nerdexam
GIAC

GPEN · Question #296

Mark works as a Network Administrator for Infonet Inc. The company has a Windows 2000 Active Directory domain-based network. The domain contains one hundred Windows XP Professional client computers…

The correct answer is C. Disable SSID Broadcast and enable MAC address filtering on all wireless access points. E. Configure the authentication type for the wireless LAN to Shared Key. F. On each client computer, add the SSID for the wireless LAN as the preferred network. Satisfying the dual requirement of auto-connecting authorized clients while hiding the network from unauthorized ones requires disabling SSID broadcast with MAC filtering, configuring WEP Shared Key authentication, and manually pre-configuring the SSID on each client.

Penetration Testing Foundations & Reconnaissance

Question

Mark works as a Network Administrator for Infonet Inc. The company has a Windows 2000 Active Directory domain-based network. The domain contains one hundred Windows XP Professional client computers. Mark is deploying an 802.11 wireless LAN on the network. The wireless LAN will use Wired Equivalent Privacy (WEP) for all the connections. According to the company's security policy, the client computers must be able to automatically connect to the wireless LAN. However, the unauthorized computers must not be allowed to connect to the wireless LAN and view the wireless network. Mark wants to configure all the wireless access points and client computers to act in accordance with the company's security policy. What will he do to accomplish this? Each correct answer represents a part of the solution. Choose three.

Options

  • AConfigure the authentication type for the wireless LAN to Open system.
  • BBroadcast SSID to connect to the access point (AP).
  • CDisable SSID Broadcast and enable MAC address filtering on all wireless access points.
  • DInstall a firewall software on each wireless access point.
  • EConfigure the authentication type for the wireless LAN to Shared Key.
  • FOn each client computer, add the SSID for the wireless LAN as the preferred network.

How the community answered

(54 responses)
  • A
    4% (2)
  • B
    11% (6)
  • C
    80% (43)
  • D
    6% (3)

Why each option

Satisfying the dual requirement of auto-connecting authorized clients while hiding the network from unauthorized ones requires disabling SSID broadcast with MAC filtering, configuring WEP Shared Key authentication, and manually pre-configuring the SSID on each client.

AConfigure the authentication type for the wireless LAN to Open system.

Open system authentication allows any device to complete the 802.11 authentication exchange without proving knowledge of the WEP key, meaning unauthorized computers can still associate with the access point despite WEP being enabled for data encryption.

BBroadcast SSID to connect to the access point (AP).

Broadcasting the SSID makes the wireless network name visible to all nearby devices during passive scanning, allowing unauthorized computers to discover and attempt to connect - directly violating the requirement to hide the network from unauthorized users.

CDisable SSID Broadcast and enable MAC address filtering on all wireless access points.Correct

Disabling SSID broadcast prevents the wireless network name from appearing in passive scans, so unauthorized devices cannot discover it exists and cannot attempt to join. Enabling MAC address filtering on all access points adds a second control layer by restricting 802.11 associations to only pre-registered hardware addresses, directly satisfying the requirement to block unauthorized computers.

DInstall a firewall software on each wireless access point.

Firewall software on access points filters IP traffic at Layer 3 and above after a device has already associated at the 802.11 link layer, so it does not prevent unauthorized devices from discovering the SSID broadcast or completing the wireless association process.

EConfigure the authentication type for the wireless LAN to Shared Key.Correct

Configuring WEP Shared Key authentication requires a connecting device to prove knowledge of the shared WEP key during the 802.11 authentication handshake - unlike Open system authentication, which permits any device to complete the authentication exchange regardless of whether it holds the correct key.

FOn each client computer, add the SSID for the wireless LAN as the preferred network.Correct

Because SSID broadcast is disabled, client computers cannot passively discover the network; adding the SSID as a preferred (manually pre-configured) network on each Windows XP client allows the wireless zero configuration service to automatically initiate connection to the non-broadcasting AP when in range, satisfying the auto-connect policy requirement.

Concept tested: WEP wireless LAN security - SSID, MAC filtering, shared key auth

Source: https://www.cisa.gov/news-events/news/securing-wireless-networks

Topics

#WEP#SSID broadcast#MAC filtering#802.11 authentication

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice