You are the network administrator for ABC Company. Your manager has recently attended a wireless security seminar. The seminar speaker taught that a wireless network could be hidden from potential intruders if you disabled the broadcasting of the SSID in Beacons and configured the access points not to respond to Probe Request frames that have a null SSID field.Your manager suggests implementing these security practices. What response should you give to this suggestion?
Answer(s): A
The response that you should give to your manager's suggestion of implementing the security practices of disabling the broadcasting of the SSID in Beacons and configuring the access points not to respond to Probe Request frames that have a null SSID field is that any 802.11 protocol analyzer can see the SSID in clear text in frames other than Beacons frames. This negates any security benefit of trying to hide the SSID in Beacons and Probe Response frames. The SSID (Service Set Identifier) is a human-readable name that identifies a WLAN and allows users to connect to it. The SSID is transmitted in clear text in several types of 802.11 frames, such as Beacon frames, Probe Request frames, Probe Response frames, Association Request frames, Association Response frames, Reassociation Request frames, and Reassociation Response frames. Some people may think that hiding the SSID can improve the security of the WLAN by making it invisible to potential intruders. However, this is not true, as hiding the SSID only removes it from Beacon frames and Probe Response frames that have a null SSID field. The SSID is still present in other types of frames that can be easily captured and analyzed by any 802.11 protocol analyzer or wireless scanner tool. Therefore, hiding the SSID does not provide any real security benefit and may even cause some compatibility and performance issues for legitimate users.
1, Chapter 4, page 133; 2, Section 4.1
What cipher suite is specified by the 802.11-2016 standard and is not deprecated?
Answer(s): C
The cipher suite specified by the 802.11-2016 standard and is not deprecated is Counter Mode with CBC-MAC Protocol (CCMP). CCMP is an encryption protocol that uses Advanced Encryption Standard (AES) as the underlying cipher and provides confidentiality, integrity, and origin authentication for wireless data. CCMP is the mandatory encryption protocol for WPA2 and WPA3.
[CWNP Certified Wireless Network Administrator Official Study Guide: Exam CWNA-109], page 295; [IEEE Standard for Information technologyTelecommunications and information exchange between systems Local and metropolitan area networksSpecific requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications], page 1560.
To ease user complexity, your company has implemented a single SSID for all employees. However, the network administrator needs a way to control the network resources that can be accessed by each employee based in their department.What WLAN feature would allow the network administrator to accomplish this task?
The WLAN feature that would allow the network administrator to control the network resources that can be accessed by each employee based on their department is Role-Based Access Control (RBAC). RBAC is a method of assigning different permissions and policies to users or groups based on their roles in the organization. RBAC can be implemented by using VLANs, ACLs, or firewalls to restrict access to certain network segments or resources. RBAC can also be integrated with 802.1X/EAP authentication to dynamically assign roles and VLANs to users based on their credentials.
[CWNP Certified Wireless Network Administrator Official Study Guide: Exam CWNA-109], page 403; [Role-Based Access Control (RBAC) in Wireless Networks], page 1.
ABC Company is planning a point-to-multipoint outdoor bridge deployment with standalone (autonomous)802.11 bridge units. 802.1X/EAP will be used for bridge authentication. A Linux-based RADIUS server will be used for authentication. What device in the bridge implementation acts as the 802.1X Authenticator?
Answer(s): D
The device in the bridge implementation that acts as the 802.1X Authenticator is the root bridge. The root bridge is the bridge that connects to the wired network and acts as the central point for all other bridges in the point-to-multipoint topology. The root bridge authenticates the non-root bridges using 802.1X/EAP and forwards their authentication requests to the RADIUS server. The non-root bridges act as the 802.1X Supplicants and use EAP methods such as EAP-TLS or EAP-PEAP to authenticate with the root bridge.
[CWNP Certified Wireless Network Administrator Official Study Guide: Exam CWNA-109], page 459; [Cisco Aironet Wireless Bridges FAQ], question 29.
You are managing a wireless access point in autonomous mode using the Web based interface. You capture traffic during this management task and notice that you can see the HTML code of the Web pages used for access point management. What error in administration could be the cause of this security concern?
The error in administration that could be the cause of this security concern is that HTTP is in use instead of HTTPS. HTTP is an unencrypted protocol that transfers data in plain text over the network. This means that anyone who captures the traffic can see the HTML code of the Web pages used for access point management, as well as any sensitive information such as passwords or configuration settings. HTTPS is an encrypted protocol that uses SSL/TLS to secure the data transmission between the Web browser and the Web server. HTTPS prevents anyone from snooping on or tampering with the Web traffic. Therefore, HTTPS should always be used for Web based management of wireless access points, especially in autonomous mode where there is no centralized controller to enforce security policies.
[CWNP Certified Wireless Network Administrator Official Study Guide:Exam CWNA-109], page 431; [HTTP vs HTTPS: What's The Difference And Why Should You Care?].
Post your Comments and Discuss CWNP CWNA-109 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CWNA-109 content, but please register or login to continue.