CWSP-208 Dumps PDF 2026 Program Your Preparation EXAM SUCCESS
Get Perfect Results with Premium CWSP-208 Dumps Updated 122 Questions
NEW QUESTION # 51
Wireless Intrusion Prevention Systems (WIPS) are used for what purposes? (Choose 3)
- A. Performance monitoring and troubleshooting
- B. Enforcing wireless network security policy
- C. Classifying wired client devices
- D. Preventing physical carrier sense attacks
- E. Security monitoring and notification
- F. Detecting and defending against eavesdropping attacks
Answer: A,B,E
Explanation:
WIPS provides multiple functionalities:
B). Policy enforcement - detects and responds to wireless threats such as rogue APs and misconfigurations.
D). Security monitoring - alerts staff when threats like deauth attacks or malware-hosting APs are detected.
A). Performance monitoring - supports diagnostics by capturing information on channel conditions, interference, and device behavior.
Incorrect options:
C). Detecting eavesdropping isn't feasible-passive listening cannot be identified by sensors.
E). Carrier sense DoS and F. Wired device classification are outside WIPS's scope.
References:
CWSP#207 Study Guide, Chapters 5-6 (WIPS Capabilities)
NEW QUESTION # 52
What WLAN client device behavior is exploited by an attacker during a hijacking attack?
- A. When the RF signal between a client and an access point is disrupted for more than a few seconds, the client device will attempt to associate to an access point with better signal quality.
- B. Client drivers scan for and connect to access points in the 2.4 GHz band before scanning the 5 GHz band.
- C. As specified by the Wi-Fi Alliance, clients using Open System authentication must allow direct client- to-client connections, even in an infrastructure BSS.
- D. When the RF signal between a client and an access point is lost, the client will not seek to reassociate with another access point until the 120 second hold down timer has expired.
- E. After the initial association and 4-way handshake, client stations and access points do not need to perform another 4-way handshake, even if connectivity is lost.
Answer: A
Explanation:
Hijacking attacks often rely on exploiting client behavior during signal disruption. Clients will seek better connections when RF is weak or interrupted. An attacker may:
Disrupt the signal (e.g., with a deauth attack)
Present a rogue access point (evil twin) with stronger signal
Trick the client into associating with the rogue AP, hijacking the session Incorrect:
B). There is no standard 120-second timer behavior.
C). Loss of connectivity typically triggers reassociation and reauthentication.
D). Direct client-to-client connections are not required in infrastructure mode.
E). Band selection logic varies and is unrelated to hijacking attacks.
References:
CWSP-208 Study Guide, Chapter 5 (Hijacking and Client Behavior)
CWNP Wi-Fi Threat Analysis
NEW QUESTION # 53
In what deployment scenarios would it be desirable to enable peer-to-peer traffic blocking?
- A. In home networks in which file and printer sharing is enabled
- B. In university environments using multicast video training sourced from professor's laptops
- C. At public hot-spots in which many clients use diverse applications
- D. In corporate Voice over Wi-Fi networks with push-to-talk multicast capabilities
Answer: C
Explanation:
Peer-to-peer blocking (also called client isolation) is useful in open or public WLANs to prevent devices from communicating directly with each other.
B). In public hot-spots, isolating users helps protect against malware spread, snooping, and attacks from nearby devices.
Incorrect:
A). In home networks, peer-to-peer communication is often desired for file sharing.
C). Voice over Wi-Fi may rely on peer communication (e.g., multicast).
D). In university setups using multicast, peer-to-peer restrictions could hinder functionality.
References:
CWSP-208 Study Guide, Chapter 3 (Access Control and WLAN Policies)
CWNP WLAN Best Practices for Public Networks
NEW QUESTION # 54
Given: ABC Corporation is evaluating the security solution for their existing WLAN. Two of their supported solutions include a PPTP VPN and 802.1X/LEAP. They have used PPTP VPNs because of their wide support in server and desktop operating systems. While both PPTP and LEAP adhere to the minimum requirements of the corporate security policy, some individuals have raised concerns about MS-CHAPv2 (and similar) authentication and the known fact that MS-CHAPv2 has proven vulnerable in improper implementations.
As a consultant, what do you tell ABC Corporation about implementing MS-CHAPv2 authentication?
(Choose 2)
- A. MS-CHAPv2 uses AES authentication, and is therefore secure.
- B. When implemented with AES-CCMP encryption, MS-CHAPv2 is very secure.
- C. MS-CHAPv2 is subject to offline dictionary attacks.
- D. MS-CHAPv2 is compliant with WPA-Personal, but not WPA2-Enterprise.
- E. MS-CHAPv2 is only appropriate for WLAN security when used inside a TLS-encrypted tunnel.
- F. LEAP's use of MS-CHAPv2 is only secure when combined with WEP.
Answer: C,E
Explanation:
MS-CHAPv2 is a widely used authentication protocol, but it has notable weaknesses:
B). MS-CHAPv2 is vulnerable to offline dictionary attacks. Attackers can capture authentication exchanges and attempt password guesses offline due to predictable hashing behavior.
D). The only secure use of MS-CHAPv2 is inside a secure tunnel (e.g., EAP-TTLS or PEAP), where credentials are protected during transmission.
Incorrect:
A). MS-CHAPv2 is used in WPA2-Enterprise, not WPA-Personal, and it is allowed under WPA2-Enterprise via PEAP.
C). WEP does not enhance LEAP's security; it compounds vulnerabilities.
E and F. MS-CHAPv2 does not use AES for authentication. Using AES-CCMP for encryption does not fix MS-CHAPv2's weaknesses.
References:
CWSP-208 Study Guide, Chapter 4 (EAP Methods and Authentication Protocols) CWNP MS-CHAPv2 and PEAP Implementation Guidelines Microsoft MS-CHAPv2 Vulnerability Advisories
NEW QUESTION # 55
What statement accurately describes the functionality of the IEEE 802.1X standard?
- A. Port-based access control with EAP encapsulation over the LAN (EAPoL)
- B. Port-based access control, which allows three frame types to traverse the uncontrolled port: EAP, DHCP, and DNS.
- C. Port-based access control with dynamic encryption key management and distribution
- D. Port-based access control with mandatory support of AES-CCMP encryption
- E. Port-based access control with support for authenticated-user VLANs only
Answer: A
Explanation:
IEEE 802.1X is a port-based Network Access Control (PNAC) protocol that:
Provides authentication at the edge of the LAN (such as a wireless access point or switch port).
Encapsulates EAP messages over the LAN using the EAPoL (EAP over LAN) protocol.
This standard defines how devices are granted or denied access based on authentication status.
Incorrect:
B). Key management is part of 802.11i (not 802.1X directly).
C). VLAN assignment may occur, but it's not limited to authenticated-user VLANs.
D). AES-CCMP is a function of WPA2/802.11i, not 802.1X.
E). Only EAP is allowed over the uncontrolled port; DHCP/DNS pass only after authentication.
References:
CWSP-208 Study Guide, Chapter 4 (802.1X Framework)
IEEE 802.1X-2010 Standard
NEW QUESTION # 56
What field in the RSN information element (IE) will indicate whether PSK- or Enterprise-based WPA or WPA2 is in use?
- A. RSN Capabilities
- B. AKM Suite List
- C. Group Cipher Suite
- D. Pairwise Cipher Suite List
Answer: B
Explanation:
The AKM (Authentication and Key Management) Suite List field within the RSN Information Element defines which authentication methods are supported by the AP. This field distinguishes between PSK (Pre- Shared Key) and Enterprise (802.1X) modes:
AKM Suite OUI 00-0F-AC:1 = WPA2-Personal (PSK)
AKM Suite OUI 00-0F-AC:2 = WPA2-Enterprise (802.1X)
By examining this field in Beacon or Probe Response frames, a protocol analyzer can determine the authentication method enforced by the BSS.
References:
CWSP-208 Study Guide, Chapter 6 - RSN IE Fields and Analysis
CWNP CWSP-208 Objectives: "RSN IE Analysis" and "Authentication Methods Identification"
NEW QUESTION # 57
Given: ABC Company has recently installed a WLAN controller and configured it to support WPA2- Enterprise security. The administrator has configured a security profile on the WLAN controller for each group within the company (Marketing, Sales, and Engineering).
How are authenticated users assigned to groups so that they receive the correct security profile within the WLAN controller?
- A. The WLAN controller polls the RADIUS server for a complete list of authenticated users and groups after each user authentication.
- B. The RADIUS server sends a group name return list attribute to the WLAN controller during every successful user authentication.
- C. The RADIUS server sends the list of authenticated users and groups to the WLAN controller as part of a 4-Way Handshake prior to user authentication.
- D. The RADIUS server forwards the request for a group attribute to an LDAP database service, and LDAP sends the group attribute to the WLAN controller.
Answer: B
Explanation:
RADIUS supports dynamic policy assignment via return list attributes (e.g., Tunnel-Private-Group-ID, Class).
The WLAN controller reads this group attribute and applies the corresponding security profile (e.g., VLAN, QoS).
Incorrect:
A). The controller does not poll the RADIUS server.
C). LDAP may support group info, but RADIUS mediates it for WLAN usage.
D). Group attributes are not sent during the 4-Way Handshake-it occurs after EAP success.
References:
CWSP-208 Study Guide, Chapter 6 (Role-Based Access Control and RADIUS Policy Assignment)
NEW QUESTION # 58
You have been recently hired as the wireless network administrator for an organization spread across seven locations. They have deployed more than 100 APs, but they have not been managed in either an automated or manual process for more than 18 months. Given this length of time, what is one of the first things you should evaluate from a security perspective?
- A. The VLANs in use
- B. The channels in use
- C. The channel widths configured
- D. The firmware revision
Answer: D
Explanation:
In a security context, outdated firmware is one of the most critical vulnerabilities. Firmware updates typically patch known security issues, fix bugs, and provide new features or improved encryption support. If the APs have not been updated or checked in over 18 months, they could be running firmware with known exploits or lacking critical security patches, making firmware review a top priority.
References:
CWSP-208 Study Guide, Chapter 8 - WLAN Security Lifecycle and Maintenance CWNP CWSP-208 Objectives: "Firmware and Security Patch Management"
NEW QUESTION # 59
Given: You have implemented strong authentication and encryption mechanisms for your enterprise 802.11 WLAN using 802.1X/EAP with AES-CCMP.
For users connecting within the headquarters office, what other security solution will provide continuous monitoring of both clients and APs with 802.11-specific tracking?
- A. IPSec VPN client and server software
- B. RADIUS proxy server
- C. Internet firewall software
- D. Wireless intrusion prevention system
- E. WLAN endpoint agent software
Answer: D
Explanation:
In integrated WIPS systems, radios are shared between client servicing and security scanning. To maintain quality of service for latency-sensitive applications such as VoWiFi (Voice over Wi-Fi), scanning operations may be temporarily suspended or deprioritized, potentially reducing security monitoring during those periods.
References:
CWSP-208 Study Guide, Chapter 7 - Integrated WIPS Tradeoffs
CWNP CWSP-208 Objectives: "Integrated WIPS Behavior and Performance Impact"
NEW QUESTION # 60
Given: Fred works primarily from home and public wireless hot-spots rather than commuting to the office. He frequently accesses the office network remotely from his Mac laptop using the local 802.11 WLAN.
In this remote scenario, what single wireless security practice will provide the greatest security for Fred?
- A. Use an IPSec VPN for connectivity to the office network
- B. Use only HTTPS when agreeing to acceptable use terms on public networks
- C. Use WIPS sensor software on the laptop to monitor for risks and attacks
- D. Use secure protocols, such as FTP, for remote file transfers.
- E. Use enterprise WIPS on the corporate office network
- F. Use 802.1X/PEAPv0 to connect to the corporate office network from public hot-spots
Answer: A
Explanation:
When connecting over untrusted public networks:
An IPSec VPN provides encryption and authentication from the client to the corporate network.
This protects against eavesdropping, man-in-the-middle attacks, and spoofed hotspots.
Incorrect:
B). HTTPS only protects web sessions-not all traffic.
C). Enterprise WIPS at the office won't protect remote users.
D). Laptop-based WIPS software is rare and less effective than using a VPN.
E). 802.1X/PEAP is not designed for remote use over public hotspots.
F). FTP is not secure; secure alternatives include SFTP or FTPS.
References:
CWSP-208 Study Guide, Chapter 6 (VPNs and Remote Security)
CWNP Remote Access Security Best Practices
NEW QUESTION # 61
What elements should be addressed by a WLAN security policy? (Choose 2)
- A. How to prevent non-IT employees from learning about and reading the user security policy
- B. End-user training for password selection and acceptable network use
- C. The exact passwords to be used for administration interfaces on infrastructure devices
- D. Social engineering recognition and mitigation techniques
- E. Enabling encryption to prevent MAC addresses from being sent in clear text
Answer: B,D
Explanation:
A strong WLAN security policy should encompass both technical controls and user education.
C). Educating users about secure password creation and acceptable use policies helps reduce risks due to weak authentication and misuse.
E). Social engineering is a common attack vector, and educating users to recognize and report such attempts is critical.
Incorrect:
A). MAC addresses are always transmitted in the clear, even with encryption.
B). Policies should be shared with users to promote compliance and awareness.
D). Passwords for administrative systems should not be disclosed in public documentation or policy documents.
References:
CWSP-208 Study Guide, Chapter 2 (Security Policies and End-User Training) CWNP WLAN Security Policy Templates
NEW QUESTION # 62
What statement is true regarding the nonces (ANonce and SNonce) used in the IEEE 802.11 4 Way Handshake?
- A. The Supplicant uses the SNonce to derive its unique PTK and the Authenticator uses the ANonce to derive its unique PTK, but the nonces are not shared.
- B. Nonces are sent in EAPoL frames to indicate to the receiver that the sending station has installed and validated the encryption keys.
- C. Both nonces are used by the Supplicant and Authenticator in the derivation of a single PTK.
- D. The nonces are created by combining the MAC addresses of the Supplicant, Authenticator, and Authentication Server into a mixing algorithm.
Answer: C
Explanation:
The PTK derivation requires:
PMK
ANonce (generated by the Authenticator)
SNonce (generated by the Supplicant)
MAC addresses of both Authenticator and Supplicant
Both the Supplicant and Authenticator derive the same PTK using identical inputs during the 4-Way Handshake.
Incorrect:
B). The nonces are shared-each party uses both ANonce and SNonce.
C). Nonces indicate no such validation message.
D). The MACs are part of the PTK input but not used to generate the nonces themselves.
References:
CWSP-208 Study Guide, Chapter 3 (4-Way Handshake)
IEEE 802.11i Key Management Process
NEW QUESTION # 63
In the IEEE 802.11-2012 standard, what is the purpose of the 802.1X Uncontrolled Port?
- A. To block authentication traffic until the 4-Way Handshake completes
- B. To pass general data traffic after the completion of 802.11 authentication and key management
- C. To allow only authentication frames to flow between the Supplicant and Authentication Server
- D. To block unencrypted user traffic after a 4-Way Handshake completes
Answer: C
Explanation:
The 802.1X Uncontrolled Port exists before a client is fully authenticated. It:
Permits only EAP/EAPoL frames to pass between the Supplicant and the Authenticator (AP or switch).
Blocks general data traffic until authentication completes.
After authentication, the Controlled Port is opened, allowing normal data flow.
Incorrect:
B). Authentication must complete before the 4-Way Handshake, not the other way around.
C). General data traffic uses the Controlled Port, not the Uncontrolled Port.
D). The Uncontrolled Port doesn't specifically deal with encrypted or decrypted user traffic.
References:
CWSP-208 Study Guide, Chapter 4 (802.1X Port Behavior)
IEEE 802.1X Overview
NEW QUESTION # 64
Given: ABC Company is deploying an IEEE 802.11-compliant wireless security solution using 802.1X/EAP authentication. According to company policy, the security solution must prevent an eavesdropper from decrypting data frames traversing a wireless connection.
What security characteristics and/or components play a role in preventing data decryption? (Choose 2)
- A. Group Temporal Keys
- B. Multi-factor authentication
- C. Integrity Check Value (ICV)
- D. PLCP Cyclic Redundancy Check (CRC)
- E. 4-Way Handshake
- F. Encrypted Passphrase Protocol (EPP)
Answer: A,E
Explanation:
To prevent data decryption:
B). The 4-Way Handshake derives and installs unique unicast keys (PTKs) on both client and AP.
F). The GTK is used to encrypt broadcast and multicast frames, ensuring group traffic is protected.
Incorrect:
A). Multi-factor authentication enhances identity assurance but not encryption.
C). PLCP CRC checks for transmission errors but does not secure data.
D). EPP is not a valid or recognized encryption protocol.
E). ICV was used in WEP and is cryptographically weak.
References:
CWSP-208 Study Guide, Chapter 3 (Key Hierarchy and 4-Way Handshake)
IEEE 802.11i Standard
NEW QUESTION # 65
What are the three roles of the 802.1X framework, as defined by the 802.1X standard, that are performed by the client STA, the AP (or WLAN controller), and the RADIUS server? (Choose 3)
- A. AAA Server
- B. Supplicant
- C. Enrollee
- D. Registrar
- E. Authentication Server
- F. Authenticator
- G. Control Point
Answer: B,E,F
Explanation:
The IEEE 802.1X framework consists of three defined roles:
Supplicant (E): The client device (STA) that requests access to the network.
Authenticator (F): The network device (usually an AP or switch) that enforces access control and acts as an intermediary between the supplicant and the authentication server.
Authentication Server (D): Typically a RADIUS server that validates credentials and responds with access decisions.
Incorrect:
A & B. Enrollee and Registrar are roles in Wi-Fi Protected Setup (WPS), not 802.1X.
C). AAA Server is a broader term; the specific role in 802.1X is "Authentication Server." G). "Control Point" is not a formal 802.1X role.
References:
CWSP-208 Study Guide, Chapter 4 (802.1X Authentication Roles)
NEW QUESTION # 66
Given: Your network implements an 802.1X/EAP-based wireless security solution. A WLAN controller is installed and manages seven APs. FreeRADIUS is used for the RADIUS server and is installed on a dedicated server named SRV21. One example client is a MacBook Pro with 8 GB RAM.
What device functions as the 802.1X/EAP Authenticator?
- A. RADIUS server
- B. MacBook Pro
- C. WLAN Controller/AP
- D. SRV21
Answer: C
Explanation:
Comprehensive Detailed Explanation:
In the 802.1X/EAP framework:
The Authenticator is the device that controls access to the network - typically the AP or WLAN controller.
The Authenticator passes EAP messages between the Supplicant (client) and the Authentication Server (RADIUS).
Incorrect:
A). SRV21 is the RADIUS server (Authentication Server), not the Authenticator.
C). The MacBook Pro is the Supplicant.
D). RADIUS server handles Authentication, not Authenticator functionality.
References:
CWSP-208 Study Guide, Chapter 4 (802.1X Architecture Roles)
CWNP AAA and Authentication Design
NEW QUESTION # 67
What EAP type supports using MS-CHAPv2, EAP-GTC or EAP-TLS for wireless client authentication?
- A. EAP-TTLS
- B. PEAP
- C. LEAP
- D. H-REAP
- E. EAP-GTC
Answer: A
Explanation:
EAP-TTLS (Tunneled Transport Layer Security) supports flexible inner authentication methods including:
MS-CHAPv2
EAP-GTC (Generic Token Card)
EAP-TLS (in some configurations)
This versatility allows EAP-TTLS to be used with a wide range of back-end authentication systems, while only requiring a server-side certificate.
Incorrect:
A). H-REAP (now FlexConnect) is a Cisco AP deployment mode, not an EAP type.
B). EAP-GTC is a simple authentication method and not a tunnel or container for others.
D). PEAP typically supports MS-CHAPv2 but not EAP-GTC or EAP-TLS as inner methods.
E). LEAP uses MS-CHAPv1 and is considered deprecated and insecure.
References:
CWSP-208 Study Guide, Chapter 4 (EAP Methods)
NEW QUESTION # 68
What preventative measures are performed by a WIPS against intrusions?
- A. ASLEAP attack against a rogue AP
- B. Evil twin attack against a rogue AP
- C. EAPoL Reject frame flood against a rogue AP
- D. Deauthentication attack against a classified neighbor AP
- E. Uses SNMP to disable the switch port to which rogue APs connect
Answer: E
Explanation:
Wireless Intrusion Prevention Systems (WIPS) can proactively respond to detected threats using various techniques. One such preventative measure is integration with the wired infrastructure to mitigate rogue APs by disabling the switch port they are connected to. This is typically done through SNMP or other switch management interfaces.
This form of wired-side containment is more secure and compliant than wireless-side attacks (e.g., deauthentication), which can violate regulations in some jurisdictions.
References:
CWSP-208 Study Guide, Chapter 7 - WIPS Architecture and Countermeasures CWNP CWSP-208 Exam Objectives: "WIPS Prevention and Containment Techniques"
NEW QUESTION # 69
Given: XYZ Company has recently installed a controller-based WLAN and is using a RADIUS server to query authentication requests to an LDAP server. XYZ maintains user-based access policies and would like to use the RADIUS server to facilitate network authorization.
What RADIUS features could be used by XYZ to assign the proper network permissions to users during authentication? (Choose 2)
- A. The RADIUS server can support vendor-specific attributes in the ACCESS-ACCEPT response, which can be used for user policy assignment.
- B. RADIUS can send a DO-NOT-AUTHORIZE demand to the authenticator to prevent the STA from gaining access to specific files, but may only employ this in relation to Linux servers.
- C. RADIUS attributes can be used to assign permission levels, such as read-only permission, to users of a particular network resource.
- D. RADIUS can reassign a client's 802.11 association to a new SSID by referencing a username-to-SSID mapping table in the LDAP user database.
- E. The RADIUS server can communicate with the DHCP server to issue the appropriate IP address and VLAN assignment to users.
Answer: A,C
Explanation:
Comprehensive Detailed Explanation:
B). Vendor-Specific Attributes (VSAs) allow integration with WLAN vendors' controllers to assign roles, VLANs, QoS levels, etc., during user authentication.
E). Standard or vendor-specific RADIUS attributes can dynamically assign permission levels based on group membership, department, or role.
Incorrect:
A). RADIUS does not directly manage DHCP functions.
C). SSID is selected by the user's device, not by the RADIUS server.
D). RADIUS uses ACCESS-REJECT, not "DO-NOT-AUTHORIZE," and it is not OS-specific.
References:
CWSP-208 Study Guide, Chapter 4 (RADIUS and Policy Assignment)
CWNP RADIUS Deployment Best Practices
NEW QUESTION # 70
ABC Company uses the wireless network for highly sensitive network traffic. For that reason, they intend to protect their network in all possible ways. They are continually researching new network threats and new preventative measures. They are interested in the security benefits of 802.11w, but would like to know its limitations.
What types of wireless attacks are protected by 802.11w? (Choose 2)
- A. Robust management frame replay attacks
- B. Social engineering attacks
- C. Layer 2 Disassociation attacks
- D. RF DoS attacks
Answer: A,C
Explanation:
802.11w, also known as Protected Management Frames (PMF), is designed to protect specific types of 802.11 management frames such as disassociation and deauthentication frames. These frames were previously sent unencrypted and could be spoofed by attackers to disconnect clients (DoS attacks). With 802.11w, these frames are cryptographically protected, mitigating such attacks.
PMF also includes replay protection for these management frames, preventing attackers from capturing and replaying them to disrupt network connectivity.
References:
CWSP-208 Study Guide, Chapter 6 (Wireless LAN Security Solutions)
IEEE 802.11w-2009 amendment
CWNP Whitepapers on PMF and Management Frame Protection
NEW QUESTION # 71
In order to acquire credentials of a valid user on a public hot-spot network, what attacks may be conducted?
Choose the single completely correct answer.
- A. Authentication cracking and/or RF DoS
- B. Social engineering and/or eavesdropping
- C. MAC denial of service and/or physical theft
- D. Code injection and/or XSS
- E. RF DoS and/or physical theft
Answer: B
Explanation:
Comprehensive Detailed Explanation:
On public Wi-Fi hotspots (typically unsecured), attackers often perform:
Eavesdropping: By passively listening to unencrypted traffic, an attacker can capture credentials or sensitive data.
Social engineering: Users may be tricked into entering their credentials on a spoofed login page or disclosing them directly through phishing or manipulation.
These are the most effective and common methods for credential theft in open network environments.
Incorrect:
B & C. Physical theft is not network-based and not relevant to hotspot-based credential acquisition.
D). Authentication cracking is not applicable to open networks with captive portals.
E). Code injection/XSS may happen in web apps but are not directly methods for acquiring hotspot credentials.
References:
CWSP-208 Study Guide, Chapter 5 (Threats and Attacks)
CWNP Security Essentials: Eavesdropping and Social Engineering in WLANs
NEW QUESTION # 72
Given: In a security penetration exercise, a WLAN consultant obtains the WEP key of XYZ Corporation's wireless network. Demonstrating the vulnerabilities of using WEP, the consultant uses a laptop running a software AP in an attempt to hijack the authorized user's connections. XYZ's legacy network is using 802.11 n APs with 802.11b, 11g, and 11n client devices.
With this setup, how can the consultant cause all of the authorized clients to establish Layer 2 connectivity with the software access point?
- A. When the RF signal between the clients and the authorized AP is temporarily disrupted and the consultant's software AP is using the same SSID on a different channel than the authorized AP, the clients will reassociate to the software AP.
- B. A higher SSID priority value configured in the Beacon frames of the consultant's software AP will take priority over the SSID in the authorized AP, causing the clients to reassociate.
- C. All WLAN clients will reassociate to the consultant's software AP if the consultant's software AP provides the same SSID on any channel with a 10 dB SNR improvement over the authorized AP.
- D. If the consultant's software AP broadcasts Beacon frames that advertise 802.11g data rates that are faster rates than XYZ's current 802.11b data rates, all WLAN clients will reassociate to the faster AP.
Answer: A
Explanation:
Clients seek connectivity when their connection is lost. If the attacker broadcasts a matching SSID on a different channel and the client is disconnected (via RF jamming or deauthentication), the client will often reassociate with the stronger signal or first-responding AP broadcasting the same SSID, even if it's rogue.
Incorrect:
A). SNR alone doesn't force reassociation-clients consider multiple factors.
B). SSID priority is not a standardized field influencing client behavior.
D). Clients won't reassociate based purely on advertised data rates unless connectivity is disrupted and other AP parameters are more attractive.
References:
CWSP-208 Study Guide, Chapter 5 (Hijacking and Evil Twin Attacks)
CWNP Roaming Behavior and Signal Loss Analysis
IEEE 802.11-2016 Standard (Association and Reassociation Behavior)
NEW QUESTION # 73
Given: WLAN protocol analyzers can read and record many wireless frame parameters.
What parameter is needed to physically locate rogue APs with a protocol analyzer?
- A. Noise floor
- B. IP Address
- C. BSSID
- D. RSN IE
- E. SSID
- F. Signal strength
Answer: F
Explanation:
While BSSID and SSID help identify and classify rogue APs, physically locating them requires using signal strength (often displayed as RSSI or dBm). By measuring signal strength from different locations, administrators can use a method called "triangulation" or "directional analysis" to approximate the physical location of the rogue device.
References:
CWSP-208 Study Guide, Chapter 6 - WLAN Protocol Analysis and Troubleshooting CWNP CWSP-208 Objectives: "Rogue Device Location and Tracking"
NEW QUESTION # 74
What 802.11 WLAN security problem is directly addressed by mutual authentication?
- A. Wireless hijacking attacks
- B. Disassociation attacks
- C. MAC spoofing
- D. Weak Initialization Vectors
- E. Offline dictionary attacks
- F. Weak password policies
Answer: A
Explanation:
Mutual authentication involves both the client and the authentication server verifying each other's identity before network access is granted. This prevents attackers from spoofing an access point (AP) and luring clients to connect to rogue APs (often used in wireless hijacking or evil twin attacks). When mutual authentication (typically via 802.1X with EAP-TLS) is used, clients will not connect unless they can verify the server certificate, which thwarts hijacking attempts.
References:
CWSP-208 Study Guide, Chapter 4 (Authentication and Access Control)
CWNP E-Learning: 802.1X and EAP Authentication Framework
IEEE 802.1X and WPA2-Enterprise concepts
NEW QUESTION # 75
......
CWSP-208 PDF Dumps Extremely Quick Way Of Preparation: https://pass4sure.actualpdf.com/CWSP-208-real-questions.html
