CWNP CWSP-208 Online Practice Questions and Exam Preparation

CWNP CWSP-208 Online Questions & Answers

• Question 101:

  What statement accurately describes the functionality of the IEEE 802.1X standard?

  A. Port-based access control with EAP encapsulation over the LAN (EAPoL)
  B. Port-based access control with dynamic encryption key management and distribution
  C. Port-based access control with support for authenticated-user VLANs only
  D. Port-based access control with mandatory support of AES-CCMP encryption
  E. Port-based access control, which allows three frame types to traverse the uncontrolled port: EAP, DHCP, and DNS.
  A. Port-based access control with EAP encapsulation over the LAN (EAPoL)

• Question 102:

  Given: ABC Company is an Internet Service Provider with thousands of customers. ABC's customers are given login credentials for network access when they become a customer. ABC uses an LDAP server as the central user credential database. ABC is extending their service toexisting customers in some public access areas and would like to use their existing database for authentication.

  How can ABC Company use their existing user database for wireless user authentication as they implement a large-scale WPA2-Enterprise WLAN security solution?

  A. Import all users from the LDAP server into a RADIUS server with an LDAP-to-RADIUS conversion tool.
  B. Implement an X.509 compliant Certificate Authority and enable SSL queries on the LDAP server.
  C. Mirror the LDAP server to a RADIUS database within a WLAN controller and perform daily backups to synchronize the user databases.
  D. Implement a RADIUS server and query user authentication requests through the LDAP server.
  D. Implement a RADIUS server and query user authentication requests through the LDAP server.

• Question 103:

  Given: During 802.1X/LEAP authentication, the username is passed across the wireless medium in clear text.

  From a security perspective, why is this significant?

  A. The username is needed for Personal Access Credential (PAC) and X.509 certificate validation.
  B. The username is an input to the LEAP challenge/response hash that is exploited, so the username must be known to conduct authentication cracking.
  C. 4-Way Handshake nonces are based on the username in WPA and WPA2 authentication.
  D. The username can be looked up in a dictionary file that lists common username/password combinations.
  B. The username is an input to the LEAP challenge/response hash that is exploited, so the username must be known to conduct authentication cracking.

• Question 104:

  Given: A company wants employees and contractors to connect to the same SSID while receiving different levels of access to internal resources based on job function.

  What WLAN security service best supports this requirement?

  A. RF fingerprinting
  B. Role-Based Access Control
  C. Dynamic Frequency Selection
  D. Peer-to-peer blocking only
  B. Role-Based Access Control

• Question 105:

  Given: You view a protocol analyzer capture decode with the following protocol frames listed in the following order (excluding the ACK frames):

  1. 802.11 Probe Request and 802.11 Probe Response

  2. 802.11 Auth and another 802.11 Auth

  3. 802.11 Assoc Req and 802.11 Assoc Rsp

  4. EAPOL-Start

  5. EAP Request and EAP Response

  6. EAP Request and EAP Response

  7. EAP Request and EAP Response

  8. EAP Request and EAP Response

  9. EAP Request and EAP Response

  10. EAP Success 19) EAPOL-Key (4 frames in a row)

  What are you seeing in the capture file? (Choose 4)

  A. WPA2-Enterprise authentication
  B. WPA2-Personal authentication
  C. 802.11 Open System authentication
  D. 802.1X with Dynamic WEP
  E. Wi-Fi Protected Setup with PIN
  F. Active Scanning
  G. 4-Way Handshake
  A. WPA2-Enterprise authentication
  C. 802.11 Open System authentication
  F. Active Scanning
  G. 4-Way Handshake

• Question 106:

  Given: XYZ Company has recently installed a controller-based WLAN and is using a RADIUS server to query authentication requests to an LDAP server. XYZ maintains user-based access policies and would like to use the RADIUS server to facilitate network authorization.

  What RADIUS features could be used by XYZ to assign the proper network permissions to users during authentication? (Choose 2)

  A. The RADIUS server can communicate with the DHCP server to issue the appropriate IP address and VLAN assignment to users.
  B. The RADIUS server can support vendor-specific attributes in the ACCESS-ACCEPT response, which can be used for user policy assignment.
  C. RADIUS can reassign a client's 802.11 association to a new SSID by referencing a username-to-SSID mapping table in the LDAP user database.
  D. RADIUS can send a DO-NOT-AUTHORIZE demand to the authenticator to prevent the STA from gaining access to specific files, but may only employ this in relation to Linux servers.
  E. RADIUS attributes can be used to assign permission levels, such as read-only permission, to users of a particular network resource.
  B. The RADIUS server can support vendor-specific attributes in the ACCESS-ACCEPT response, which can be used for user policy assignment.
  E. RADIUS attributes can be used to assign permission levels, such as read-only permission, to users of a particular network resource.

• Question 107:

  What information can be used by a WIPS to triangulate the position of a rogue device?

  A. RSSI values from multiple sensors
  B. Beacon interval timing
  C. VLAN tag assignments
  D. MAC OUI prefix
  A. RSSI values from multiple sensors

• Question 108:

  You have been recently hired as the wireless network administrator for an organization spread across seven locations. They have deployed more than 100 APs, but they have not been managedin either an automated or manual process for more than 18 months.

  Given this length of time, what is one of the first things you should evaluate from a security perspective?

  A. The channel widths configured
  B. The channels in use
  C. The VLANs in use
  D. The firmware revision
  D. The firmware revision

• Question 109:

  Given: ABC Company has a WLAN controller using WPA2-Enterprise with PEAPv0/MS-CHAPv2 and AES-CCMP to secure their corporate wireless data. They wish to implement a guest WLAN for guest users to have Internet access, but want to implement some security controls.

  The security requirements for the hot-spot include: Cannot access corporate network resources Network permissions are limited to Internet access

  All stations must be authenticated.

  What security controls would you suggest? (Choose the single best answer.)

  A. Implement separate controllers for the corporate and guest WLANs.
  B. Use a WIPS to deauthenticate guest users when their station tries to associate with the corporate WLAN.
  C. Configure access control lists (ACLs) on the guest WLAN to control data types and destinations.
  D. Require guest users to authenticate via a captive portal HTTPS login page and place the guest WLAN and the corporate WLAN on different VLANs.
  E. Force all guest users to use a common VPN protocol to connect.
  D. Require guest users to authenticate via a captive portal HTTPS login page and place the guest WLAN and the corporate WLAN on different VLANs.

• Question 110:

  Given: WLAN attacks are typically conducted by hackers to exploit a specific vulnerability within a network.

  What statement correctly pairs the type of WLAN attack with the exploited vulnerability? (Choose 3)

  A. Management interface exploit attacks are attacks that use social engineering to gain credentials from managers.
  B. Zero-day attacks are always authentication or encryption cracking attacks.
  C. RF DoS attacks prevent successful wireless communication on a specific frequency or frequency range.
  D. Hijacking attacks interrupt a user's legitimate connection and introduce a new connection with an evil twin AP.
  E. Social engineering attacks are performed to collect sensitive information from unsuspecting users
  F. Association flood attacks are Layer 3 DoS attacks performed against authenticated client stations
  C. RF DoS attacks prevent successful wireless communication on a specific frequency or frequency range.
  D. Hijacking attacks interrupt a user's legitimate connection and introduce a new connection with an evil twin AP.
  E. Social engineering attacks are performed to collect sensitive information from unsuspecting users