Free Certified Wireless Security Professional Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Certified Wireless Security Professional practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1During WLAN requirements gathering, which input should determine the security obligations that the design must satisfy?

   1. A. The security features enabled in the vendor's default configuration
   2. B. The applicable laws, regulations, and organizational security policies
   3. C. The settings that produced the highest throughput in a vendor test
   4. D. The authentication method most familiar to the installation team

   Answer: B

   Explanation: NIST states, "This should include identifying relevant WLAN security requirements from applicable laws, policies, regulations, etc." Applicable obligations guide requirements gathering; defaults, throughput results, and staff familiarity do not establish those obligations.

   Reference: Guidelines for Securing Wireless Local Area Networks (WLANs) — Section 2.1.1, Needs Gathering, p. 4

2. 2An attacker captures WLAN data frames to read message contents without transmitting or altering traffic. Which attack is being performed?

   1. A. Eavesdropping
   2. B. Masquerading
   3. C. Message modification
   4. D. Replay

   Answer: A

   Explanation: NIST defines eavesdropping as, "The attacker monitors WLAN data transmissions for message content." This is passive content interception. Masquerading impersonates a user, modification changes messages, and replay retransmits captured messages.

   Reference: Guidelines for Securing Wireless Local Area Networks (WLANs) — Section 3.1.1, Attack Monitoring, p. 9

3. 3A password-based WLAN design must improve resistance to an attacker who captures an exchange and then guesses the password without further interaction. Which authentication method addresses this requirement?

   1. A. WEP shared-key authentication
   2. B. WPA2-Personal using the same publicly shared PSK
   3. C. WPA3-Personal using SAE
   4. D. Open-system authentication without encryption

   Answer: C

   Explanation: Cisco states that SAE "resists offline dictionary attacks." SAE addresses the stated password-guessing threat. A public shared PSK does not provide this protection, while WEP and unencrypted open access do not meet the requirement.

   Reference: Cisco Catalyst 9800 Configuration Guide: Wi-Fi Protected Access 3 — Simultaneous Authentication of Equals

4. 4New WLAN-connected mobile devices advertise hardware-backed key protection. Why should the security team validate whether the deployed applications actually use that capability?

   1. A. Hardware-backed protection eliminates the need to assess applications
   2. B. The presence of security hardware guarantees that every app uses it
   3. C. A supported security component may not be used by default
   4. D. Key protection matters only after the device leaves the WLAN

   Answer: C

   Explanation: NIST cautions, "Although these components may exist on devices, they may not be used by default." Introducing capable devices is not proof that their protective measures are active in the deployed applications; validation must check actual use.

   Reference: Guidelines for Managing the Security of Mobile Devices in the Enterprise — Section 4.1.1, Hardware-Backed Processing and Storage, p. 16

5. 5A company is assessing the security requirements of WLAN-connected laptops that also use cellular and Bluetooth connections. What should the assessment consider?

   1. A. Only the WLAN interface, because other radios use separate protocols
   2. B. Only the cellular interface, because its traffic leaves the premises
   3. C. The risks of the possible combinations of network technologies
   4. D. The number of interfaces, treating every combination as equally risky

   Answer: C

   Explanation: NIST recommends, "Organizations should assess the risk of the possible combinations of network technologies for their WLAN client devices and determine how those risks should be mitigated." The relevant issue is the combined exposure, rather than one interface or an assumption that all combinations have identical risk.

   Reference: Guidelines for Securing Wireless Local Area Networks (WLANs) — Section 2.1.2, WLAN Architecture, p. 5

6. 6Encrypted WLAN payloads remain unreadable, but an observer infers work patterns from when devices communicate and how traffic volumes change. Which technique describes this activity?

   1. A. Replay of captured messages
   2. B. Modification of message payloads
   3. C. Masquerading as an authorized user
   4. D. Traffic flow analysis

   Answer: D

   Explanation: NIST explains traffic analysis: "The attacker gains intelligence by monitoring the transmissions for patterns of communication." Inferring patterns does not require decrypting payloads. The other choices require retransmission, alteration, or impersonation.

   Reference: Guidelines for Securing Wireless Local Area Networks (WLANs) — Section 3.1.1, Attack Monitoring, p. 9

7. 7An engineer configures a WPA3-only WLAN. Which Protected Management Frames setting is required for this mode?

   1. A. Required
   2. B. Optional
   3. C. Disabled
   4. D. Enabled only after roaming

   Answer: A

   Explanation: Cisco states, "For WPA3, PMF is mandatory." WPA3-only operation therefore requires PMF; optional, disabled, and deferred protection do not meet that requirement.

   Reference: Cisco Catalyst 9800 Configuration Guide: Wi-Fi Protected Access 3 — Configure SAE (WPA3+WPA2 mixed mode), PMF note

8. 8A WLAN device was verified as patched at deployment but can later be reset or restored from backups. What lifecycle activity checks that the protection remains in place?

   1. A. Continue monitoring whether the patch remains installed
   2. B. Treat the original deployment check as permanent assurance
   3. C. Remove the device from monitoring after its first successful connection
   4. D. Check only whether the original patch download is still available

   Answer: A

   Explanation: NIST recommends monitoring "to confirm that the patch is still installed." It specifically notes that restoring an unpatched backup or resetting a device can remove protection. Initial verification and file availability do not establish ongoing protection.

   Reference: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology — Section 2.3.4, Monitor the Deployed Patches, p. 7

9. 9Which check directly evaluates whether proposed WLAN security settings are compatible with required business applications?

   1. A. Run required applications with the proposed security settings enabled
   2. B. Confirm client authentication without exercising required applications
   3. C. Verify the saved WLAN profile without running application traffic
   4. D. Run required applications with the proposed security settings disabled

   Answer: A

   Explanation: NIST calls for evaluating "its potential impacts on performance and functionality (for example, a security setting that is incompatible with use of a particular application)." Running the applications with the settings applied tests compatibility. Authentication, a saved profile, or operation with the settings disabled does not establish protected application operation.

   Reference: Guidelines for Securing Wireless Local Area Networks (WLANs) — Section 2.2, Configuration Implementation, Evaluation, and Maintenance, p. 7

10. 10An attacker records a legitimate WLAN transmission and later sends the recorded message again while posing as its original sender. What is this attack?

    1. A. Passive eavesdropping
    2. B. Replay
    3. C. Traffic flow analysis
    4. D. Message deletion

    Answer: B

    Explanation: NIST describes replay: "The attacker monitors transmissions (passive attack) and retransmits messages posing as the legitimate user." Recording followed by retransmission distinguishes replay from passive observation or deleting a message.

    Reference: Guidelines for Securing Wireless Local Area Networks (WLANs) — Section 3.1.1, Attack Monitoring, p. 9