GAWN Exam Questions

Which attack is MOST directly associated with WEP IV weaknesses?

You find an SSID using WPA3-Personal but also advertising "transition mode". What does that imply?

A client associates to an evil twin AP with stronger signal and same SSID. Which client-side behavior MOST enables this?

Which management frames are protected by PMF when negotiated?

Which is the MOST effective audit recommendation to reduce credential theft risk in WPA2- Enterprise?

A capture shows EAPOL Message 2/4 includes SNonce and MIC. What does Message 2 primarily prove?

Which control BEST mitigates WPS brute-force risk?

Which statement about GCMP is MOST accurate?

A wireless survey finds large areas at -80 dBm RSSI for the corporate SSID. From an auditor viewpoint, the MOST likely security risk is:

Which device is the authoritative source for "who authenticated" in WPA2-Enterprise?

An auditor sees EAP method "EAP-MD5" enabled. What is the best classification?

Which wireless condition MOST impacts throughput due to contention, not PHY rate?

What is the MOST direct mitigation for deauth attacks in legacy WPA2 networks?

A capture shows RSN AKM 00-0f-ac:3. What does that indicate?

Which is MOST likely to leak a hidden SSID across the air repeatedly?

Which attack focuses on manipulating client behavior to join a network by answering probes broadly?

A WPA2-Enterprise deployment uses VLAN assignment per user/group. Where is VLAN assignment MOST commonly enforced?

Which IEEE amendment is most associated with fast roaming improvements?

An auditor sees "Open" security but encrypted frames after association using OWE. What is the best description?

Which audit evidence BEST supports a finding of "rogue AP" presence?

Which is TRUE about Wi-Fi "transition mode" SSIDs (e.g., WPA2/WPA3)?

An auditor sees EAPOL frames but no DHCP/ARP from the client. What phase is MOST likely underway?

Which statement about WIPS vs WIDS is MOST accurate?

Which AP misconfiguration MOST increases risk of offline cracking?

A capture shows the client and AP both advertise PMF capable, but association proceeds without PMF. What is MOST likely?

In WPA2, which key encrypts broadcast/multicast traffic?

Which is the MOST accurate statement about "client isolation" (AP isolation)?

A Wireshark decode shows RSN Capabilities "Replay Counter: 16". What does that primarily relate to?

Which is a common indicator of a "honeypot/evil twin" during assessment?

A WPA2-Enterprise environment uses EAP-TLS. Which audit weakness is MOST critical?

Which U.S. 2.4 GHz channel is NOT permitted for standard Wi-Fi client operation?

Which metric BEST represents link quality relative to interference?

Which attack is MOST directly associated with TKIP weaknesses (not AES)?

A wireless controller shows many authentication failures from unknown MACs across multiple APs. What audit concern is MOST plausible?

Which 802.11 frame category includes RTS/CTS/ACK?

Which is the BEST practice for preventing users from connecting to rogue enterprise SSIDs?

An AP is configured for WPA2-Enterprise, but the client is prompted to "enter a password" instead of selecting a certificate. What is MOST likely?

Which is a realistic limitation of relying solely on MAC filtering?

Which is MOST likely to be impacted by RF jamming?

A site requires strong roaming for VoWiFi. Which standard is MOST relevant?

Which observed behavior is MOST consistent with a client performing directed probes for a hidden SSID?

A capture includes Group Key Handshake frames. What does that MOST likely indicate?

Which is the MOST accurate statement about WPA3-SAE vs WPA2-PSK regarding offline guessing?

Which attack uses forced disconnects to increase chance of capturing EAPOL handshakes?

Which of the following is the MOST defensible "high severity" wireless finding in an enterprise?

A capture shows 802.11 Authentication frames with algorithm "Open System". What does that indicate?

What is the MOST accurate audit statement about "hidden SSID + strong WPA2"?

Which item is MOST useful to differentiate multiple APs advertising the same SSID?

A WLAN uses 802.11r FT over-the-air. Which AKM suite commonly indicates this for PSK-based FT?

Which is the MOST accurate statement about "OWE transition mode"?