.

Explanation

The 4-way handshake uses the PSK plus ANonce and SNonce to derive the pairwise transient key, and the MIC in message 2 can be checked offline against candidate passphrases. The PSK itself is never sent over the air. SAE belongs to WPA3, and RADIUS is part of Enterprise deployments.

Question 19Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which 5 GHz channel characteristic affects an attacker attempting to use a wide bonded channel for a rogue AP?

  1. All 5 GHz channels are restricted to 20 MHz by regulation
  2. 5 GHz channels overlap in groups of five like 2.4 GHz channels
  3. 5 GHz channels cannot carry management frames
  4. DFS channels require radar detection and may force the AP to vacate the channel Correct answer.

Explanation

Many 5 GHz channels fall in DFS bands, where an AP must detect radar and vacate within a specified time, which can disrupt a rogue AP or a long capture. 5 GHz channels are 20 MHz wide and non-overlapping by design, and they carry the same frame types as any other band. Planning around DFS behavior is important for stable long-duration tests.

Question 20Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which frame carries the BSSID and capability information in a probe response, and why does this matter for a rogue AP assessment?

  1. The probe response carries only encryption keys, so it cannot be spoofed
  2. The probe response is a data frame and is ignored by clients during scanning
  3. The probe response is only sent after a successful 4-way handshake
  4. The probe response mimics beacon content, so a rogue AP can answer wildcard probes and appear as a legitimate network Correct answer.

Explanation

Probe responses carry the same discovery elements as beacons, including SSID, BSSID, and capabilities, so an attacker can answer wildcard probes to lure clients. Clients trust this unauthenticated discovery information, which underpins evil-twin style attacks. The frame is a management frame and precedes any security handshake.

Question 21Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which 802.11 power-saving mechanism allows a station to sleep and be notified of buffered frames via the TIM in beacons?

  1. Legacy power save with PS-Poll Correct answer.
  2. Spatial multiplexing power control
  3. Dynamic frequency selection
  4. Unscheduled automatic power save delivery only

Explanation

In legacy power save, a station sleeps and the AP sets the traffic indication map in beacons; the station wakes and sends a PS-Poll to retrieve buffered frames. U-APSD is a later delivery mechanism, and DFS is a radar-avoidance requirement rather than a power feature. Recognizing sleep behavior helps when a capture shows intermittent client traffic.

Question 22Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which statement best explains why 802.11 management frames are a security concern in legacy WLANs?

  1. They are only transmitted during the 4-way handshake
  2. They are sent unencrypted and unauthenticated, so spoofed deauthentication and beacon frames are accepted by clients Correct answer.
  3. They are encrypted with WEP, which is trivially broken
  4. They require a valid client certificate to be processed

Explanation

Legacy 802.11 management frames lack cryptographic protection, so an attacker can forge deauthentication, disassociation, and beacon frames that clients honor. 802.11w (PMF) was introduced to protect certain management frames with integrity checks. WEP encrypts data frames rather than authenticating management traffic, and client certificates are an Enterprise authentication concept.

Question 23Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

An analyst observes a client repeatedly reassociating to different APs with the same SSID but different BSSIDs. Which explanation is most consistent with this behavior?

  1. The client is roaming across an ESS and the distribution system is preserving its session Correct answer.
  2. The client is performing a WEP key rotation
  3. The client is acting as a rogue AP beaconing multiple BSSIDs
  4. The client is executing a PMF downgrade attack

Explanation

Repeated reassociation to different BSSIDs under one SSID is normal roaming within an ESS, where the distribution system maintains the client's session. A rogue AP would be the beacon source, not the roaming client, and WEP key rotation and PMF downgrade do not produce this pattern. Distinguishing benign roaming from malicious behavior requires correlating BSSIDs with known infrastructure.

Question 24Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which factor most directly limits the effectiveness of a 2.4 GHz deauthentication flood against a target client in a dense office?

  1. Co-channel interference and retransmissions reduce the reliability of forged frames reaching the client Correct answer.
  2. 2.4 GHz frames cannot be spoofed because of mandatory PMF
  3. Deauthentication frames are only valid on 5 GHz channels
  4. Clients ignore deauthentication frames when WPA3 is enabled

Explanation

In a congested 2.4 GHz environment, interference causes collisions and retransmissions that reduce the probability that forged frames are received and acted upon. PMF is not mandatory on all 2.4 GHz networks, and deauthentication is band-independent. WPA3 networks with PMF resist forgery, but the question's limiting factor in a dense office is medium reliability.

Question 25Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which combination of 802.11 features most improves both spectral efficiency and resilience to interference in a high-density venue?

  1. 802.11g with 40 MHz channels and ERP protection
  2. 802.11ax OFDMA with BSS coloring and 20/40 MHz channel planning Correct answer.
  3. 802.11b with DSSS and long preamble
  4. 802.11a with 160 MHz channels and no DFS

Explanation

802.11ax OFDMA schedules sub-channel resource units, and BSS coloring lets overlapping BSSs distinguish frames to reduce unnecessary backoff. Careful 20/40 MHz planning limits co-channel interference in dense areas. Legacy 802.11b/g/a features either lack these efficiencies or, in the case of wide channels, increase contention.

Question 26Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which 802.11 PHY operates in the 60 GHz band and is designed for very high throughput over short distances?

  1. 802.11ad (DMG) Correct answer.
  2. 802.11j (4.9 GHz)
  3. 802.11ah (S1G)
  4. 802.11af (TVWS)

Explanation

802.11ad, also called DMG (Directional Multi-Gigabit), uses the unlicensed 60 GHz band to achieve multi-gigabit rates but suffers high oxygen absorption and poor penetration, limiting range. The other amendments target sub-1 GHz, TV white space, and 4.9 GHz Japanese bands respectively.

Question 27Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

A client associates to an AP and the AP assigns it a 16-bit Association ID (AID). What is the primary purpose of this identifier?

  1. It encrypts the station's unicast frames after the handshake
  2. It selects which spatial stream the station will use
  3. It defines the station's channel width during association
  4. It identifies the station's traffic within the TIM bitmap for power-save delivery Correct answer.

Explanation

The AID is a 16-bit value assigned at association that maps the station to a bit position in the Partial Virtual Bitmap of the TIM information element, allowing the AP to signal buffered frames to sleeping stations. It carries no cryptographic or PHY-layer role.

Question 28Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which 802.11 MAC frame type includes subtypes such as Beacon, Probe Request, and Association Request?

  1. Control frames
  2. Management frames Correct answer.
  3. Data frames
  4. Extension frames

Explanation

The 802.11 MAC defines three frame classes: management, control, and data. Beacons, probe requests/responses, authentication, and association frames all fall under management, which is why they are central to reconnaissance and rogue AP activity.

Question 29Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

An attacker observes a beacon frame and reads the DS Parameter Set element with a value of 6. What does this element convey?

  1. The DTIM period for buffered multicast traffic
  2. The primary channel number the BSS operates on Correct answer.
  3. The maximum transmit power the AP allows
  4. The beacon interval in time units

Explanation

The DS Parameter Set information element carries the current channel number of the BSS, letting stations know the primary operating channel. Beacon interval and DTIM are carried in separate fields, and transmit power is conveyed through other elements such as the Country or TPC elements.

Question 30Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which 802.11 amendment first introduced operation in the 6 GHz band for Wi-Fi, branded Wi-Fi 6E?

  1. 802.11ac
  2. 802.11n
  3. 802.11g
  4. 802.11ax Correct answer.

Explanation

802.11ax (Wi-Fi 6) was extended to the 6 GHz spectrum through regulatory action, and products supporting that band are marketed as Wi-Fi 6E. The earlier amendments 802.11ac, 802.11n, and 802.11g operate only in 5 GHz and/or 2.4 GHz.

Question 31Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

A station sends an authentication frame with algorithm number 0 to an open system AP. What does this exchange accomplish at the MAC layer?

  1. It proves possession of the PSK configured on the AP
  2. It negotiates the channel width for the upcoming association
  3. It derives the pairwise transient key used for data confidentiality
  4. It establishes the station's identity to the AP before association, without encrypting traffic Correct answer.

Explanation

Open System authentication is a simple two-frame exchange (request and response) that precedes association and provides no real security; it merely satisfies the link-layer requirement before association. Key derivation and PSK proof occur later in the 4-way handshake for WPA/WPA2.

Question 32Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which term describes a set of one or more BSSs interconnected by a distribution system and sharing the same SSID and security configuration?

  1. Independent Basic Service Set (IBSS)
  2. Mesh Basic Service Set (MBSS)
  3. Basic Service Area (BSA)
  4. Extended Service Set (ESS) Correct answer.

Explanation

An ESS joins multiple BSSs through a distribution system so clients can roam while keeping the same network identity. IBSS is an ad hoc network without an AP, and BSA refers to the physical coverage area of a single AP.

Question 33Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

A rogue AP is configured with the same SSID as the corporate network but advertises a different security configuration. Which behavior would a client most likely exhibit when encountering it?

  1. It will treat the rogue as a mesh peer and form an MBSS link
  2. It will immediately deauthenticate from the legitimate AP regardless of signal
  3. It may attempt association based on the SSID and then fail the security negotiation Correct answer.
  4. It will ignore the SSID because security configuration is not part of network selection

Explanation

Clients often select networks by SSID, and mismatched security settings cause the association or handshake to fail, which can expose information or trigger fallback behavior. This is why evil-twin attacks clone the security profile as well as the SSID.

Question 34Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which field in the 802.11 MAC header indicates whether a frame is destined for the distribution system, and how is it used in a frame from a station to an AP?

  1. The From DS bit, set to 1 for frames sent by a station toward the AP
  2. The Protected Frame bit, set to 1 for all management frames
  3. The To DS bit, set to 1 for frames sent by a station toward the AP Correct answer.
  4. The More Fragments bit, set to 1 for the final fragment

Explanation

The To DS and From DS bits in the Frame Control field describe the frame's direction relative to the distribution system. A station sending uplink traffic to its AP sets To DS to 1 and From DS to 0, which also determines how the four address fields are interpreted.

Question 35Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which 802.11 control frame is sent by a station to reserve the medium and is answered by the AP with a CTS?

  1. RTS Correct answer.
  2. Block Ack Request
  3. PS-Poll
  4. ACK

Explanation

A Request to Send (RTS) frame is a control frame a station transmits to reserve airtime; the AP replies with a Clear to Send (CTS) that quiets the area. ACK acknowledges received frames, Block Ack Request manages block acknowledgment sessions, and PS-Poll retrieves buffered frames.

Question 36Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

An analyst inspects a capture and sees a frame with three address fields where Address1 equals the AP BSSID and Address2 equals the client MAC. Which frame direction does this indicate?

  1. A management frame broadcast to all stations
  2. A frame within an IBSS between two peers
  3. Downlink data from the AP to the client
  4. Uplink data from the client to the AP Correct answer.

Explanation

In an infrastructure BSS, uplink frames set Address1 to the receiver (the AP BSSID) and Address2 to the transmitter (the client), with To DS set. Downlink frames reverse these roles, and IBSS frames use different address semantics.

Question 37Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which 802.11 feature allows a station to transmit multiple frames in a single transmit opportunity after winning contention, improving efficiency?

  1. Fragmentation of large frames
  2. Dynamic frequency selection
  3. Frame aggregation within a TXOP Correct answer.
  4. Clear channel assessment

Explanation

A transmit opportunity (TXOP) grants a station a bounded period during which it can send multiple frames or aggregates without recontending, which reduces overhead. Fragmentation splits frames, DFS avoids radar, and CCA is the listen-before-talk mechanism.

Question 38Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which statement accurately describes the role of the distribution system (DS) in an infrastructure WLAN?

  1. It forwards frames between APs and toward wired networks, enabling roaming across BSSs Correct answer.
  2. It authenticates stations using 802.1X before association
  3. It defines the ad hoc peer-to-peer forwarding rules
  4. It provides the radio modulation scheme used between a station and its AP

Explanation

The DS is the logical backhaul that connects APs and bridges wireless traffic to other networks, letting stations move between BSSs within an ESS. It is not a PHY modulation scheme, an authentication protocol, or an ad hoc forwarding mechanism.

Question 39Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

A tester wants to identify all SSIDs advertised in an area without sending probe requests that reveal the tester's presence. Which passive observation approach is most appropriate?

  1. Send directed probe requests to each suspected SSID
  2. Capture beacon frames on each channel and parse their SSID elements Correct answer.
  3. Perform an active scan with wildcard probe requests
  4. Initiate association attempts to each visible BSSID

Explanation

Beacon frames are broadcast periodically by APs and contain the SSID element, so passively capturing them on each channel reveals advertised networks without transmitting. Probe requests and association attempts are active and expose the tester's MAC and activity.

Question 40Wireless network types and architectures (Wi-Fi standards, 802.11 foundations)

Which combination of channel width and band best explains why a 160 MHz channel is impractical for a covert rogue AP in a congested 5 GHz environment?

  1. It forces the AP into 2.4 GHz compatibility mode
  2. It requires a large contiguous block of clean spectrum and is easily noticed by spectrum monitoring Correct answer.
  3. It prevents the use of WPA2 encryption on the rogue AP
  4. It disables MIMO and reduces throughput below 20 MHz channels

Explanation

Wide channels consume large contiguous spectrum blocks that are scarce in congested 5 GHz deployments, and their wide energy footprint is conspicuous to spectrum analyzers and WIDS. Narrower channels are easier to hide and more likely to find clean spectrum.

Question 41Wireless reconnaissance and traffic capture/analysis (Aircrack-ng, Kismet, Wireshark)

Which aircrack-ng suite tool is designed to inject frames and replay captured traffic against a target AP?

  1. aireplay-ng Correct answer.
  2. airmon-ng
  3. airodump-ng
  4. airdecap-ng

Explanation

aireplay-ng is the injection utility in the suite, used for deauthentication, fake authentication, ARP replay, and other frame injection attacks. airmon-ng manages monitor-mode interfaces, airodump-ng performs capture and discovery, and airdecap-ng decrypts captured files with known keys.

Question 42Wireless reconnaissance and traffic capture/analysis (Aircrack-ng, Kismet, Wireshark)

What does airodump-ng write to disk when you supply the --write /path/capture option?

  1. A live SQLite database that grows during capture
  2. A single pcapng file only
  3. An encrypted archive requiring a passphrase
  4. Several files sharing the given prefix, including .cap and .csv Correct answer.

Explanation

airodump-ng creates a family of files that share the prefix you specify, typically capture-01.cap for packet data and capture-01.csv for the station and AP tables. Additional .kismet.netxml and log files may also appear, so the prefix is a basename rather than a complete filename.

Question 43Wireless reconnaissance and traffic capture/analysis (Aircrack-ng, Kismet, Wireshark)

Which Wireshark display filter shows only beacon frames?

  1. wlan.fc.type_subtype == 0x0008 Correct answer.
  2. wlan.bssid == beacon
  3. wlan.fc.subtype == 8
  4. wlan.fc.type == 0

Explanation

Beacon frames are management frames (type 0) with subtype 8, which Wireshark represents through the combined wlan.fc.type_subtype field with value 0x0008. Filtering on type alone returns every management frame, including probes and authentication frames.

Question 44Wireless reconnaissance and traffic capture/analysis (Aircrack-ng, Kismet, Wireshark)

In airodump-ng output, what does the ENC column report?

  1. The encryption cipher suite advertised by the AP Correct answer.
  2. The number of associated stations
  3. The signal strength in dBm
  4. The channel width in MHz

Explanation

The ENC column summarizes the privacy and cipher information advertised by the access point, such as WEP, WPA, or WPA2. It is a quick indicator of the security configuration rather than a measure of radio or client activity.

Question 45Wireless reconnaissance and traffic capture/analysis (Aircrack-ng, Kismet, Wireshark)

Which Kismet feature aggregates observed wireless devices into persistent records across sessions?

  1. The device database Correct answer.
  2. The channel hopping schedule
  3. The pcapng logging pipe
  4. The GPS daemon

Explanation

Kismet stores observed devices in a database so that APs, clients, and other emitters persist and can be queried across capture sessions. Channel hopping affects radio coverage, GPS adds location, and logging pipes write packet data, but none of them maintains device records.

Question 46Wireless reconnaissance and traffic capture/analysis (Aircrack-ng, Kismet, Wireshark)

Which pcapng block type stores interface-specific metadata such as link type and snapshot length?

  1. Interface Description Block Correct answer.
  2. Enhanced Packet Block
  3. Name Resolution Block
  4. Section Header Block

Explanation

Each pcapng section begins with a Section Header Block, and every interface is described by an Interface Description Block that records link type, snapshot length, and options. Enhanced Packet Blocks carry the actual frames and reference the interface they arrived on.

Question 47Wireless reconnaissance and traffic capture/analysis (Aircrack-ng, Kismet, Wireshark)

What is the primary purpose of the aircrack-ng suite's airmon-ng check kill command?

  1. Terminate processes that could interfere with monitor mode Correct answer.
  2. Delete old capture files from the working directory
  3. Test the adapter's injection capability
  4. Verify the wireless adapter's regulatory domain

Explanation

Network managers and supplicants such as NetworkManager or wpa_supplicant can reset an interface or interfere with monitor mode, so check kill identifies and stops them. It does not test injection, manage files, or query regulatory settings.

Question 48Wireless reconnaissance and traffic capture/analysis (Aircrack-ng, Kismet, Wireshark)

Which tshark option writes the packets it processes to a new capture file?

  1. -w Correct answer.
  2. -Y
  3. -T
  4. -r

Explanation

The -w option directs tshark to write processed packets to an output file, which can be combined with a read filter to extract a subset. The -r option reads an input file, -T selects output formatting for dissection, and -Y applies a display filter.

Question 49Wireless reconnaissance and traffic capture/analysis (Aircrack-ng, Kismet, Wireshark)

You need to capture only frames on channel 6 while hopping is disabled. Which airodump-ng invocation accomplishes this?

  1. airodump-ng --band a wlan0mon
  2. airodump-ng --bssid 6 wlan0mon
  3. airodump-ng -c 6 wlan0mon Correct answer.
  4. airodump-ng --essid 6 wlan0mon

Explanation

The -c option fixes the capture to a single channel, and because a channel is specified airodump-ng stops hopping. The --band option selects frequency bands, while --bssid and --essid filter by identifier rather than by channel.

Question 50Wireless reconnaissance and traffic capture/analysis (Aircrack-ng, Kismet, Wireshark)

A capture shows a station sending an Authentication frame to an AP followed by an Association Request. Which frame type and subtype pair describes the Authentication frame?

  1. Control, subtype 11
  2. Management, subtype 0 Correct answer.
  3. Data, subtype 0
  4. Management, subtype 11

Explanation

Authentication is a management frame (type 0) with subtype 0, and association request is subtype 0 in a different type context. Control frames such as RTS use subtype 11, and data subtypes carry payload rather than joining handshakes.