CWSP-207 Certified Wireless Security Professional (CWSP) Practice Questions

This attack is known as an Association Flood. It is a Layer 2 Denial of Service (DoS) attack that targets the resources of an access point by overwhelming it with forged Association Request frames. By exhausting the AP's client association table, it prevents legitimate clients from connecting. RF Jamming is a Layer 1 attack. A Deauthentication Flood targets connected clients, not the AP's association table. An ARP spoofing attack is a man-in-the-middle attack.

Network Access Control (NAC) is the technology designed for this purpose. A NAC solution performs 'posture assessment' on devices attempting to connect to the network. It checks for compliance with security policies, such as having a specific OS patch level, antivirus definitions, or firewall status. If a device is non-compliant, the NAC solution can place it into a quarantined VLAN for remediation. While MDM is used to manage the device and can push policies, NAC is the gatekeeper that enforces access based on the device's health state.

This statement is false. The 802.11 connection process follows a specific order. The client must first successfully authenticate (Open System or, in the case of 802.1X, complete the EAP exchange) and then associate with the access point. Only after a successful association does the 4-way handshake begin to derive and install the temporal keys (PTK and GTK) used for encrypting data frames.

TKIP was designed as a transitional protocol to fix the flaws in WEP without requiring new hardware. However, it is based on the same underlying RC4 stream cipher as WEP. Over time, significant cryptographic weaknesses were discovered in RC4 that could be exploited to decrypt traffic or inject malicious packets. For this reason, the Wi-Fi Alliance has deprecated TKIP, and the 802.11 standard mandates that CCMP/AES be used for robust security. While the data rate limitation is a side effect, the core issue is the fundamental cryptographic weakness.

The log message michael_mic_failure is specific to the TKIP encryption protocol. The Message Integrity Code (MIC), codenamed Michael, is used to protect against packet forgery. If an AP receives a frame with an invalid MIC, it logs a failure. As a countermeasure against active attacks, if two MIC failures are detected within 60 seconds, the AP will shut down the BSS for 60 seconds, deauthenticating all clients. This behavior indicates a potential attack on the network.

WPA3-Enterprise with EAP-TLS is the strongest combination. EAP-TLS uses client-side and server-side certificates for mutual authentication, providing device-specific credentials that cannot be easily shared. This meets the stringent requirements of PCI-DSS. WPA3-Personal uses a shared key, which violates the device-specific credential requirement. EAP-PEAP uses a server-side certificate but relies on username/password credentials inside the tunnel, which are weaker than certificates. OWE is designed for unauthenticated encryption on open networks, not for corporate authentication.

The 802.11w amendment introduces Protected Management Frames (PMF), also known as Management Frame Protection (MFP). This feature cryptographically protects certain management frames, including Disassociation and Deauthentication frames, preventing attackers from spoofing them to launch denial-of-service attacks. 802.11r is for fast roaming, 802.11k provides radio measurement information, and 802.11e provides Quality of Service (QoS).

The WPA3-SAE (Simultaneous Authentication of Equals) handshake, also known as the Dragonfly handshake, relies on both the client and the AP knowing the same pre-shared key (password). The Commit and Confirm frames are part of a key exchange process that will only succeed if both parties start with the same password. A mismatch will cause the cryptographic checks within the handshake to fail, preventing the establishment of a Pairwise Master Key (PMK) and subsequent association. SAE does not use certificates or a RADIUS server.

The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). In this scenario, the SLE is $500,000. The ARO is the frequency of the event per year, which is once every ten years, or 1/10 = 0.1. Therefore, ALE = SLE * ARO = $500,000 * 0.1 = $50,000.