Certified Wireless Security Professional (CWSP) Free Sample Questions

WPA3-Enterprise with EAP-TLS is the strongest combination. EAP-TLS uses client-side and server-side certificates for mutual authentication, providing device-specific credentials that cannot be easily shared. This meets the stringent requirements of PCI-DSS. WPA3-Personal uses a shared key, which violates the device-specific credential requirement. EAP-PEAP uses a server-side certificate but relies on username/password credentials inside the tunnel, which are weaker than certificates. OWE is designed for unauthenticated encryption on open networks, not for corporate authentication.

The 802.11w amendment introduces Protected Management Frames (PMF), also known as Management Frame Protection (MFP). This feature cryptographically protects certain management frames, including Disassociation and Deauthentication frames, preventing attackers from spoofing them to launch denial-of-service attacks. 802.11r is for fast roaming, 802.11k provides radio measurement information, and 802.11e provides Quality of Service (QoS).

The WPA3-SAE (Simultaneous Authentication of Equals) handshake, also known as the Dragonfly handshake, relies on both the client and the AP knowing the same pre-shared key (password). The Commit and Confirm frames are part of a key exchange process that will only succeed if both parties start with the same password. A mismatch will cause the cryptographic checks within the handshake to fail, preventing the establishment of a Pairwise Master Key (PMK) and subsequent association. SAE does not use certificates or a RADIUS server.

The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). In this scenario, the SLE is $500,000. The ARO is the frequency of the event per year, which is once every ten years, or 1/10 = 0.1. Therefore, ALE = SLE * ARO = $500,000 * 0.1 = $50,000.

The 'Monitor' phase of the security lifecycle involves ongoing observation and auditing of the network to ensure compliance and detect threats. Reviewing logs from a Wireless Intrusion Prevention System (WIPS) and a Security Information and Event Management (SIEM) system is a core monitoring activity. Developing a policy is part of 'Identify', configuring security settings is part of 'Protect', and performing risk analysis is part of 'Assess'.

This statement is false. A fundamental principle of Public Key Infrastructure (PKI) is that the private key never leaves the client device. The client proves its identity by using its private key to process information that can only be verified by the corresponding public key, which is contained in the client's certificate. The RADIUS server validates the client's certificate (checking the signature of the Certificate Authority) and verifies the client's proof of possession of the private key, but it never sees the private key itself.

Opportunistic Wireless Encryption (OWE), also known as Wi-Fi Certified Enhanced Open, is specifically designed to provide encryption for open (unauthenticated) networks. It uses a Diffie-Hellman key exchange during the association process to create a unique, individualized encryption key for each client session, protecting users from passive eavesdropping without requiring a password. This perfectly matches the coffee shop's requirements.

The aircrack-ng tool itself is used for the actual cracking of keys. After capturing the 4-way handshake (typically using airodump-ng), the capture file is fed into aircrack-ng along with a wordlist (dictionary file). Aircrack-ng then iterates through the wordlist, attempting to find the correct PSK. Airmon-ng is used to put wireless cards into monitor mode, airodump-ng is for capturing packets, and aireplay-ng is for injecting packets (e.g., to perform a deauthentication attack to force a handshake).

This is the most robust and scalable solution. Using multiple SSIDs (e.g., 'Corp', 'IoT', 'Guest') allows for different authentication and encryption settings per group. Mapping each SSID to a separate VLAN segments the traffic at Layer 2. A RADIUS server can dynamically assign users/devices to the correct VLAN based on their credentials or attributes (Role-Based Access Control). Finally, a firewall with Access Control Lists (ACLs) is essential for enforcing security policies between the VLANs, such as preventing the Guest and IoT networks from accessing the Corporate network.