Wireless Security Settings

Question 1 of 6

An attacker passively monitors a WPA2-Personal wireless network near a coffee shop. A customer connects to the Wi-Fi. The attacker captures the connection exchange and drives away. Later, the attacker successfully recovers the Wi-Fi passphrase using a GPU-accelerated cracking tool. Which specific property of WPA2 PSK made this attack possible?

WPA2 uses only 128-bit encryption keys, which are too short to resist modern cracking tools The WPA2 four-way handshake transmits a hash derived from the PSK across the wireless medium, which can be captured and subjected to offline brute-force with no rate limiting WPA2 does not encrypt management frames, allowing the passphrase to be read in plaintext The attacker exploited a known vulnerability in the WPA2 encryption algorithm itself

Question 2 of 6

A security engineer explains to management why WPA3-Personal is significantly more secure than WPA2-Personal for the company's wireless network. Which TWO properties of WPA3 SAE most directly eliminate the attack that the WPA2 four-way handshake enables? (Select the best single answer that captures both.)

WPA3 uses longer encryption keys and stronger ciphers, making brute-force computationally infeasible WPA3 SAE requires the attacker to be physically closer to the access point than WPA2 WPA3 SAE derives the session key independently on each side via Diffie-Hellman — no hash is transmitted across the network, eliminating offline cracking — and generates a unique per-session key, providing forward secrecy WPA3 requires the use of enterprise RADIUS authentication, eliminating the shared passphrase entirely

Question 3 of 6

A medium-sized accounting firm needs wireless authentication that provides individual user accountability, allows IT to revoke a terminated employee's access immediately without disrupting any other user, and generates per-user session logs for compliance auditing. Which wireless security mode meets these requirements?

WPA3-Personal (PSK) with a complex passphrase and regular rotation WPA3-Enterprise (802.1X) with RADIUS authentication integrated with the firm's Active Directory WPA2-Personal with a unique SSID and hidden network broadcast Open network with application-layer VPN enforcement for all users

Question 4 of 6

After a successful wireless authentication, a RADIUS server determines that the authenticated user should be placed on VLAN 40 (guest access) rather than VLAN 10 (internal) and should have a maximum session duration of 8 hours. Which component of the AAA framework does this RADIUS response represent?

Authentication — the RADIUS server is confirming the user's identity Accounting — the RADIUS server is recording the session parameters Authorization — the RADIUS server is determining what access and constraints apply to the authenticated user Identification — the RADIUS server is establishing the user's claimed identity

Question 5 of 6

In an 802.1X wireless authentication deployment, the access point receives the user's EAP credentials and forwards them to the RADIUS server. The RADIUS server returns an Access-Accept message. The access point then opens the port and grants network access. Which 802.1X role does the access point fulfill, and what is the defining characteristic of that role?

Authentication Server — it is the component that validates credentials and makes the access decision Authenticator — it enforces port-based access control and relays EAP messages, but does not validate credentials itself Supplicant — it is the device requesting access to the network Authorization Server — it assigns VLANs and access policies to authenticated users

Question 6 of 6

A university IT team is deploying 802.1X wireless authentication for 30,000 students using personal devices. They cannot issue and manage client certificates at this scale. They need a solution where only the RADIUS server requires a certificate and students authenticate with their existing university username and password, with the credential exchange protected by a TLS tunnel. Which EAP method should they deploy?

EAP-TLS — requires only a server certificate; client authentication uses the TLS handshake PEAP — requires only a server certificate; creates a TLS tunnel to protect inner authentication (username/password) Open system — no certificate infrastructure required; all users connect without credentials WPA3-Personal PSK — shared passphrase avoids any certificate requirement

Matching

1. All users on the home wireless network share a single 256-bit passphrase. Unlike WPA2, the connection handshake derives session keys independently on each side using Diffie-Hellman — no hash of the passphrase is transmitted across the wireless medium, eliminating offline brute-force attacks.

2. WPA3 uses this single algorithm to provide both AES-based data encryption for confidentiality and GMAC-based message integrity checking — replacing the separate CCMP algorithm used in WPA2.

3. In an 802.1X deployment, this is the role filled by the wireless access point — it blocks network access until authentication succeeds, relays EAP credential messages between the client and the authentication server, and opens the logical port upon receiving an Access-Accept response.

4. The centralized AAA server that receives forwarded authentication requests from access points, validates credentials against Active Directory, and returns Access-Accept or Access-Reject responses — optionally including authorization attributes such as VLAN assignment and session time limits.

1. 2. 3. 4.

A. GCMP

B. WPA3-Personal

C. Authenticator

D. RADIUS

Wireless Security Settings — Quiz

Matching