CWSP-207 Certified Wireless Security Professional (CWSP) Questions and Answers

Man-in-the-Middle

Wi-Fi phishing

Management interface exploits

UDP port redirection

IGMP snooping

All integrated 802.11ac adapters will work with most protocol analyzers for frame capture, including the Radio Tap Header.

Integrated 802.11ac adapters are not typically compatible with protocol analyzers in Windows laptops. It is often best to use a USB adapter or carefully select a laptop with an integrated adapter that will work.

Laptops cannot be used to capture 802.11ac frames because they do not support MU-MIMO.

Only Wireshark can be used to capture 802.11ac frames as no other protocol analyzer has implemented the proper frame decodes.

The only method available to capture 802.11ac frames is to perform a remote capture with a compatible access point.

When the RF signal between a client and an access point is disrupted for more than a few seconds, the client device will attempt to associate to an access point with better signal quality.

When the RF signal between a client and an access point is lost, the client will not seek to reassociate with another access point until the 120 second hold down timer has expired.

After the initial association and 4-way handshake, client stations and access points do not need to perform another 4-way handshake, even if connectivity is lost.

As specified by the Wi-Fi Alliance, clients using Open System authentication must allow direct client-to-client connections, even in an infrastructure BSS.

Client drivers scan for and connect to access points in the 2.4 GHz band before scanning the 5 GHz band.

Weak-IV

Forgery

Replay

Bit-flipping

Session hijacking

RF DoS attacks

Layer 2 Disassociation attacks

Robust management frame replay attacks

Social engineering attacks

MS-CHAPv2 is compliant with WPA-Personal, but not WPA2-Enterprise.

MS-CHAPv2 is subject to offline dictionary attacks.

LEAP’s use of MS-CHAPv2 is only secure when combined with WEP.

MS-CHAPv2 is only appropriate for WLAN security when used inside a TLS-encrypted tunnel.

MS-CHAPv2 uses AES authentication, and is therefore secure.

When implemented with AES-CCMP encryption, MS-CHAPv2 is very secure.

2, 3, 4, 1

1, 2, 3, 4

4, 3, 1, 2

3, 4, 1, 2

All WIPS sensors must be installed as dual-purpose (AP/sensor) devices.

A location chipset (GPS) must be installed with it.

At least six antennas must be installed in each sensor.

The RF environment must be sampled during an RF calibration process.

AKM Suite List

Group Cipher Suite

RSN Capabilities

Pairwise Cipher Suite List

Use a WPA2-Enterprise compliant security solution with strong mutual authentication and encryption for network access of corporate devices.

Hide the SSID of all legitimate APs on the network so that intruders cannot copy this parameter on rogue APs.

Conduct thorough manual facility scans with spectrum analyzers to detect rogue AP RF signatures.

A trained employee should install and configure a WIPS for rogue detection and response measures.

Enable port security on Ethernet switch ports with a maximum of only 3 MAC addresses on each port.

Awareness of the exact vendor devices being installed

Management support for the process

End-user training manuals for the policies to be created

Security policy generation software

Enabling encryption to prevent MAC addresses from being sent in clear text

How to prevent non-IT employees from learning about and reading the user security policy

End-user training for password selection and acceptable network use

The exact passwords to be used for administration interfaces on infrastructure devices

Social engineering recognition and mitigation techniques

In home networks in which file and printer sharing is enabled

At public hot-spots in which many clients use diverse applications

In corporate Voice over Wi-Fi networks with push-to-talk multicast capabilities

In university environments using multicast video training sourced from professor’s laptops

MSCHAPv2 passwords used with EAP/PEAPv0 should be stronger than typical WPA2-PSK passphrases.

Password complexity should be maximized so that weak WEP IV attacks are prevented.

Static passwords should be changed on a regular basis to minimize the vulnerabilities of a PSK-based authentication.

Certificates should always be recommended instead of passwords for 802.11 client authentication.

EAP-TLS must be implemented in such scenarios.

Require Port Address Translation (PAT) on each laptop.

Require secure applications such as POP, HTTP, and SSH.

Require VPN software for connectivity to the corporate network.

Require WPA2-Enterprise as the minimal WLAN security solution.

Migrate corporate data clients to WPA-Enterprise and segment Voice over Wi-Fi phones by assigning them to a different frequency band.

Migrate corporate data and Voice over Wi-Fi devices to WPA2-Enterprise with fast secure roaming support, and segment Voice over Wi-Fi data on a separate VLAN.

Migrate to a multi-factor security solution to replace IPSec; use WEP with MAC filtering, SSID hiding, stateful packet inspection, and VLAN segmentation.

Migrate all 802.11 data devices to WPA-Personal, and implement a secure DHCP server to allocate addresses from a segmented subnet for the Voice over Wi-Fi phones.

X.509 certificates

User credentials

Server credentials

RADIUS shared secret

The client will be the authenticator in this scenario.

The client STAs must use a different, but complementary, EAP type than the AP STAs.

The client STAs may communicate over the uncontrolled port in order to authenticate as soon as Open System authentication completes.

The client STAs may communicate over the controlled port in order to authenticate as soon as the Open System authentication completes.

WEP

RC4

CCMP

WPA2

The PTK is a type of master key used as an input to the GMK, which is used for encrypting multicast data frames.

The PTK contains keys that are used to encrypt unicast data frames that traverse the wireless medium.

The PTK is XOR'd with the PSK on the Authentication Server to create the AAA key.

The PTK is used to encrypt the Pairwise Master Key (PMK) for distribution to the 802.1X Authenticator prior to the 4-Way Handshake.

Configure WPA2-Enterprise security on the access point

Block TCP port 25 and 80 outbound on the Internet router

Require client STAs to have updated firewall and antivirus software

Allow only trusted patrons to use the WLAN

Use a WIPS to monitor all traffic and deauthenticate malicious stations

Implement a captive portal with an acceptable use disclaimer

They are used to pad Message 1 and Message 2 so each frame contains the same number of bytes.

The IEEE 802.11 standard requires that all encrypted frames contain a nonce to serve as a Message Integrity Check (MIC).

They are added together and used as the GMK, from which the GTK is derived.

They are input values used in the derivation of the Pairwise Transient Key.

They allow the participating STAs to create dynamic keys while avoiding sending unicast encryption keys across the wireless medium.

EAP-FAST

EAP-MD5

EAP-TLS

PEAPv0/EAP-MSCHAPv2

EAP-TTLS

PEAPv1/EAP-GTC

Implement an SSID with WPA2-Personal that allows both AES-CCMP and TKIP clients to connect.

Implement an SSID with WPA-Personal that allows both AES-CCMP and TKIP clients to connect.

Implement two separate SSIDs on the AP—one for WPA-Personal using TKIP and one for WPA2-Personal using AES-CCMP.

Implement an SSID with WPA2-Personal that sends all broadcast traffic using AES-CCMP and unicast traffic using either TKIP or AES-CCMP.