Free CompTIA Network+ Wireless Security Protocols Questions and Answers 1 — Questions and Answers
Question 1: A network administrator is setting up a wireless network for a large corporation. The security policy requires that each user authenticates with their unique network credentials rather than using a shared password. Which of the following wireless security configurations should be implemented?
- WPA2-PSK
- WEP
- WPA3-Personal
- WPA2-Enterprise (Correct answer)
Correct answer: WPA2-Enterprise
WPA2-Enterprise mode uses the IEEE 802.1X standard to authenticate each user individually, typically against a RADIUS server. This method allows for unique credentials for every user, which is a requirement for robust corporate security. WPA2-PSK and WPA3-Personal use a Pre-Shared Key, where all users share the same password. WEP is an obsolete and insecure protocol.
Question 2: Which wireless security protocol is considered deprecated and highly vulnerable due to its use of the RC4 stream cipher with a small, static 24-bit initialization vector (IV), making it susceptible to key recovery attacks?
- WPA
- WEP (Correct answer)
- WPA2
- WPA3
Correct answer: WEP
Wired Equivalent Privacy (WEP) is an outdated security protocol that has significant vulnerabilities. Its use of the RC4 stream cipher combined with a short, 24-bit IV that is sent in plaintext leads to IV collision and allows attackers to easily recover the secret key.
Question 3: A network technician is upgrading a company's wireless security from WPA2 to WPA3. Which major enhancement does WPA3-Personal offer over WPA2-Personal to protect against offline dictionary attacks?
- Temporal Key Integrity Protocol (TKIP)
- Advanced Encryption Standard (AES)
- Simultaneous Authentication of Equals (SAE) (Correct answer)
- Extensible Authentication Protocol (EAP)
Correct answer: Simultaneous Authentication of Equals (SAE)
WPA3 replaces the Pre-Shared Key (PSK) four-way handshake of WPA2 with Simultaneous Authentication of Equals (SAE). SAE is a secure key establishment protocol that is resistant to offline dictionary attacks, which were a significant vulnerability in WPA2-PSK.
Question 4: WPA2 mandates the use of a specific AES-based protocol to provide strong data confidentiality and integrity. Which of the following protocols is required for WPA2?
- TKIP
- CCMP (Correct answer)
- WEP
- RC4
Correct answer: CCMP
Wi-Fi Protected Access 2 (WPA2) mandates the use of CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol). CCMP is based on the strong AES (Advanced Encryption Standard) encryption algorithm and is a significant security improvement over the TKIP protocol used by WPA.
Question 5: A small business owner wants to set up a guest Wi-Fi network. They are using older access points that do not support WPA2 or WPA3. The only available security options are WEP and WPA with TKIP. Which of the following is the MOST secure option available in this scenario?
- WPA with TKIP (Correct answer)
- WEP with a 128-bit key
- WEP with a 64-bit key
- Open network with MAC filtering
Correct answer: WPA with TKIP
While both are now considered insecure, WPA with TKIP (Temporal Key Integrity Protocol) is significantly more secure than WEP. WPA was designed as an interim replacement for WEP and fixed several of its critical flaws, such as implementing a message integrity check and dynamically changing keys. WEP is fundamentally broken and easily cracked, regardless of key length.
Question 6: Which of the following authentication frameworks is used by WPA2-Enterprise and WPA3-Enterprise to provide port-based network access control, requiring individual users to authenticate before gaining access?
- PSK
- SAE
- WPS
- IEEE 802.1X (Correct answer)
Correct answer: IEEE 802.1X
IEEE 802.1X is an authentication framework that provides port-based network access control for both wired and wireless networks. In a WPA2/WPA3-Enterprise environment, 802.1X is used to pass authentication information (often using an EAP method) between a client, an access point (the authenticator), and an authentication server (like RADIUS).
