Use the best ways of preparing for CWSP-208 Exam Dumps with Prep4sureGuide CWNP CWSP-208 dump PDF [2026]
CWNP CWSP-208 exam candidates will surely pass the Exam if they consider the CWSP-208 dumps learning material presented by Prep4sureGuide.
NEW QUESTION # 57
What protocols allow a network administrator to securely manage the configuration of WLAN controllers and access points? (Choose 2)
- A. TFTP
- B. SSHv2
- C. FTP
- D. Telnet
- E. SNMPv1
- F. HTTPS
Answer: B,F
Explanation:
Secure configuration of network devices requires encrypted management protocols:
HTTPS: Provides secure web-based GUI access using TLS encryption.
SSHv2: Provides secure CLI access using encrypted channels.
Incorrect:
A). SNMPv1 is not secure - lacks encryption and authentication.
C). Telnet sends credentials and commands in clear text.
D). TFTP is used for file transfer without encryption or authentication.
E). FTP is also insecure-transmits credentials in plain text.
References:
CWSP-208 Study Guide, Chapter 7 (Management Plane Security)
CWNP Secure Management Practices
NEW QUESTION # 58
What type of WLAN attack is prevented with the use of a per-MPDU TKIP sequence counter (TSC)?
- A. Forgery
- B. Replay
- C. Weak-IV
- D. Session hijacking
- E. Bit-flipping
Answer: B
Explanation:
TKIP (Temporal Key Integrity Protocol) was introduced with WPA to enhance WEP security. One of the security mechanisms used in TKIP is a per-MPDU (MAC Protocol Data Unit) sequence counter called the TSC (TKIP Sequence Counter). The TSC acts as a form of replay protection by assigning a unique sequence number to each transmitted frame. If a packet is received with a sequence number lower than or equal to a previously received number, it is discarded. This directly prevents replay attacks, where a malicious actor resends previously captured frames in an attempt to spoof the session or extract data.
References:
CWSP-208 Official Study Guide, Chapter 5 (WLAN Threats and Attacks)
CWNP Exam Objectives: WLAN Encryption and Key Management
IEEE 802.11i-2004 standard (Replay protection mechanisms in TKIP)
NEW QUESTION # 59
Given: ABC Hospital wishes to create a strong security policy as a first step in securing their 802.11 WLAN.
Before creating the WLAN security policy, what should you ensure you possess?
- A. Management support for the process
- B. Security policy generation software
- C. Awareness of the exact vendor devices being installed
- D. End-user training manuals for the policies to be created
Answer: A
Explanation:
Developing a robust WLAN security policy requires buy-in from executive or senior management. Without management support, it's difficult to enforce compliance, allocate resources, or prioritize security among other organizational objectives. This foundational step ensures that policy creation and enforcement are feasible and aligned with organizational goals.
Incorrect:
A). Device/vendor specifics are addressed later during implementation.
C). End-user training materials are created after the policy is finalized.
D). Security policy software can assist, but is not essential compared to management support.
References:
CWSP-208 Study Guide, Chapter 2 (Policy Development and Implementation) CWNP WLAN Lifecycle Framework
NEW QUESTION # 60
Given: When the CCMP cipher suite is used for protection of data frames, 16 bytes of overhead are added to the Layer 2 frame. 8 of these bytes comprise the MIC.
What purpose does the encrypted MIC play in protecting the data frame?
- A. The MIC is used as a first layer of validation to ensure that the wireless receiver does not incorrectly process corrupted signals.
- B. The MIC is a hash computation performed by the receiver against the MAC header to detect replay attacks prior to processing the encrypted payload.
- C. The MIC is a random value generated during the 4-way handshake and is used for key mixing to enhance the strength of the derived PTK.
- D. The MIC provides for a cryptographic integrity check against the data payload to ensure that it matches the original transmitted data.
Answer: D
Explanation:
The Message Integrity Code (MIC) is:
A cryptographic checksum applied to the data payload.
It ensures the payload was not modified in transit and guards against tampering.
With AES-CCMP, the MIC is generated as part of the encryption process and verified upon decryption.
Incorrect:
A). Signal integrity is validated at the physical layer, not through the MIC.
C). The MIC protects data payload integrity, not just MAC headers.
D). The MIC is not generated during the 4-Way Handshake.
References:
CWSP-208 Study Guide, Chapter 3 (CCMP and Frame Protection)
IEEE 802.11i-2004 Specification
NEW QUESTION # 61
As a part of a large organization's security policy, how should a wireless security professional address the problem of rogue access points?
- A. Conduct thorough manual facility scans with spectrum analyzers to detect rogue AP RF signatures.
- B. A trained employee should install and configure a WIPS for rogue detection and response measures.
- C. Use a WPA2-Enterprise compliant security solution with strong mutual authentication and encryption for network access of corporate devices.
- D. Enable port security on Ethernet switch ports with a maximum of only 3 MAC addresses on each port.
- E. Hide the SSID of all legitimate APs on the network so that intruders cannot copy this parameter on rogue APs.
Answer: B
Explanation:
Rogue APs pose a significant risk and should be detected and mitigated automatically.
D). A properly configured Wireless Intrusion Prevention System (WIPS) can detect unauthorized APs and prevent client associations to them in real time.
Incorrect:
A). While WPA2-Enterprise adds client-level protection, it does not detect rogue APs.
B). Hiding SSIDs is ineffective-SSIDs are still discoverable in management frames.
C). Manual scans are labor-intensive and impractical for ongoing monitoring.
E). Port security controls wired threats but cannot detect rogue APs using wireless signals.
References:
CWSP-208 Study Guide, Chapter 6 (Wireless Intrusion Prevention Systems) CWNP Rogue Detection Strategies
NEW QUESTION # 62
As the primary security engineer for a large corporate network, you have been asked to author a new security policy for the wireless network. While most client devices support 802.1X authentication, some legacy devices still only support passphrase/PSK-based security methods.
When writing the 802.11 security policy, what password-related items should be addressed?
- A. Certificates should always be recommended instead of passwords for 802.11 client authentication.
- B. MSCHAPv2 passwords used with EAP/PEAPv0 should be stronger than typical WPA2-PSK passphrases.
- C. Password complexity should be maximized so that weak WEP IV attacks are prevented.
- D. EAP-TLS must be implemented in such scenarios.
- E. Static passwords should be changed on a regular basis to minimize the vulnerabilities of a PSK-based authentication.
Answer: E
Explanation:
In environments where PSK-based authentication (like WPA2-Personal) is still in use due to legacy device constraints:
C). Regularly changing static passwords helps limit exposure from credential leaks or previous employees retaining access.
Incorrect:
A). MSCHAPv2 is vulnerable to offline attacks; recommending strong passwords is good, but that alone isn't sufficient.
B). WEP is insecure regardless of password strength due to IV reuse.
D). Certificates are stronger, but not always feasible for legacy systems.
E). EAP-TLS is ideal but not always compatible with all devices; policies should be flexible to device capabilities.
References:
CWSP-208 Study Guide, Chapters 3 and 4 (WPA2-PSK and 802.1X Considerations) CWNP WLAN Security Lifecycle and Policy Development
NEW QUESTION # 63
Given: ABC Corporation's 802.11 WLAN is comprised of a redundant WLAN controller pair (N+1) and 30 access points implemented in 2004. ABC implemented WEP encryption with IPSec VPN technology to secure their wireless communication because it was the strongest security solution available at the time it was implemented. IT management has decided to upgrade the WLAN infrastructure and implement Voice over Wi-Fi and is concerned with security because most Voice over Wi-Fi phones do not support IPSec.
As the wireless network administrator, what new security solution would be best for protecting ABC's data?
- A. Migrate all 802.11 data devices to WPA-Personal, and implement a secure DHCP server to allocate addresses from a segmented subnet for the Voice over Wi-Fi phones.
- B. Migrate corporate data and Voice over Wi-Fi devices to WPA2-Enterprise with fast secure roaming support, and segment Voice over Wi-Fi data on a separate VLAN.
- C. Migrate corporate data clients to WPA-Enterprise and segment Voice over Wi-Fi phones by assigning them to a different frequency band.
- D. Migrate to a multi-factor security solution to replace IPSec; use WEP with MAC filtering, SSID hiding, stateful packet inspection, and VLAN segmentation.
Answer: B
Explanation:
Comprehensive Detailed Explanation:
To support real-time applications like Voice over Wi-Fi:
WPA2-Enterprise ensures robust security using 802.1X and AES-CCMP.
Fast secure roaming (802.11r) is essential to maintain voice session quality.
VLAN segmentation improves network performance and security between voice and data devices.
Incorrect:
A). WPA-Enterprise is less secure than WPA2, and frequency band segmentation doesn't address QoS and security together.
C). WEP is deprecated and insecure even with added measures.
D). WPA-Personal lacks centralized authentication and doesn't support enterprise-grade security or fast roaming.
References:
CWSP-208 Study Guide, Chapter 6 (Voice WLAN Security)
CWNP Guide to Secure WLAN Design
NEW QUESTION # 64
Given: You are using WEP as an encryption solution. You are using VLANs for network segregation.
Why can you not establish an RSNA?
- A. RSNA connections require TKIP or CCMP.
- B. RSNA connections do not work in conjunction with VLANs.
- C. RSNA connections require CCMP and do not support TKIP or WEP.
- D. RSNA connections require BIP and do not support TKIP, CCMP or WEP.
Answer: A
Explanation:
RSNA (Robust Security Network Association), as defined by 802.11i, requires:
TKIP (WPA) or CCMP (WPA2) for encryption.
WEP is deprecated and not supported for RSNA since it does not meet RSN standards.
Incorrect:
B & C. BIP is not required for RSNA formation-it is used for management frame protection (802.11w).
D). VLANs are orthogonal to RSNA-network segmentation does not interfere with RSNA formation.
References:
CWSP-208 Study Guide, Chapter 3 (RSNA Formation and Key Hierarchy)
IEEE 802.11i and 802.11-2012 Standards
NEW QUESTION # 65
What wireless security protocol provides mutual authentication without using an X.509 certificate?
- A. EAP-TTLS
- B. EAP-FAST
- C. EAP-MD5
- D. PEAPv0/EAP-MSCHAPv2
- E. EAP-TLS
- F. PEAPv1/EAP-GTC
Answer: B
Explanation:
EAP-FAST (Flexible Authentication via Secure Tunneling) provides:
Mutual authentication using Protected Access Credentials (PACs).
Does not require X.509 certificates for either client or server (although optional for servers).
Is faster and easier to deploy in environments lacking a PKI.
Incorrect:
B). EAP-MD5 provides no mutual authentication.
C). EAP-TLS requires client and server certificates.
D). PEAPv0/EAP-MSCHAPv2 requires a server certificate.
E). EAP-TTLS requires a server certificate.
F). PEAPv1/EAP-GTC still requires a server certificate.
References:
CWSP-208 Study Guide, Chapter 4 (EAP Method Comparisons)
Cisco EAP-FAST Whitepaper
Wi-Fi Alliance EAP Interoperability Matrix
NEW QUESTION # 66
In the basic 4-way handshake used in secure 802.11 networks, what is the purpose of the ANonce and SNonce? (Choose 2)
- A. They are used to pad Message 1 and Message 2 so each frame contains the same number of bytes.
- B. They are added together and used as the GMK, from which the GTK is derived.
- C. They allow the participating STAs to create dynamic keys while avoiding sending unicast encryption keys across the wireless medium.
- D. They are input values used in the derivation of the Pairwise Transient Key.
- E. The IEEE 802.11 standard requires that all encrypted frames contain a nonce to serve as a Message Integrity Check (MIC).
Answer: C,D
Explanation:
In the 802.11 4-Way Handshake:
D: The ANonce (from the AP) and SNonce (from the STA) are critical entropy values used along with the PMK, MAC addresses, etc., to derive the PTK securely.
E: This process ensures both parties derive the same PTK without ever transmitting the key over the air, mitigating interception risk.
Incorrect:
A). Nonces are not padding bytes.
B). Nonces are not the MIC; MIC is a separate integrity mechanism.
C). GMK and GTK are for group keys, not derived from nonces.
References:
CWSP-208 Study Guide, Chapter 3 (4-Way Handshake Mechanics)
IEEE 802.11i Specification
NEW QUESTION # 67
Select the answer option that arranges the numbered events in the correct time sequence (first to last) for a client associating to a BSS using EAP-PEAPv0/MSCHAPv2.
1. Installation of PTK
2. Initiation of 4-way handshake
3. Open system authentication
4. 802.11 association
5. 802.1X controlled port is opened for data traffic
6. Client validates server certificate
7. AS validates client credentials
- A. 4-3-5-2-7-6-1
- B. 3-4-7-6-5-2-1
- C. 6-1-3-4-2-7-5
- D. 3-4-6-7-2-1-5
- E. 5-3-4-2-6-7-1
- F. 4-3-2-7-6-1-5
Answer: A
Explanation:
When compliance reporting and forensic analysis are required and the WLAN vendor's centralized management system does not provide it, deploying a dedicated overlay WIPS is the most effective solution.
Overlay WIPS uses dedicated sensors independent of the WLAN's operational radios, offering detailed threat detection, compliance logging, and reporting capabilities that often surpass native WLAN features.
References:
CWSP-208 Study Guide, Chapter 7 - Overlay vs Integrated WIPS
CWNP CWSP-208 Objectives: "Compliance Monitoring and Forensics"
NEW QUESTION # 68
Which one of the following describes the correct hierarchy of 802.1X authentication key derivation?
- A. If passphrase-based client authentication is used by the EAP type, the PMK is mapped directly from the user's passphrase. The PMK is then used during the 4-way handshake to create data encryption keys.
- B. After successful EAP authentication, the RADIUS server generates a PMK. A separate key, the MSK, is derived from the AAA key and is hashed with the PMK to create the PTK and GTK.
- C. The PMK is generated from a successful mutual EAP authentication. When mutual authentication is not used, an MSK is created. Either of these two keys may be used to derive the temporal data encryption keys during the 4-way handshake.
- D. The MSK is generated from the 802.1X/EAP authentication. The PMK is derived from the MSK. The PTK is derived from the PMK, and the keys used for actual data encryption are a part of the PTK.
Answer: D
Explanation:
In 802.1X/EAP authentication:
The EAP method (e.g., EAP-TLS, PEAP) results in the generation of a Master Session Key (MSK).
The Pairwise Master Key (PMK) is derived from the MSK.
The Pairwise Transient Key (PTK) is derived from the PMK using nonces and MAC addresses during the 4- Way Handshake.
The PTK includes the actual keys used for data encryption.
Incorrect:
B). This applies to WPA/WPA2-Personal, not 802.1X/EAP.
C). The RADIUS server sends the MSK, not the PMK directly.
D). The MSK is always derived during EAP authentication, mutual or not.
References:
CWSP-208 Study Guide, Chapter 3 (Key Hierarchy)
IEEE 802.11i Specification
NEW QUESTION # 69
What statement is true regarding the nonces (ANonce and SNonce) used in the IEEE 802.11 4 Way Handshake?
- A. Both nonces are used by the Supplicant and Authenticator in the derivation of a single PTK.
- B. Nonces are sent in EAPoL frames to indicate to the receiver that the sending station has installed and validated the encryption keys.
- C. The Supplicant uses the SNonce to derive its unique PTK and the Authenticator uses the ANonce to derive its unique PTK, but the nonces are not shared.
- D. The nonces are created by combining the MAC addresses of the Supplicant, Authenticator, and Authentication Server into a mixing algorithm.
Answer: A
Explanation:
The PTK derivation requires:
PMK
ANonce (generated by the Authenticator)
SNonce (generated by the Supplicant)
MAC addresses of both Authenticator and Supplicant
Both the Supplicant and Authenticator derive the same PTK using identical inputs during the 4-Way Handshake.
Incorrect:
B). The nonces are shared-each party uses both ANonce and SNonce.
C). Nonces indicate no such validation message.
D). The MACs are part of the PTK input but not used to generate the nonces themselves.
References:
CWSP-208 Study Guide, Chapter 3 (4-Way Handshake)
IEEE 802.11i Key Management Process
NEW QUESTION # 70
Given: Many computer users connect to the Internet at airports, which often have 802.11n access points with a captive portal for authentication.
While using an airport hot-spot with this security solution, to what type of wireless attack is a user susceptible? (Choose 2)
- A. Management interface exploits
- B. UDP port redirection
- C. Man-in-the-Middle
- D. Wi-Fi phishing
- E. IGMP snooping
Answer: C,D
Explanation:
Open networks with captive portals do not provide link-layer encryption, so:
A). Man-in-the-Middle (MitM): Attackers can intercept or modify traffic between the user and the legitimate network (especially before HTTPS negotiation).
B). Wi-Fi phishing: Evil twin APs may mimic the legitimate hotspot and show a fake captive portal, stealing user credentials or prompting malicious downloads.
Incorrect:
C). Management interface exploits target device admin panels, not typical client users.
D). UDP port redirection and
E). IGMP snooping are network-layer behaviors, not common user-targeted attacks.
References:
CWSP-208 Study Guide, Chapter 5 (Hotspot Vulnerabilities)
CWNP Wi-Fi Phishing and Evil Twin Defense Strategies
NEW QUESTION # 71
You must support a TSN as you have older wireless equipment that will not support the required processing of AES encryption. Which one of the following technologies will you use on the network so that a TSN can be implemented that would not be required in a network compliant with 802.11-2012 non-deprecated technologies?
- A. WPA2
- B. CCMP
- C. WEP
- D. RC4
Answer: D
Explanation:
A Transitional Security Network (TSN) allows legacy stations to interoperate by using older encryption methods. If AES (CCMP) is unsupported by older equipment, the network can fall back to TKIP, which uses RC4 as its encryption algorithm. TKIP enables AES encryption on newer devices while accommodating legacy clients.
Options A, C, D are current or deprecated standards with AES; only RC4 matches the transitional need.
References:
CWSP#207 Study Guide, Chapter 3 (TSN, TKIP, AES-CCMP)
NEW QUESTION # 72
You are implementing an 802.11ac WLAN and a WIPS at the same time. You must choose between integrated and overlay WIPS solutions. Which of the following statements is true regarding integrated WIPS solutions?
- A. Integrated WIPS is always more expensive than overlay WIPS.
- B. Integrated WIPS always perform better from a client throughput perspective because the same radio that performs the threat scanning also services the clients.
- C. Integrated WIPS use special sensors installed alongside the APs to scan for threats.
- D. Many integrated WIPS solutions that detect Voice over Wi-Fi traffic will cease scanning altogether to accommodate the latency sensitive client traffic.
Answer: D
Explanation:
In integrated WIPS systems, radios are shared between client servicing and security scanning. To maintain quality of service for latency-sensitive applications such as VoWiFi (Voice over Wi-Fi), scanning operations may be temporarily suspended or deprioritized, potentially reducing security monitoring during those periods.
References:
CWSP-208 Study Guide, Chapter 7 - Integrated WIPS Tradeoffs
CWNP CWSP-208 Objectives: "Integrated WIPS Behavior and Performance Impact"
NEW QUESTION # 73
In the IEEE 802.11-2012 standard, what is the purpose of the 802.1X Uncontrolled Port?
- A. To pass general data traffic after the completion of 802.11 authentication and key management
- B. To allow only authentication frames to flow between the Supplicant and Authentication Server
- C. To block authentication traffic until the 4-Way Handshake completes
- D. To block unencrypted user traffic after a 4-Way Handshake completes
Answer: B
Explanation:
The 802.1X Uncontrolled Port exists before a client is fully authenticated. It:
Permits only EAP/EAPoL frames to pass between the Supplicant and the Authenticator (AP or switch).
Blocks general data traffic until authentication completes.
After authentication, the Controlled Port is opened, allowing normal data flow.
Incorrect:
B). Authentication must complete before the 4-Way Handshake, not the other way around.
C). General data traffic uses the Controlled Port, not the Uncontrolled Port.
D). The Uncontrolled Port doesn't specifically deal with encrypted or decrypted user traffic.
References:
CWSP-208 Study Guide, Chapter 4 (802.1X Port Behavior)
IEEE 802.1X Overview
NEW QUESTION # 74
For a WIPS system to identify the location of a rogue WLAN device using location patterning (RF fingerprinting), what must be done as part of the WIPS installation?
- A. At least six antennas must be installed in each sensor.
- B. The RF environment must be sampled during an RF calibration process.
- C. All WIPS sensors must be installed as dual-purpose (AP/sensor) devices.
- D. A location chipset (GPS) must be installed with it.
Answer: B
Explanation:
For a WIPS system to perform location patterning (also called RF fingerprinting), it must first perform an RF calibration or RF site survey. This process involves sampling signal strengths from known locations to develop a model of how signals propagate in the environment. This "fingerprint" is then used to triangulate or estimate the positions of rogue devices.
NEW QUESTION # 75
Given: In XYZ's small business, two autonomous 802.11ac APs and 12 client devices are in use with WPA2- Personal.
What statement about the WLAN security of this company is true?
- A. An unauthorized wireless client device cannot associate, but can eavesdrop on some data because WPA2-Personal does not encrypt multicast or broadcast traffic.
- B. A successful attack against all unicast traffic on the network would require a weak passphrase dictionary attack and the capture of the latest 4-Way Handshake for each client.
- C. Intruders may obtain the passphrase with an offline dictionary attack and gain network access, but will be unable to decrypt the data traffic of other users.
- D. Because WPA2-Personal uses Open System authentication followed by a 4-Way Handshake, hijacking attacks are easily performed.
- E. An unauthorized WLAN user with a protocol analyzer can decode data frames of authorized users if he captures the BSSID, client MAC address, and a user's 4-Way Handshake.
Answer: B
Explanation:
In WPA2-Personal, each client derives its Pairwise Transient Key (PTK) based on a shared Pairwise Master Key (PMK) and values exchanged during the 4-Way Handshake. Therefore, even if the passphrase is cracked, an attacker must still capture the 4-Way Handshake for each target client in order to decrypt their unicast traffic.
Incorrect:
A). Incorrect because cracking the passphrase allows decrypting data traffic after capturing the 4-Way Handshake.
C). WPA2 encrypts multicast and broadcast traffic using the GTK, which unauthorized clients cannot derive.
D). Capturing BSSID and MAC isn't enough without knowing the passphrase and the full 4-Way Handshake.
E). Hijacking is harder in WPA2-Personal due to the dynamic PTK derived per session.
References:
CWSP-208 Study Guide, Chapter 3 (WPA2-PSK Key Management)
CWNP Learning: WLAN Encryption and PTK Derivation
NEW QUESTION # 76
In an effort to optimize WLAN performance, ABC Company has upgraded their WLAN infrastructure from
802.11a/g to 802.11n. 802.11a/g clients are still supported and are used throughout ABC's facility. ABC has always been highly security conscious, but due to budget limitations, they have not yet updated their overlay WIPS solution to 802.11n or 802.11ac.
Given ABC's deployment strategy, what security risks would not be detected by the 802.11a/g WIPS?
- A. 802.11a STA performing a deauthentication attack against 802.11n APs
- B. 802.11n client spoofing the MAC address of an authorized 802.11n client
- C. Hijacking attack performed by using a rogue 802.11n AP against an 802.11a client
- D. Rogue AP operating in Greenfield 40 MHz-only mode
Answer: D
Explanation:
An 802.11a/g-based WIPS cannot detect rogue activity that occurs in 802.11n/ac-specific modes, including Greenfield (HT-only) operation and use of 40 MHz channels, which are not part of the 802.11a/g specification. Greenfield mode disables legacy support, so a WIPS limited to 802.11a/g radios won't even
"see" these frames. This leaves a significant blind spot for detecting certain types of rogue devices or attacks using newer PHYs.
References:
CWSP-208 Study Guide, Chapter 7 - WIPS Capabilities and Limitations
CWNP CWSP-208 Objectives: "Protocol Compatibility and Threat Detection"
NEW QUESTION # 77
Given: John Smith uses a coffee shop's Internet hot-spot (no authentication or encryption) to transfer funds between his checking and savings accounts at his bank's website. The bank's website uses the HTTPS protocol to protect sensitive account information. While John was using the hot-spot, a hacker was able to obtain John's bank account user ID and password and exploit this information.
What likely scenario could have allowed the hacker to obtain John's bank account user ID and password?
- A. The bank's web server is using an X.509 certificate that is not signed by a root CA, causing the user ID and password to be sent unencrypted.
- B. Before connecting to the bank's website, John's association to the AP was hijacked. The attacker intercepted the HTTPS public encryption key from the bank's web server and has decrypted John's login credentials in near real-time.
- C. John's bank is using an expired X.509 certificate on their web server. The certificate is on John's Certificate Revocation List (CRL), causing the user ID and password to be sent unencrypted.
- D. John accessed his corporate network with his IPSec VPN software at the wireless hot-spot. An IPSec VPN only encrypts data, so the user ID and password were sent in clear text. John uses the same username and password for banking that he does for his IPSec VPN software.
- E. John uses the same username and password for banking that he does for email. John used a POP3 email client at the wireless hot-spot to check his email, and the user ID and password were not encrypted.
Answer: E
Explanation:
In this scenario, although the bank's website uses HTTPS (which encrypts communications between John's browser and the bank's server), the compromise did not occur during the banking session itself. Instead, the attacker exploited a common security mistake: credential reuse.
John reused his email credentials for his bank login, and he accessed his email using a POP3 client without encryption at a public hotspot. This means his username and password were sent in cleartext, which is trivially easy to sniff on an open wireless network. Once an attacker obtained those credentials, they could use them to log into his bank account if the same credentials were used there.
Here's how this aligns with CWSP knowledge domains:
* CWSP Security Threats & Attacks: This is a classic example of credential harvesting via cleartext protocols (POP3), and password reuse, both of which are significant risks in WLAN environments.
* CWSP Secure Network Design: Recommends use of encrypted protocols (e.g., POP3S or IMAPS) and user education against password reuse.
* CWSP WLAN Security Fundamentals: Emphasizes that open Wi-Fi networks offer no encryption by default, leaving unprotected protocols vulnerable to sniffing and interception.
Other answer options and why they are incorrect:
* A & D are invalid because an expired or unsigned certificate may cause browser warnings but won't result in sending credentials unencrypted unless the user bypasses HTTPS (which wasn't stated).
* C is incorrect: IPSec VPNs encrypt all data between the client and VPN endpoint-including credentials.
* E is technically incorrect and misleading: intercepting the public key of an HTTPS session doesn't allow decryption of the credentials due to asymmetric encryption and session key security. Real-time decryption of HTTPS traffic without endpoint compromise is not feasible.
References:
CWSP-208 Study Guide, Chapters 3 (Security Policy) and 5 (Threats and Attacks) CWNP CWSP-208 Official Study Guide CWNP Exam Objectives - WLAN Authentication, Encryption, and VPNs CWNP Whitepapers on WLAN Security Practices
NEW QUESTION # 78
Given: AAA is an architectural framework used to provide three separate security components in a network.
Listed below are three phrases that each describe one aspect of the AAA framework.
Option-1 - This AAA function is performed first and validates user identify prior to determining the network resources to which they will be granted access.
Option-2 - This function is used for monitoring and auditing purposes and includes the collection of data that identifies what a user has done while connected.
Option-3 - This function is used to designate permissions to a particular user.
What answer correctly pairs the AAA component with the descriptions provided above?
- A. Option-1 - Access Control
Option-2 - Authorization
Option-3 - Accounting - B. Option-1 - Authentication
Option-2 - Accounting
Option-3 - Association - C. Option-1 - Authorization
Option-2 - Access Control
Option-3 - Association - D. Option-1 - Authentication
Option-2 - Accounting
Option-3 - Authorization
Answer: D
Explanation:
AAA stands for:
Authentication: Validates user identity (Option 1).
Authorization: Grants access to specific resources based on policy (Option 3).
Accounting: Tracks user activity (Option 2).
This ordering matches standard network security architecture:
Who are you? # Authentication
What are you allowed to do? # Authorization
What did you do? # Accounting
Incorrect:
A-C. Misplace or mislabel AAA functions.
References:
CWSP-208 Study Guide, Chapter 4 (AAA Framework)
CWNP AAA and WLAN Policy Documents
NEW QUESTION # 79
What WLAN client device behavior is exploited by an attacker during a hijacking attack?
- A. As specified by the Wi-Fi Alliance, clients using Open System authentication must allow direct client- to-client connections, even in an infrastructure BSS.
- B. Client drivers scan for and connect to access points in the 2.4 GHz band before scanning the 5 GHz band.
- C. When the RF signal between a client and an access point is disrupted for more than a few seconds, the client device will attempt to associate to an access point with better signal quality.
- D. After the initial association and 4-way handshake, client stations and access points do not need to perform another 4-way handshake, even if connectivity is lost.
- E. When the RF signal between a client and an access point is lost, the client will not seek to reassociate with another access point until the 120 second hold down timer has expired.
Answer: C
Explanation:
Hijacking attacks often rely on exploiting client behavior during signal disruption. Clients will seek better connections when RF is weak or interrupted. An attacker may:
Disrupt the signal (e.g., with a deauth attack)
Present a rogue access point (evil twin) with stronger signal
Trick the client into associating with the rogue AP, hijacking the session Incorrect:
B). There is no standard 120-second timer behavior.
C). Loss of connectivity typically triggers reassociation and reauthentication.
D). Direct client-to-client connections are not required in infrastructure mode.
E). Band selection logic varies and is unrelated to hijacking attacks.
References:
CWSP-208 Study Guide, Chapter 5 (Hijacking and Client Behavior)
CWNP Wi-Fi Threat Analysis
NEW QUESTION # 80
Given: You have implemented strong authentication and encryption mechanisms for your enterprise 802.11 WLAN using 802.1X/EAP with AES-CCMP.
For users connecting within the headquarters office, what other security solution will provide continuous monitoring of both clients and APs with 802.11-specific tracking?
- A. WLAN endpoint agent software
- B. IPSec VPN client and server software
- C. Internet firewall software
- D. RADIUS proxy server
- E. Wireless intrusion prevention system
Answer: E
Explanation:
In integrated WIPS systems, radios are shared between client servicing and security scanning. To maintain quality of service for latency-sensitive applications such as VoWiFi (Voice over Wi-Fi), scanning operations may be temporarily suspended or deprioritized, potentially reducing security monitoring during those periods.
References:
CWSP-208 Study Guide, Chapter 7 - Integrated WIPS Tradeoffs
CWNP CWSP-208 Objectives: "Integrated WIPS Behavior and Performance Impact"
NEW QUESTION # 81
......
Full CWSP-208 Practice Test and 122 unique questions with explanations waiting just for you, get it now: https://drive.google.com/open?id=1VaqPlR9v2x6WrDUAYITddhfb4mwNtYfe
Accurate & Verified Answers As Seen in the Real Exam here: https://www.prep4sureguide.com/CWSP-208-prep4sure-exam-guide.html