3.4 Wireless Security Settings

Question 1

WPA 2

Answer 1

Wifi protected access 2

uses AES encryption based on CCMP
It can operate in either open, PSK or enterprise mode
- pre-shared key does not provide individual
authentication.
- Open mode doesn’t use any security and allows all
users to access the AP.

• Enterprise mode is more secure than
  Personal mode, and it provides strong authentication.
• Enterprise mode uses an 802.1X server (implemented as a RADIUS server) to
  add authentication.

Question 2

WPA3

Answer 2

Newest wireless encryption
Uses Simultaneous authentication of equals( SAE) instead of PSK like WPA2
Replacement for WPA2
offers better security when setting up wifi protected setup (WPS)
supports better enterprise mode but still uses radius server like to authenticate like WPA2

Question 3

EAP

Answer 3

Extensible authentication Protocol

An authentication framework used to provide guidance on authentication methods
802.1X servers use this for to increase authentication security

Question 4

PEAP & EAP TTLS

Answer 4

Protected EAP and tunneled TLS

Requires a certificate on the 802.1x server but not on the clients

Question 5

EAP-FAST

Answer 5

Supports certificates but are optional

Question 6

EAP-TLS

Answer 6

Requires certificates on both the 802.1x server and each of the clients

Question 7

802.1x server

Answer 7

An 802.1X server provides port-based authentication, ensuring that
only authorized clients can connect to a device or a network. It
prevents rogue devices from connecting

Question 8

PAP

Answer 8

Password authentication protocol
is used with point-to-point (PPP) to authenticate clients
sends information across the network in cleartext

Question 9

CHAP

Answer 9

Challenge handshake authentication protocol (CHAP)
uses PPP to authenticate remote users, more secure than PAP
doesn’t send passwords over the network in cleartext

Question 10

RADIUS AAA Protocol

Answer 10

Remote Authentication Dial-In User Service
centralized authentication service that can act as 802.1x server with enterpise mode
Database of user accounts to authenticate users
Cab use EAP to encrypt entire session

Question 11

TACACS+ AAA protocol

Answer 11

Terminal Access Controller Access-control system plus

• alternative to Radius, created by CISCO
• The benefit over RADIUS is that can encrypt entire sessions by defualt whereas RADIUS only encrypts the password by default.
• Can be used with kerberos