201-250 Flashcards

Question 1

Q

802.1X/EAP-TLS supports what client authentication credential type?

A. Passwords

B. x.509 Certificates

C. Digital Security Token

D. MD5 Hash Exchange

E. Biometric

Question 2

Q

Which wireless security protocol cannot use digital certificates for both the supplicant and authentication server?

A. EAP-TLS

B. IPSec VPN

C. PEAPv0/EAP-TLS

D. EAP-TTLS

E. LEAP

Question 3

Q

Why do PEAPv0/EAP-TLS and PPTP/EAP-TLS offer stronger authentication than PEAPv0/EAP- MSCHAPv2 and PPTP/MS-CHAPv2?

A. MS-CHAPv2 supports only protected access credentials (PACs), but EAP-TLS supports smart cards andsecure tokens for client authentication.

B. EAP-TLS uses x.509 certificates for client and server authentication while MS-CHAPv2 uses passwordauthentication.

C. Use of MS-CHAPv2 allows only RADIUS to be used as an authentication server, but EAP-TLS allows bothRADIUS and TACACS+.

D. EAP-TLS supports hashing passwords before they are transmitted across the medium by clients, but MSCHAPv2supports only clear text passwords.

Question 4

Q

Which 802.1X/EAP type allows a maximum of three phases of authentication?

A. EAP-FAST

B. EAP-TTLS/MS-CHAPv2

C. PEAPv0/EAP-MSCHAPv2

D. PEAPv1/EAP-GTC

E. EAP-TLS

Question 5

Q

What is the primary difference between EAP-TLS and EAP-TTLS authentication?

A. EAP-TTLS provides strong client authentication and EAP-TLS does not

B. EAP-TLS is an authentication protocol, and EAP-TTLS is an encryption type

C. EAP-TTLS provides support for legacy client authentication methods, and EAP-TLS requires certificates forclient-side authentication

D. EAP-TLS uses a RADIUS server for authentication, and EAP-TTLS can only use Kerberos E. EAP-TLS uses IP-based authentication, and EAP-TTLS uses MAC-based authentication

Question 6

Q

Which statements are true regarding deployment of lightweight access points? (Choose four)

A. Lightweight access points support 802.3af and may connect directly to the WLAN controller or to anEthernet switch.

B. Lightweight access points may connect to the WLAN controller with either a Layer-2 or a Layer- 3 protocol.

C. Lightweight access points may be controlled over either Layer-2 or Layer-3.

D. Lightweight access points may use DNS to locate their assigned WLAN controller.

E. Lightweight access points cannot be deployed over the Internet due to Network Address Translation.

F. Lightweight access points may be configured for 802.11a or 802.11g, but not both simultaneously.

Answer

A

A, B, C, D

Question 7

Q

What is a consideration when implementing a security policy regarding wireless bridging?

A. Bridge links can be mistaken for public accesshot-spots

B. Bridge links should be used as corporate access points whenever possible

C. Bridge links can span miles so an intruder is unlikely to be seen or located

D. Bridge links cannot be protected by 802.1X/EAP authentication so an appropriate VPN solution must bechosen

E. Wireless intrusion prevention systems (WIPS) should always have the ‘false root detection’ feature enabled

Question 8

Q

As part of its corporate security policy, your organization requires all wireless LANs to be separated from the wired network core using a device capable of authentication, data encryption, and throughput limiting. Which device will accomplish this policy requirement?

A. Wireless workgroup bridge

B. Transparent tunneling bridge

C. Wireless LAN controller

D. Personal firewall software

Question 9

Q

Which statement describes a potential architectural performance disadvantage of some WLAN controllers with centralized forwarding and controller-based access points in a large-scale WLAN deployment?

A. Data encryption/decryption is always performed on the WLAN controller.

B. The 802.11 distribution system (DS) is located in the WLAN controller software.

C. All WLAN traffic must flow through the WLAN controller.

D. Management frames and Control frames are always encapsulated in 802.3 frames.

Question 10

Q

In order to implement a robust security network (RSN) as defined by the 802.11i-2004 amendment, an administrator may not implement _______________?

A. The Wired Equivalent Privacy (WEP) Cipher Suite

B. The STAKey Handshake

C. The Pass-phrase-to-Preshared Key Algorithm

D. The Group Key Handshake

E. The TKIP Message Integrity Check (MIC) called ‘Michael’

Question 11

Q

Given: The enhanced confidentiality, data authentication, and replay protection mechanisms of the 802.11i-2004 amendment require fresh cryptographic keys. What wireless components are defined by the 802.11i- 2004 amendment to provide fresh cryptographic keys? (Choose three)

A. 4-Way Handshake

B. EAPoL Handshake

C. Group Handshake

D. 802.1X/EAP Handshake

E. AES-CCMP Handshake

F. STAKey Handshake

Question 12

Q

The 802.11i 4-way handshake process is used with which secure WLAN implementations? (Choose two)

A. When WPA-Personal is used on a SOHO WLAN router

B. When static WEP-128 is used on a WLAN switch

C. When IPSec is used on an Enterprise Wireless Gateway

D. When WPA2-Enterprise is used on an enterprise class thick AP

E. When HTTPS is used for a WLANhot-spotlogin

Question 13

Q

In an 802.11i-compliant 802.1X/EAP system, where are AAA keys generated?

A. On the 802.1X Authentication Server only

B. Manually by the network administrator

C. Jointly negotiated between the 802.1X Supplicant andthe 802.1X AuthenticationServer

D. On the 802.1X Authenticator only

E. In the Pass-phrase-to-PSK mapping algorithm

F. On the 802.1X Supplicant only

Question 14

Q

ABC Company has a Microsoft Windows 2003 Active Directory (AD) environment with IAS (an EAP-enabled RADIUS server) installed at their corporate headquarters (HQ) and at all branch locations. The HQ IAS server is currently used to authenticate HQ 802.11g WLAN users. ABC is installing an 802.11g WLAN at a branch office, and they have hired you to advise them on the best way to implement authentication for branch WLAN users. How will you configure access points at the branch office for maximized authentication speed and reliability?

A. Authenticate against the HQ IAS server. The HQ IAS will look up the user on the HQ AD servers.

B. Authenticate against the branch IAS server. The branch IAS server will look up the user on the branch ADserver.

C. Authenticate against the branch IAS server. The branch IAS server will proxy the request to the HQ IASserver. The HQ IAS server will look up the user on the HQ AD servers.

D. Authenticate against the branch IAS server. The branch IAS server will look up the user on the HQ ADservers.

Question 15

Q

What is one method of implementing RADIUS-based VLAN assignment?

A. VSA access lists

B. SSID assignment

C. Roaming profiles

D. VLAN map matrix

Question 16

Q

ABC Corporation, a software development organization, wishes to test their own LDAP implementation in a live wireless environment. Choose the appropriate ways to use LDAP for user authentication in a WLAN environment. (Choose three)

A. A WLAN switch using EAP-TTLS authentication sends a user authentication request to a RADIUS server.
The RADIUS server queries the LDAP server for user credential information.

B. An enterprise wireless gateway (EWG) directly queries the LDAP server for user credential information

C. An access point using PEAPv1/EAP-GTC sends an authentication request to the LDAP server whichproxies the request to a TACACS+ server for user credential authentication

D. A enterprise encryption gateway (EEG) sends an authentication request to an access control server whichproxies the request to a TACACS+ server, which in turn forwards auser credential request to the LDAPserver for verification

Question 17

Q

The 802.11i-2004 amendment defines and supports what three cipher suites? (Choose three)

A. WEP

B. PSK

C. CCMP

D. TKIP

E. IPSec

F. SSH2

Question 18

Q

ABC Corporation implemented a PPTP/MSCHAPv2/MPPE-128 VPN to secure its 802.11g WLAN one year ago. ABC Corp’s VPN concentrator has been using local authentication, and they have steadily grown to match the VPN server’s maximum local authentication capacity. As a consultant, you advise the network manager to consider what steps in order to scale this WLAN security solution and to strengthen its security? (Choose two)

A. ABC Corp’s users should implement personal firewall software to prevent peer-to-peer attacks.

B. Implement WPA2-Personal at layer2 while leaving the PPTP VPN in place to increase scalability.

C. PPTP/RC4 should be changed to PPTP/AES to strengthen the VPN’s encryption.

D. Once the VPN server’s local database capacity is exceeded, ABC Corp should migrate to IPSec VPNtechnology for greater scalability.

E. ABC Corp should use RADIUS for authentication instead of local authentication on the VPN server.

Question 19

Q

You are a wireless network administrator for ABC Corporation. Currently ABC Corp has a VPN concentrator that uses a PPTP/MS-CHAPv2/MPPE-128 VPN security solution for its 100 WLAN users. Since the WLAN was installed, there have been multiple successful attacks against ABC Corp’s access points since they are using Open System authentication. ABC Corp wants to update their WLAN security solution. Which security solution would improve the security of ABC Corp’s access points while increasing encryption strength and network scalability?

A. L2TP/IPSec with AES-192

B. WPA2-Enterprise with EAP-TTLS

C. SSH2 with 3DES

D. WEP with Shared Key authentication

Question 20

Q

What statements describe the AES-CCMP data protection mechanism implemented by the 802.11i-2004 amendment?

A. Uses the 256-bit Rijndael encryption algorithm to protect the MPDU Data field.

B. Protects the integrity of both the MPDU Data field and selected portions of the MPDU header.

C. Has support for CCMP using a 128-bit key that is mandatory for Robust Security Network (RSN) compliancewhen not using TKIP.

D. Uses either the RC4 stream cipher or 3DES block cipher to encrypt the MPDU Data field.

E. Uses a 192-bit encryption algorithm to protect authentication between the supplicant and authenticationserver.

Question 21

Q

You have been hired by ABC Corporation to perform a WLAN security audit. ABC’s network manager has attended a one-day manufacturer’s seminar on WLAN security and, in your opinion, knows only enough to ask good questions of a WLAN security professional. The network manager asks you about the specific advantages of TKIP over WEP. You explain that TKIP has the following advantages over WEP: (Choose two)

A. Inclusion of SHA-HMAC authentication to prevent man-in-the-middle attacks

B. Inclusion of a strong MIC to prevent in-transit frame tampering and replay attacks

C. Replacement of IVs with LIVs to prevent attacks against weak passwords

D. Replacement of CRC-32 with ICV-32 to prevent brute-force attacks against RC4

E. Improved per-packet keying to prevent weak IVs from being used to derive the WEP key

Question 22

Q

Two IT administrators at ABC Corporation are debating the differences between WPA2 and Layer 3 VPN technologies. The IT Director settles the dispute by explaining how WPA2 secures the WLAN data frame payloads. Which description of this process is correct in describing how WPA2 secures wireless data transmissions?

A. WPA2 encrypts layer 2 addresses and encrypts the layer 3 through layer 7 payloads.

B. WPA2 encodes layer 2 addresses with a 64-bit offset and encrypts the layer 3 and layer 4 addresses only.

C. WPA2 encrypts layer 3 through layer 7 payloads while leaving layer 2 source and destination addressesexposed.

D. WPA2 leaves the layer 2 and layer 3 addresses exposed while encrypting layer 4 through layer 7 payloads.

Question 23

Q

What statements are true regarding access point firmware updates? (Choose two)

A. A WNMS distributes firmware to autonomous access points.

B. A WIPS distributes firmware to multiple vendors’ autonomous access points.

C. A WLAN controller distributes firmware to lightweight access points.

D. Client devices notify the WNMS when an access point’s firmware is out-of-date.

E. Autonomous access points automatically update firmware on their neighboring access points.

Question 24

Q

What scenario could cause a ‘false positive’ intrusion alarm in a wireless intrusion prevention system (WIPS)?

A. A client device has a high rate of frame retransmissions due to a noisy RF environment.

B. A client device disassociates and reassociates to an AP several times in quick succession due to a lowRSSI value.

C. A reporting delay from a remote RF sensor due to busy WAN links.

D. A rogue access point is located and found to have the same SSID as the authorized network.

Question 25

Q

Wireless Intrusion Prevention Systems (WIPS) started as Wireless Intrusion Detection Systems (WIDS).

WIPS can both detect and prevent some network attacks, whereas WIDS can only detect and report network intrusions. Which wireless network attacks can WIPS prevent?

A. Narrowband RF jamming of a spread spectrum channel

B. EAP-Start flooding against an access point

C. Association of authorized clients to rogue access points

D. Deauthentication attacks against access points by intruders

Question 26

Q

ABC Company has 6 employees, each of whom uses a laptop with an 802.11a/b/g Mini-PCI card configured for Ad-Hoc mode. These laptops are the only computers in the company. Why is it not possible for ABC Company to have a Wireless Intrusion Prevention System (WIPS) with the existing network configuration?

A. In an Ad-Hoc WLAN environment, there is no central management station to which to report intrusions.

B. Most intrusion detection systems by design are incompatible with 802.11Ad-Hocmode.

C. Intrusion detection systems use the SNMP protocol, which is incompatible with 802.11 Ad-Hoc mode.

D. Intrusion detection systems work only in switched WLAN environments.

Question 27

Q

A university’s WLAN administrator is seeking an efficient and effective method of detecting and eliminating rogue access points and wireless Ad Hoc networks across the entire campus. The administrator’s friend suggests that the he use a WLAN protocol analyzer to perform a weekly survey of the campus to discover rogues devices. The administrator considers this option and then asks you to offer advice on the subject. What is your advice to the administrator? (Choose two)

A. In a campus environment, manual scanning for rogues requires too much time and resources to effectivelyand consistently locate all rogue devices. A system is needed that can inspect the entire campus in realtime.

B. WLAN protocol analyzers will not detect rogue devices that do not use the 802.11 protocol frame format.

C. Because WLAN protocol analyzers can see all frames on the wireless medium, they are the mostcomprehensive solution for detecting rogue wireless devices of any kind.

D. By assigning one IT worker to do weekly scans using a WLAN protocol analyzer, Wi-Fi, Bluetooth, and

Infrared rogue access points and Ad Hoc networks can be effectively located and removed.

E. WLAN protocol analyzers are not a comprehensive rogue detection solution because they cannot detectaccess points that are configured to hide the SSID in beacons.

Question 28

Q

WLAN protocol analyzers can decrypt data frames in real time when the data frames are encrypted with which security mechanisms? (Choose two)

A. WPA-Personal

B. PPTP/MPPE

C. WPA2-Enterprise

D. IPSec/ESP

E. WEP-128

Question 29

Q

ABC Company’s lightweight access points periodically go ‘off channel’ for a short period of time to scan all 802.11a/g Wi-Fi channels to detect and locate rogue access points. When a rogue access point is found, the active security policy requires at least one access point to perform a deauthentication attack against the rogue. What type of WIPS does ABC Company have?

A. Hot-standby

B. Integrated

C. Overlay

D. Autonomous

E. AP-reliant

Question 30

Q

ABC Company’s network includes ten ERP-OFDM (802.11g) STAs connecting through a single access point. To help avoid the spread of viruses between wireless users, what should be implemented on the network? (Choose two)

A. Personal firewall software on client devices

B. Wireless Intrusion Prevention System (WIPS)

C. WLAN protocol analysis software on one laptop

D. Peer-to-peer data blocking in the AP

E. Wi-Fi Protected Access version 2 (WPA2)

Question 31

Q

As a wireless security professional, you are tasked by a company to quickly attempt to bypass static WEP security on their 802.11a WLAN. WEP is configured as mandatory on all devices in the network. Which approaches do you take? (Choose two)

A. Enable a wireless protocol analyzer and wait for it to gather a given amount of data traffic from multiplewireless LAN end users. You use AirCrack to look for weak IVs in the packet trace.

B. Associate with an access point using Open System authentication and log in with the default username andpassword. You reconfigure the access point for a new WEP key.

C. Record their SSID, phone number, address, and other data related to their organization and try to fitnumbers and letters into patterns of 5, 10, 13, or 26 characters for use as a test WEP key

D. Transmit a high volume of association frames to an access point to force it to fail into an Open System state.You use a WLAN client to associate and bypass WEP security.

E. Configure Windows Zero Configuration (WZC) to have the key providedautomatically to your client device.Enable a WLAN protocol analyzer to capture theWEP key.

Question 32

Q

As a wireless security professional working for ABC Corporation, you have a corner office with a window. You notice someone on the roof of the building across the street pointing a Yagi antenna in your building’s direction. You deduce that this person is likely trying to attack ABC Corp’s WLAN. What are your first steps in thwarting this potential attack? (Choose two)

A. Monitor the intrusion prevention system closely for any alerts and carefully document any findings

B. Broadcast a voice message and email to everyone in the company to refrain from using the WLAN until anintruder suspect can be apprehended

C. Shut down your WLAN until the individual on top of the other building can be identified and questioned as tohis business

D. Contact the facilities manager of the building across the street and inquire as to the nature of the businessof the individual on top of his building

E. Power up the perimeter Directional Jamming System (DJS) and focus its antennas at the individual acrossthe street

Question 33

Q

An intruder locates an unprotected 802.11b WLAN and gains control of two access points and a wireless bridge using the default SNMP read/write community strings. What types of wireless auditing tools are required for the intruder to locate the WLAN, discover the infrastructure devices, and exploit this particular security hole?

A. Netstumbler, share enumerator, wireless protocol analyzer, and spectrum analyzer

B. MacStumbler, OS fingerprinting & port scanning tool, and WEP decryption software

C. Wireless protocol analyzer, IP scanning utility, and network management software

D. IP scanning utility, network management software, access point software, and an RFjamming device

E. Network management software, WEP decryption software, application layer analyzer, and an SSH2 clientutility

Question 34

Q

An attacker captures a wireless frame, modifies it, recalculates its ICV, and retransmits the modified frame to the intended destination. What type of attack is this, and what is the mitigating solution?

A. Man-in-the-middle attack - 802.11i per-frame authentication

B. En-route attack - CRC-32 checksum

C. Authentication attack - Replace passwords with x.509 certificates

D. Bit-flipping attack - Strong Message Integrity Check (MIC)

E. Hijacking attack - Mutual authentication

Question 35

Q

As a consultant, you are explaining the risks of WLAN Denial-of-Service (DoS) attacks to a group of engineers at ABC Corporation. They understand DoS attacks, but do not understand wireless technology very well. You inform the engineers that there are multiple WLAN DoS attacks that must be mitigated as part of a security strategy. Which DoS attacks do you mention in your discussion with the group of engineers? (Choose three)

A. Use of 2.4 GHz cordless phones

B. Wideband RF jamming

C. 802.11 deauthentication

D. EAP-Start flooding

E. SSID hiding

F. Adjacent channel interference

Question 36

Q

XYZ Corporation has hired you to audit their WLAN network security measures. XYZ Corp currently has the following security measures in place:

1) All access points have non-default management interface passwords
2) Access points have been configured not to broadcast their SSID in Beacons or to respond to Probe Request frames with null SSID values
3) 128-bit WEP is in use by all access point and wireless client devices
4) MAC filters are implemented on all access points to allow only authorized users
5) Wireless Intrusion Prevention System (WIPS) with rogue detection and prevention

Your task is to compromise XYZ Corp’s wireless network by gaining access to sensitive data. How do you start your initial attack against the WLAN, given the above security measures?

A. Locate the WLAN using Netstumbler. Compromise data security by using a narrowband RF jamming deviceagainst an access point. Use a WLAN client device to gain access to the wired network through the jammedaccess point.

B. Locate the WLAN and obtain the SSID using Kismet. Put the SSID into a protocol analyzer, and thendecode frames looking for HTTP logins to a captive portal or an access point. Use the HTTP login to gainaccess to the wired network.

C. Locate the WLAN and obtain the WEP key using a spectrum analyzer. Put the WEP key into a WLAN clientdevice and access the wired network. Since the correct WEP key is being used, the WIPS will not detectyour client as a rogue device.

D. Locate the WLAN using a WLAN protocol analyzer. Gain access to sensitive data by attacking WEP securityusing a WEP cracking utility and putting the WEP key into the protocol analyzer.

Question 37

Q

An intruder wants to perform a WLAN hijacking attack against a wireless laptop on its layer 2 and layer 3 connections. This will be followed by a peer attack against open file shares on the wireless laptop. What items must the intruder possess to conduct this attack?

A. The SSID and channel of the authorized network, a narrowband RF jamming device, access point software,and subnet information of the existing network or DHCP server software

B. The SSID and channel of the authorized network, a spectrum analyzer, protocol analyzer software, wirelessframe generator software, and DHCP server software

C. The SSID of the authorized network, Internet Connection Sharing software, a high power FHSS jammingdevice, and DHCP server software

D. The channel of the authorized network, a mobile microwave oven, access point software, a spectrumanalyzer, and wireless protocol analysis software

Question 38

Q

As a new WLAN administrator for XYZ Corp, you notice that people are hanging around the coffee shop next door to your building aiming Yagi antennas toward your building. You assume that they are, at a minimum, attempting to passively eavesdrop on your network’s traffic. How can you verify that these people are indeed passively eavesdropping on your wireless LAN?

A. By using a WLAN protocol analyzer to detect an increase of collisions on the wireless network

B. By using a WIPS to detect rogue devices

C. By using a WLAN protocol analyzer detector application

D. By using a network reconnaissance tool to perform continuous PING sweeps

E. It is not possible to detect passive eavesdropping

Question 39

Q

Which of the following is a type of WLAN Denial of Service (DoS) attack?

A. Peer file theft

B. Active Bit flipping

C. Passive WEP cracking

D. Hijacking

E. Eavesdropping

Question 40

Q

Given: As the wireless LAN administrator, it is part of your responsibility to detect and eliminate rogue access points. You have educated end users about the dangers of rogue devices and have implemented a security policy sufficient to deter employees from placing rogues on the network.

You have located a rogue access point for which no employee will take responsibility for installing. You must assume that someone intentionally placed the rogue access point to attack your network. You determine that the rogue was not present on the network the previous day. By viewing the HTML management interface, you determine that the rogue has only been powered up for 15 minutes. What is your next task to deal with this situation?

A. Document the incident and report it to the highest level of management as a breach of security. Contact thepolice.

B. Disconnect the rogue access point’s wired network connection, and save and analyze its log files.

C. Reconfigure all authorized access points to your organization’s default security settings. Leave the rogue inplace as a trap for the intruder.

D. Document the incident. Power down the access point, and take it to the police for fingerprinting tests.

E. Temporarily shut down the entire wireless segment of the network pending an internal criminal investigation

Question 41

Q

ABC Corporation has recently hired a skilled wireless LAN security consultant to design, configure, install, and test a wireless LAN security implementation. The security implementation consists of 802.1X/PEAP, IPSec, and SSH2 solutions using the strongest available encryption. The security policy is very strict about use of the software solutions, and all end users have been sufficiently trained. When an unauthorized user tries to access the corporate WLAN from the parking lot, he cannot circumvent the existing security solutions. What are the next two steps the unauthorized user could take in order to penetrate the system’s security? (Choose two)

A. Perform a distributed Internet crack against a single access point

B. Perform a social engineering attack against help desk personnel

C. Perform an RF jamming attack against the WIPS

D. Mount an email virus campaign to unlock access points from the wired LAN segment

E. Place a rogue access point on ABC Corporation’s network

Question 42

Q

As a network administrator, you understand the mentality of most war drivers and have implemented a very strong WLAN security solution. From your office window, you spot a war driver in your parking lot using a Yagi antenna and a laptop in his car. You correctly assume that the war driver is attempting to penetrate your WLAN. What should you do next?

A. Ignore the war driver. You have implemented a secure WLAN solution they cannotpenetrate.

B. Call the police and have the war driver apprehended. Press charges for violations ofregulatory domainlaws.

C. Monitor the WIPS alerts and inform your organization’s security personnel to ask the war driver to vacate thepremises.

D. Implement a high-powered RF jamming device on all DSSS channels.

E. Approach the war driver and explain how his actions are illegal and unethical.

Question 43

Q

A government agency has allowed its employees to telecommute from WLAN hot-spots. After implementing this policy, there occurred a sharp increase in the exposure and exploitation of sensitive government data. The WLAN administrator has been tasked with securing remote user laptop computers so that telecommuting can be continued indefinitely. What steps does the WLAN Administrator take to secure these laptop computers during use at wireless hot-spots?

A. Install wireless LAN client utilities with mandatory use of WPA2-Enterprise security on all laptops

B. Install personal firewall software and VPN end-point software on all laptops

C. Install WLAN protocol analyzer software which allows the admin to remotely monitor for wireless intrusionsto each laptop

D. Require each user to utilize a portable NAT-capable wireless router while connected to thehot- spotnetwork.

Brainscape's Knowledge GenomeTM

201-250 Flashcards

Brainscape's Knowledge Genome^TM