Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CWNA > Chapter 13. > Flashcards

Chapter 13. Flashcards

1
Q

What did 802.11i bring?

A

Robust Wireless Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 5 categories of wireless security?

A 
Data privacy and integrity
Authentication, authorization, and accounting (AAA)
Segmentation
Monitoring
Policy
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a cipher?

A

An algorithm used to perform encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which the best cipher to use for wireless?

A

AES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is AES?

A

A block cipher much stronger than RC4. Uses Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What amendment introduced protection for authentication and association frames?

A

802.11w

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What happened to the 802.11 data frame if data encryption is enabled?

A

If data encryption is enabled, the MAC Service Data Unit (MSDU) inside the body of any 802.11 data frame is protected by layer 2 encryption. Most of the encryption methods discussed in this chapter use layer 2 encryption, which is used to protect the layer 3–7 information found inside the body of an 802.11 data frame.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is authentication? Give an example.

A

Authentication is the verification of identity and credentials. Users or devices must identify themselves and present credentials, such as usernames and passwords or digital certificates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is authorization? Give an example.

A

Authorization determines if the device or user is authorized to have access to network resources. This can include identifying whether you can have access based upon the type of device you are using (laptop, tablet, or phone), time of day restrictions, or location. Before authorization can be determined, proper authentication must occur.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is accounting?

A

Accounting is tracking the use of network resources by users and devices. It is an important aspect of network security, used to keep a historical trail of who used what resource, when, and where.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is segmentation and give examples as to how they would be segmented?

A

Segmentation is separating user traffic within a network. VLANS are used to segment the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is open systems authentication?

A

Basically insures that both devices are 802.11. Authenticates the devices not the users. How does it work?

Open System authentication provides authentication without performing any type of
user verification. It is essentially a two-way exchange between the client radio and the
access point:
1. The client sends an authentication request.
2. The access point then sends an authentication response.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What cipher did WEP use?

A

RC4.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How long is a MAC address?

A

12 digit hexadecimal.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What happens when you cloak your SSID?

A

When you implement a closed network, the SSID field in the beacon frame is null (empty), and therefore passive scanning will not reveal the SSID to client stations that are listening to beacons.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Does cloaking your SSID also hide you from active scanning?

A

Yes it does, because the request probes will have a null SSID. The AP will then respond with a null SSID field, or will be ignored. AP will only respond to clients that are trusted or have associated before and their SSID field is filled with the correct SSID and not null.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How are hidden networks, with masked ID’s discovered?

A

By using a layer 2 scanning tool or protocol analyzer and listening to the CLIENTS send data\control frames to the AP.

18
Q

What is the most common wireless authentication method used in small businesses?

A

PSK or private shared key.

19
Q

What is the default encryption method for 802.11 - 2012?

A

CCMP/AES encryption is the default encryption method

20
Q

When 802.11i was ratified what certification was given to devices that where compliant?

A

WPA2 certification. WPA2 is a more complete implementation of the 802.11i amendment and supports both CCMP/AES and TKIP/RC4 dynamic encryption-key generation.

21
Q

What happens during a client interaction on a robust security configured network? When the clients first communicate?

A 
Two stations (STAs) must authenticate and
associate with each other, as well as create dynamic encryption keys through a process known as the 4-Way Handshake. This association between two stations is referred to as an RSNA. In other words, any two radios must share dynamic encryption keys that are unique between those two radios.
22
Q

An RSN can be identified by what field in a frame? What is the name of this field?

A

An RSN can be identified by a feld found in beacons, probe response frames, association request frames, and reassociation request frames. This field is known as the RSN Information Element (IE). This feld may identify the cipher suite capabilities of each station.

23
Q

What is an authentication and key management protocol (AKMP)? and where is it used?

A

A system that require both authentication processes and the generation and management of encryption keys. Can be either a preshared (PSK) or an EAP protocol used during 802.1X authentication.

24
Q

What are some ways that vendors are combating the issues with wireless preshared keys?

A

Creating databases that each user can have his\her own password. Simpler then setting up a radius server.

25
Q

What are the 3 components that 802.11x is made of?

A

Supplicant - A host with software that requests authentication and access to network resources is known as a supplicant. Each supplicant has unique authentication credentials that are verified by the authentication server.

Authenticator - An authenticator device blocks traffic or allows traffic to pass through its port entity. This allows or blocks traffic using 2 virtual ports…uncontroller which allows EAP authentication traffic to pass through, and the controlled port blocks all other traffic until supplicant has been authenticated.

Authentication Server (AS) - he authentication server validates the credentials of the supplicant that is requesting access and notifies the authenticator that the supplicant has been authorized.

26
Q

What is EAP? What are the 2 ways that authentication occurs? How does it work?

A

Extensible Authentication Protocol. EAP is a layer 2 protocol that is very flexible.
Mutual authentication - Mutual authentication not only requires that the authentication server validate the client credentials, but the supplicant must also authenticate the validity of the authentication server. By validating the authentication server, the supplicant can ensure that the username and password are not inadvertently given to a rogue authentication server. A root certificate is installed on the RADIUS server and a CA cert is installed on the clients.

27
Q

What part of the security triangle does EAP and 802.1X satisfy?

A

Authentication and Authorization

28
Q

What is the 4 way handshake?

A 
Two stations (STAs) must establish a procedure to authenticate and associate with each other as well as
create dynamic encryption keys through a process. These final keys are created during a four-way EAP frame exchange that is known as the 4-Way Handshake.
29
Q

What is a Group Master Key (GMK) and the Pairwise Master Key (PMK)

A

Part of the RSNA process involves the creation of two

master keys.

30
Q

What is a PMK (Pairwise Master Key)

A

The PMK is created as a result of the 802.1X/EAP authentication. These master keys are the seeding material used to create the final dynamic keys that are used for encryption and decryption.

31
Q

What is a Pairwise Transient Key

PTK

A

The PTK is used to encrypt/decrypt unicast

traffc, and the GTK is used to encrypt/decrypt broadcast and multicast traffic.

32
Q

What is PSK and how does it work?

A

his method involves manually typing matching passphrases on both the access point and all client stations that will need to be able to associate to the wireless network. A formula is run that converts the
passphrase to a Pairwise Master Key (PMK) used with the 4-Way Handshake to create the final dynamic encryption keys.

33
Q

What is TKIP?

A

The optional encryption method defned for a robust security network is Temporal Key Integrity Protocol (TKIP). This method uses the RC4 cipher just as WEP encryption does. As a matter of fact, TKIP is an enhancement of WEP encryption that addresses many of the known weaknesses of WEP. The problem with WEP was not the RC4 cipher but how the encryption
key was created. TKIP was developed to rectify the problems that were inherent in WEP.

34
Q

Why does TKIP slow down wireless significantly?

A

Because of the additional overhead used. A total of 20 bytes of overhead is added to the body of an 802.11 data frame.

35
Q

What does CCMP stand for?

A

Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP).

36
Q

What cipher does CCMP use?

A

AES.

37
Q

What is the key size for CCMP?

A

CCMP/AES uses a 128-bit encryption-key size and encrypted in 128-bit fixed-length blocks.

38
Q

What is the added overhead cost for using CCMP and what is that downside?

A

CCMP/AES encryption will add an extra 16 bytes of overhead to the body of an 802.11 data frame. Because the AES cipher is processor intensive, older legacy 802.11 devices do not have the processing power necessary to perform AES calculations.

39
Q

How would you get your users to use a single SSID but still be separated into VLANS based on roles?

A

Using a RADIUS server, RADIUS attributes can be leveraged for VLAN assignment when using 802.1X authentication on the employee SSID. When
a RADIUS server provides a successful response to an authentication request, the ACCESS-ACCEPT response can contain a series of attribute-value pairs (AVPs). One of the most popular uses of RADIUS AVPs is assigning users to VLANs dynamically, Based on the identity of the authenticating user.

40
Q

How does SSL VPN work?

A

The traffic between the web browser and the SSL VPN server is encrypted with the SSL protocol or Transport Layer Security (TLS). TLS and SSL encrypt data connections above the Transport layer, using
asymmetric cryptography for privacy and a keyed message authentication code for message reliability.

41
Q

What is one of the primary reasons behind a captive portal?

A

One of the most important aspects of the captive web portal page is the legal disclaimer. A good legal disclaimer informs the guest users about acceptable behavior while using the guest WLAN. Businesses are also legally protected if something bad should happen to a guest user’s WLAN device, such as being
infected by a computer virus.

42
Q

What is a captive portal?

A

Most hotspots and guest networks are secured by a captive portal. A captive portal is essentially the integration of a firewall with an authentication web page. When a user connects to the guest network, whether wired or wireless, any packets that the user transmits are intercepted and blocked from accessing a gateway to the network resources until the user has authenticated through the captive portal.

CWNA (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions