Examkin

Security Fundamentals

298 questions

All types298Multiple choice157Multiple select64Matching56Ordering21
Question 161Question →

A network administrator needs to deploy a centralized AAA solution specifically for managing router and switch command-line interface (CLI) administration. The security team mandates that every individual command entered by an administrator must be evaluated and authorized independently, and all data within the protocol packet body must be encrypted during transport. Which protocol satisfies these operational requirements?

Show answer & explanation

Answer: TACACS+, because it encrypts the entire packet payload and decouples authentication from authorization.

Answer

TACACS+, because it encrypts the entire packet payload and decouples authentication from authorization.
TACACS+ (Terminal Access Controller Access-Control System Plus) is designed specifically for administrative network device management. It uses TCP port 49 for reliable transport, encrypts the entire payload of every packet, and decouples authentication, authorization, and accounting. This separation permits individual command authorization checks for administrative sessions.

Step-by-Step Solution

1
Analyze the requirements for command authorization and encryption.
The requirement specifies per-command authorization and full packet body payload encryption.
Device management requires granular authorization per CLI command, whereas network access control (802.1X) typically uses user/port-level authorization.
2
Evaluate TACACS+ capabilities against the requirements.
TACACS+ uses TCP port 49, separates Authentication and Authorization into modular components (allowing per-command check), and encrypts the complete packet payload.
Separating authentication from authorization allows a network device to query the AAA server for authorization rights on every CLI command executed.
3
Contrast TACACS+ capabilities with RADIUS capabilities.
RADIUS operates over UDP (ports 1812/1813), combines authentication and authorization into a unified response, and encrypts only the user password field within packets.
Because RADIUS combines authentication and authorization, it cannot perform per-command authorization checks efficiently.

Key Concept

TACACS+ vs RADIUS Architectural and Functional Differences
Estimated Time:1m 15s
Question 162Question →

An enterprise network engineering team is deploying AAA services across core routers and wireless LAN controllers. The design requires differentiating protocols used for CLI administrative access versus port-based network access control. Which TWO of the following statements correctly compare the operational characteristics of TACACS+ and RADIUS in this environment?

Select all that apply

Show answer & explanation

Answer: RADIUS combines authentication and authorization into unified transaction packets, whereas TACACS+ decouples authentication, authorization, and accounting into distinct and independent processes.; TACACS+ encrypts the entire body of the packet following the header, whereas RADIUS encrypts only the password field within the packet payload.

Answer

The correct statements are that RADIUS combines authentication and authorization into unified transaction packets while TACACS+ decouples them into distinct processes, and TACACS+ encrypts the entire body of the packet following the header while RADIUS encrypts only the password field.
RADIUS integrates authentication and authorization into single transactions (Access-Request/Access-Accept), while TACACS+ decouples all three AAA elements. Additionally, TACACS+ encrypts the entire body of every packet following the header, whereas RADIUS leaves packet headers and non-password attributes unencrypted in transit.

Step-by-Step Solution

1
Analyze protocol architecture and functional separation
Identify that RADIUS combines authentication and authorization, while TACACS+ separates AAA functions.
RADIUS sends authorization attributes inside authentication response packets (Access-Accept), whereas TACACS+ allows granular, separate authorization requests.
2
Evaluate transport layer protocols and port assignments
Verify transport protocols: TACACS+ uses TCP port 49; RADIUS uses UDP ports 1812 and 1813.
TACACS+ requires connection-oriented TCP reliability, whereas RADIUS uses connectionless UDP.
3
Examine packet payload encryption mechanisms
Determine packet encryption scope for both protocols.
TACACS+ encrypts the entire packet body following the header, protecting all AAA data, whereas RADIUS encrypts only the password attribute.

Key Concept

Operational differences between TACACS+ and RADIUS protocols within the AAA framework.
Question 163Question →

A network security policy requires allowing database traffic to a server while restricting other communications. An engineer applies the following named extended IPv4 Access Control List (ACL) inbound on interface GigabitEthernet0/0/1 of a Cisco router:

text
ip access-list extended RESTRICT_DB
permit tcp 10.20.10.0 0.0.0.255 host 10.20.30.50 eq 1433
deny ip 10.20.10.0 0.0.0.255 host 10.20.30.50

Users on subnet 10.20.10.0/2410.20.10.0/24 report that they cannot reach a web server located at 10.20.30.8010.20.30.80 over HTTP (TCP port 80). Which statement explains why the router drops the HTTP traffic destined for 10.20.30.8010.20.30.80?

Show answer & explanation

Answer: The unwritten implicit deny any statement at the end of the ACL drops all unpermitted IPv4 traffic.

Answer

The unwritten implicit deny any statement at the end of the ACL drops all unpermitted IPv4 traffic.
Cisco IOS IPv4 Access Control Lists evaluate rules sequentially from top to bottom. If a packet does not match any explicit permit or deny statement in the list, it hits the invisible implicit deny statement (`deny ip any any`) at the end of the ACL and is dropped. Since HTTP traffic to 10.20.30.8010.20.30.80 matches neither line 1 (which targets 10.20.30.50:143310.20.30.50:1433) nor line 2 (which targets host 10.20.30.5010.20.30.50), it is dropped by the implicit deny.

Step-by-Step Solution

1
Analyze the sequential processing of the ACL for traffic destined to 10.20.30.80 on TCP port 80.
Line 1 matches destination 10.20.30.50 on port 1433 (No match). Line 2 matches destination 10.20.30.50 (No match).
Traffic to host 10.20.30.80 port 80 does not satisfy the criteria of either explicit rule.
2
Determine the default behavior when a packet reaches the end of an ACL without matching any explicit entry.
The packet encounters the implicit 'deny ip any any' rule.
All Cisco IOS IPv4 ACLs have an invisible final statement that drops any packet not explicitly permitted.

Key Concept

ACL Sequential Evaluation and Implicit Deny Any
Question 164Question →

A network administrator is upgrading a remote office wireless LAN from WPA2-Personal to WPA3-Personal. The main objective of this upgrade is to protect user traffic against offline dictionary attacks if an attacker captures the initial wireless association exchange. Which key exchange mechanism implemented in WPA3-Personal mitigates this vulnerability?

Show answer & explanation

Answer: Simultaneous Authentication of Equals (SAE)

Answer

Simultaneous Authentication of Equals (SAE) is the key exchange mechanism in WPA3-Personal that prevents offline dictionary attacks.
Simultaneous Authentication of Equals (SAE) is the fundamental key exchange protocol defined in WPA3-Personal. Based on the Dragonfly key exchange algorithm, SAE provides zero-knowledge proof during authentication, making captured handshakes immune to offline dictionary attacks.

Step-by-Step Solution

1
Identify the deployment mode and vulnerability mentioned in the scenario
The scenario highlights upgrading WPA2-Personal to WPA3-Personal specifically to protect against offline dictionary password-guessing attacks resulting from captured handshakes.
WPA2-Personal relies on the 4-way handshake using a Pre-Shared Key (PSK), which is vulnerable to offline dictionary/brute-force attacks if captured.
2
Determine the WPA3-Personal authentication enhancement mechanism
WPA3-Personal replaces the 4-way PSK handshake with Simultaneous Authentication of Equals (SAE), based on the Dragonfly handshake.
SAE provides forward secrecy and renders captured handshake data useless for offline password cracking attempt tools.

Key Concept

WPA3-Personal Key Exchange (SAE vs WPA2 PSK)
Question 165Question →

A network security administrator is configuring centralized access control services across enterprise switches and routers. Match each operational capability or requirement on the left with the correct AAA framework element or protocol specification on the right.

Click a left item, then click its matching right item

Items

Per-command administrative authorization during active CLI management sessions
Payload encryption that obfuscates the entire packet body following the header
Authentication and authorization coupled together within single request/response pairs
Tracking user session duration, login timestamps, and commands executed for audit compliance

Matches

Show answer & explanation

Answer

Per-command CLI authorization matches TACACS+ architecture leveraging TCP port 49 and decoupled AAA functions. Full payload body encryption matches TACACS+ transport security mechanism providing full-body packet protection. Coupled authentication and authorization matches RADIUS protocol operation leveraging UDP ports 1812 and 1813. Session tracking and audit logging matches the Accounting component of the AAA framework.
TACACS+ uses TCP port 49 and decouples AAA functions to permit per-command authorization and full packet payload encryption. RADIUS operates over UDP ports 1812 (Authentication/Authorization) and 1813 (Accounting), combining authentication and authorization in a single transaction while only encrypting passwords. Accounting tracks user session metrics and activity logs.

Step-by-Step Solution

1
Analyze protocol modularity for per-command authorization.
Identified TACACS+ as the protocol that decouples AAA services, allowing individual command authorization over TCP port 49.
RADIUS binds authentication and authorization together, making fine-grained CLI command authorization impossible.
2
Evaluate packet encryption methods between AAA protocols.
Matched full body encryption to TACACS+, which encrypts the entire payload after the 12-byte header.
RADIUS only encrypts the password field in Access-Request packets, leaving the rest of the packet body in cleartext.
3
Identify protocol binding for combined authentication/authorization.
Matched combined authentication and authorization to RADIUS over UDP ports 1812/1813.
RADIUS returns authorization attributes directly inside the Access-Accept response during authentication.
4
Determine the functional role of audit logging in AAA.
Matched session duration and command execution tracking to the Accounting framework pillar.
Accounting logs user activities and resource usage after authentication and authorization occur.

Key Concept

AAA Protocol Mechanics & Functional Separation (TACACS+ vs RADIUS)
Estimated Time:1m 30s
Question 166Question →

A network engineer is reviewing security standards to upgrade an organization's wireless network infrastructure to WPA3. Which TWO statements accurately describe the security enhancements and requirements introduced in WPA3 compared to WPA2? (Select two.)

Select all that apply

Show answer & explanation

Answer: WPA3-Personal replaces the legacy pre-shared key (PSK) four-way handshake with Simultaneous Authentication of Equals (SAE) to protect against offline dictionary attacks.; WPA3 mandates the use of Protected Management Frames (PMF) across all connections to defend against wireless management frame spoofing.

Answer

WPA3 introduces Simultaneous Authentication of Equals (SAE) in Personal mode to protect against dictionary attacks, and mandates Protected Management Frames (PMF) on all connections.
WPA3 introduces key cryptographic enhancements over WPA2. First, WPA3-Personal replaces the legacy WPA2 PSK four-way handshake with Simultaneous Authentication of Equals (SAE), which protects against offline dictionary attacks and provides forward secrecy. Second, WPA3 mandates Protected Management Frames (PMF / IEEE 802.11w) across all client connections to protect against management frame injection and deauthentication attacks.

Step-by-Step Solution

1
Analyze WPA3-Personal authentication improvements over WPA2-Personal.
Identified that WPA3-Personal replaces the PSK four-way handshake with Simultaneous Authentication of Equals (SAE), preventing offline password guessing.
SAE uses Dragonfly key exchange so that an attacker capturing the handshake cannot perform offline dictionary attacks.
2
Evaluate management frame protection requirements in WPA3.
Confirmed that Protected Management Frames (PMF / IEEE 802.11w) are mandatory in WPA3.
PMF prevents deauthentication and disassociation spoofing attacks by encrypting/authenticating management frames.
3
Examine distractor statements regarding RADIUS deployment and TKIP ciphers.
Disqualified statements claiming WPA3-Personal requires RADIUS or that WPA3 uses TKIP.
RADIUS is required for 802.1X Enterprise mode, not Personal mode. TKIP is an insecure legacy cipher prohibited in WPA3.

Key Concept

WPA3 Security Improvements: SAE Key Exchange and Mandatory PMF
Estimated Time:1m 30s
Question 167Question →

A network administrator is deploying a high-security wireless LAN on a Cisco Wireless LAN Controller (WLC) configured for WPA3-Enterprise authentication. Which operational feature is mandatory for all client devices connecting to this WLAN?

Show answer & explanation

Answer: Support and active enforcement of Protected Management Frames (PMF)

Answer

Support and active enforcement of Protected Management Frames (PMF)
The WPA3 security specification makes Protected Management Frames (PMF, IEEE 802.11w) mandatory for all device connections in both WPA3-Personal and WPA3-Enterprise deployments. PMF protects unicast and multicast management frames—such as deauthentication and disassociation frames—against eavesdropping and spoofing.

Step-by-Step Solution

1
Identify the key cryptographic and structural enhancements introduced by the WPA3 standard.
Recognize that Protected Management Frames (PMF / IEEE 802.11w) are mandatory across all WPA3 modes (Personal and Enterprise).
PMF prevents attackers from forging management frames, such as deauthentication or disassociation packets, mitigating Wireless DoS attacks.
2
Evaluate client-side compatibility requirements for joining WPA3 WLANs.
Determine that connected clients must explicitly support PMF negotiation during association.
Unlike WPA2 where PMF was optional, WPA3 enforces PMF as a non-negotiable security baseline.

Key Concept

WPA3 Mandatory Protected Management Frames (PMF)
Question 168Question →

Match each wireless security protocol or mode with its primary key exchange mechanism or encryption characteristic.

Click a left item, then click its matching right item

Items

WPA2-Personal
WPA3-Personal
WPA3-Enterprise (192-bit mode)
Opportunistic Wireless Encryption (OWE)

Matches

Show answer & explanation

Answer

WPA2-Personal pairs with CCMP (AES-128) and PSK 4-way handshake; WPA3-Personal pairs with Simultaneous Authentication of Equals (SAE); WPA3-Enterprise (192-bit mode) pairs with GCMP-256, EAP-TLS, and PMF; OWE pairs with unauthenticated encryption on open networks using Diffie-Hellman key exchange.
Each wireless security protocol uses distinct key exchange mechanisms and encryption ciphers: WPA2-Personal relies on PSK with CCMP (AES-128); WPA3-Personal introduces SAE to mitigate dictionary attacks; WPA3-Enterprise 192-bit mode mandates GCMP-256 and EAP-TLS; OWE delivers unauthenticated encryption over open networks using Diffie-Hellman key exchanges.

Step-by-Step Solution

1
Identify the authentication and encryption suite for legacy WPA2-Personal.
WPA2-Personal uses PSK authentication with a 4-way handshake and CCMP (AES-128) encryption.
This is the baseline IEEE 802.11i implementation for pre-shared key deployments.
2
Identify the key exchange enhancement in WPA3-Personal.
WPA3-Personal mandates Simultaneous Authentication of Equals (SAE).
SAE prevents password guessing attacks by validating authentication without exposing pre-shared secrets.
3
Identify the high-security requirements of WPA3-Enterprise 192-bit mode.
It specifies GCMP-256 cipher suite along with EAP-TLS and mandatory PMF.
Enterprise 192-bit mode enforces top-tier cryptographic standards for sensitive deployments.
4
Identify the role of Opportunistic Wireless Encryption (OWE).
OWE encrypts traffic over open wireless networks using Diffie-Hellman key negotiation.
OWE allows open hotspots to encrypt wireless transmission without requiring user passphrases.

Key Concept

Wireless Security Protocols (WPA, WPA2, WPA3, OWE)
Estimated Time:1m 30s
Question 169Question →

A wireless network engineer is reviewing protocol requirements to transition an enterprise Wi-Fi infrastructure from WPA2 to WPA3 across corporate and guest SSIDs. Which TWO statements correctly describe key structural and operational differences between WPA3 and legacy WPA2 standards?

Select all that apply

Show answer & explanation

Answer: WPA3-Personal mandates the use of Simultaneous Authentication of Equals (SAE) for initial key exchange to mitigate offline password guessing and dictionary attacks.; Protected Management Frames (PMF / IEEE 802.11w) are strictly mandatory for all native WPA3 connections.

Answer

The correct statements are that WPA3-Personal mandates Simultaneous Authentication of Equals (SAE) to protect against offline dictionary attacks, and Protected Management Frames (PMF) are mandatory across all native WPA3 network connections.
WPA3 introduces key improvements over WPA2: Simultaneous Authentication of Equals (SAE) replaces WPA2-Personal's Pre-Shared Key (PSK) 4-way handshake to protect against offline dictionary attacks and provide forward secrecy. Additionally, Protected Management Frames (PMF / IEEE 802.11w) are mandatory across all native WPA3 network connections to secure control and management traffic against spoofing.

Step-by-Step Solution

1
Analyze WPA3-Personal key exchange mechanisms
Identified that WPA3-Personal uses Dragonfly/SAE (Simultaneous Authentication of Equals) instead of the WPA2 PSK 4-way handshake, preventing offline dictionary attacks.
SAE provides forward secrecy and protects authentication exchanges even when weak passwords are chosen.
2
Evaluate WPA3 Management Frame Protection requirements
Confirmed that IEEE 802.11w Protected Management Frames (PMF) are negotiated as required (mandatory) in WPA3 mode.
PMF shields unicast and multicast management frames against deauthentication and disassociation spoofing.
3
Verify legacy cipher and enterprise framework compatibility
Disproved claims that WPA3 uses TKIP or removes 802.1X.
TKIP is explicitly forbidden in WPA3 due to security vulnerabilities, and WPA3-Enterprise retains 802.1X/EAP.

Key Concept

WPA3 Security Enhancements (SAE and Mandatory PMF)
Question 170Question →

A small business seeks to secure its employee Wi-Fi network against offline brute-force and dictionary attacks if wireless traffic captures occur. The company does not deploy a centralized AAA or RADIUS server. Which wireless security protocol and key exchange mechanism should be configured on the Wireless LAN Controller (WLC) to satisfy these requirements?

Show answer & explanation

Answer: WPA3-Personal using Simultaneous Authentication of Equals (SAE)

Answer

WPA3-Personal using Simultaneous Authentication of Equals (SAE)
WPA3-Personal replaces the traditional WPA2 4-way handshake with Simultaneous Authentication of Equals (SAE), based on the Dragonfly key exchange algorithm. SAE provides forward secrecy and effectively mitigates offline dictionary and brute-force attacks even if passwords are simple, all without requiring an 802.1X RADIUS authentication server.

Step-by-Step Solution

1
Analyze authentication infrastructure constraints
Since the organization has no AAA/RADIUS server, Enterprise modes (802.1X/EAP) cannot be implemented. The solution must use a Personal (Preshared Key) deployment model.
Enterprise security modes rely on 802.1X RADIUS communication to authenticate users against a centralized backend directory.
2
Evaluate key exchange mechanisms for PSK protection
WPA2-Personal uses a 4-way handshake vulnerable to offline dictionary/brute-force attacks if captured. WPA3-Personal replaces this mechanism with Simultaneous Authentication of Equals (SAE).
SAE is based on the Dragonfly handshake algorithm, which provides zero-knowledge proof key establishment, preventing passive offline key-cracking attempts.
3
Select the matching configuration option
WPA3-Personal utilizing SAE delivers pre-shared key simplicity without requiring RADIUS while guaranteeing protection against offline dictionary attacks.
Meets both operational constraints: no RADIUS server required and resistant to handshake capture attacks.

Key Concept

Wireless Security Protocols: WPA3-Personal SAE vs WPA2-Personal PSK
Question 171Question →

A network administrator is upgrading a corporate Wireless LAN Controller (WLC) to meet stringent government cryptographic requirements. The administrator configures a new SSID operating in WPA3-Enterprise 192-bit mode. Which encryption cipher suite is mandated by WPA3-Enterprise 192-bit mode to protect data payload frames?

Show answer & explanation

Answer: GCMP-256 (Galois/Counter Mode Protocol with 256-bit encryption)

Answer

GCMP-256 (Galois/Counter Mode Protocol with 256-bit encryption)
Galois/Counter Mode Protocol with 256-bit encryption (GCMP-256) is mandated by the IEEE 802.11i / WPA3 specifications for WPA3-Enterprise 192-bit mode. This mode provides higher-grade cryptographic protection aligned with Commercial National Security Algorithm (CNSA) suite standards.

Step-by-Step Solution

1
Identify the specific wireless security framework and operational mode requested
The scenario specifies WPA3-Enterprise in 192-bit security mode (CNSA suite compliant).
Different WPA3 operating modes specify distinct cryptographic algorithms and key sizes.
2
Evaluate the cipher suite requirements for WPA3-Enterprise 192-bit mode
WPA3-Enterprise 192-bit mode requires GCMP-256 for authenticated data encryption, BIP-GMAC-256 for management frame protection, and EAP-TLS with SHA-384 for authentication.
Standard WPA2/WPA3 Enterprise 128-bit modes use CCMP-128, whereas 192-bit mode upgrades the cipher suite to 256-bit GCMP.

Key Concept

WPA3-Enterprise 192-bit Security Mode Requirements
Question 172Question →

Match each wireless security protocol or feature to its defining operational characteristic.

Click a left item, then click its matching right item

Items

Protected Management Frames (PMF)
Temporal Key Integrity Protocol (TKIP)
Opportunistic Wireless Encryption (OWE)
Simultaneous Authentication of Equals (SAE)

Matches

Show answer & explanation

Answer

Protected Management Frames (PMF) matches securing unicast/multicast management frames; TKIP matches legacy RC4 encapsulation with key mixing; OWE matches unauthenticated encryption on open networks; SAE matches prevention of offline dictionary attacks via Dragonfly key exchange.
Each protocol or mechanism serves a distinct function within wireless security architectures: PMF protects management action frames from forgery, TKIP relies on RC4 for legacy WPA security, OWE provides unauthenticated encryption for open access, and SAE uses Dragonfly key exchange to secure pre-shared key establishment in WPA3-Personal.

Step-by-Step Solution

1
Identify the primary role of Protected Management Frames (PMF)
PMF (IEEE 802.11w) protects management frames (such as deauth packets) against spoofing and eavesdropping; it is mandatory in WPA3.
Security standards mandate PMF to prevent common Wireless Denial of Service (DoS) attacks.
2
Identify the encryption characteristics of Temporal Key Integrity Protocol (TKIP)
TKIP uses RC4 stream cipher with dynamic temporal key mixing as an upgrade path from WEP.
TKIP was designed to run on legacy WEP hardware while fixing key reuse flaws.
3
Identify the operation of Opportunistic Wireless Encryption (OWE)
OWE uses Diffie-Hellman key exchange to encrypt open Wi-Fi networks without requiring client authentication.
Enhanced Open (OWE) provides opportunistic privacy for guest networks without passphrase configuration.
4
Identify the authentication protocol used in Simultaneous Authentication of Equals (SAE)
SAE utilizes the Dragonfly handshake algorithm to negotiate shared keys securely and neutralize offline dictionary attacks.
SAE replaces the traditional 4-way handshake PSK model in WPA3-Personal.

Key Concept

Wireless Security Protocols and Cipher Mechanics
Question 173Question →

A network administrator is transitioning a retail store Wi-Fi network from WPA2-Personal to WPA3-Personal. During testing, the administrator confirms that pre-shared key (PSK) authentication has been replaced by Simultaneous Authentication of Equals (SAE) based on the Dragonfly key exchange algorithm. Which security enhancement does SAE deliver when compared to the traditional WPA2 4-way handshake?

Show answer & explanation

Answer: It provides forward secrecy and built-in resistance to offline dictionary attacks even when password complexity is low.

Answer

SAE provides forward secrecy and prevents offline dictionary attacks by eliminating the predictable 4-way handshake password exchange used in WPA2-Personal.
WPA3-Personal mandates Simultaneous Authentication of Equals (SAE), replacing the vulnerable 4-way WPA2 PSK exchange. SAE leverages the Dragonfly key exchange protocol, which prevents passive eavesdroppers from capturing traffic and cracking passwords via offline dictionary attacks, while also guaranteeing forward secrecy.

Step-by-Step Solution

1
Analyze WPA2-Personal vulnerability
WPA2-Personal uses a 4-way handshake based on a static PSK. An attacker capturing the handshake can perform offline brute-force or dictionary attacks to reveal the PSK.
The WPA2 pairwise master key (PMK) derivation allows passive offline analysis.
2
Evaluate WPA3-Personal SAE operation
WPA3-Personal replaces the standard PSK 4-way handshake with Simultaneous Authentication of Equals (SAE), based on the Diffie-Hellman Dragonfly key exchange.
SAE executes a peer-to-peer authentication exchange before key establishment.
3
Identify key cryptographic advantages
SAE ensures forward secrecy (session keys cannot be compromised even if the password is discovered later) and renders offline dictionary attacks useless because each attempt requires an active network exchange.
Invalid authentication attempts require live interactions with the AP, frustrating passive capture analysis.

Key Concept

WPA3-Personal Simultaneous Authentication of Equals (SAE)
Question 174Question →

Match each wireless security framework or protocol with its primary key exchange or encryption mechanism.

Click a left item, then click its matching right item

Items

WPA3-Personal
WPA2-Enterprise
Enhanced Open (OWE)
WPA-Personal (Legacy)

Matches

Show answer & explanation

Answer

WPA3-Personal matches with SAE key exchange. WPA2-Enterprise matches with 802.1X/RADIUS authentication. Enhanced Open (OWE) matches with unauthenticated Diffie-Hellman encryption. WPA-Personal matches with deprecated TKIP/RC4 encryption.
Each wireless protocol maps to its distinct standard implementation: WPA3-Personal uses SAE for Dragonfly key exchange, WPA2-Enterprise mandates 802.1X/EAP with RADIUS, Enhanced Open provides OWE encryption for unauthenticated networks, and legacy WPA uses TKIP.

Step-by-Step Solution

1
Identify key characteristics of WPA3-Personal.
WPA3-Personal introduces SAE (Simultaneous Authentication of Equals) to eliminate offline brute-force attacks.
SAE is the hallmark replacement for PSK in WPA3.
2
Identify key characteristics of WPA2-Enterprise.
Enterprise modes specifically demand 802.1X with EAP and RADIUS servers.
Personal modes use pre-shared keys, whereas Enterprise modes use centralized AAA architecture.
3
Identify key characteristics of Enhanced Open (OWE).
Enhanced Open uses OWE (Diffie-Hellman key exchange) to encrypt traffic on open networks without password entry.
OWE protects public Wi-Fi eavesdropping without authentication.
4
Identify key characteristics of WPA-Personal (Legacy).
Legacy WPA relied on TKIP/RC4 prior to the introduction of CCMP/AES in WPA2.
TKIP was designed as an interim migration path from WEP.

Key Concept

Wireless Security Protocols and Authentication/Encryption Mechanisms
Question 175Question →

A network engineer is configuring a new Wireless LAN Controller (WLC) deployment to support WPA3-Enterprise across an enterprise infrastructure. Which two operational characteristics or requirements strictly apply to WPA3-Enterprise deployments? (Select two.)

Select all that apply

Show answer & explanation

Answer: Protected Management Frames (PMF) must be set to required and enforced on the WLAN.; Client authentication relies on IEEE 802.1X and EAP protocols rather than Simultaneous Authentication of Equals (SAE).

Answer

WPA3-Enterprise requires Protected Management Frames (PMF) to be enforced and uses IEEE 802.1X/EAP frameworks for client authentication.
WPA3 mandates the use of Protected Management Frames (PMF / IEEE 802.11w) across all implementations to guard against eavesdropping and frame forging. Additionally, WPA3-Enterprise relies on IEEE 802.1X authentication with EAP methods for centralized user access control, contrasting with WPA3-Personal which employs SAE.

Step-by-Step Solution

1
Analyze key security requirements for the WPA3 standard.
PMF (IEEE 802.11w) is mandatory across all WPA3 modes (Personal and Enterprise) to protect against management frame attacks.
WPA3 eliminates optional PMF negotiated states found in WPA2 and makes management protection compulsory.
2
Differentiate between Personal and Enterprise operational modes in WPA3.
WPA3-Personal replaces PSK with SAE (Simultaneous Authentication of Equals), whereas WPA3-Enterprise mandates IEEE 802.1X and EAP authentication.
Enterprise wireless networks require individual user identity verification backed by a centralized AAA infrastructure.

Key Concept

WPA3-Enterprise mandatory security requirements (PMF enforcement and 802.1X/EAP authentication architecture)
Question 176Question →

A network administrator is migrating an enterprise wireless network from WPA2-Enterprise to WPA3-Enterprise by enabling a transition mode on a Cisco Wireless LAN Controller (WLC). Which two statements accurately describe the protocol mechanisms and operational requirements for this transition deployment? (Select two.)

Select all that apply

Show answer & explanation

Answer: Protected Management Frames (PMF) must be set to optional (capable) on the WLAN to allow legacy WPA2 clients to connect alongside WPA3 clients.; Both WPA2-Enterprise and WPA3-Enterprise utilize the IEEE 802.1X framework and Extensible Authentication Protocol (EAP) for user authentication.

Answer

Protected Management Frames (PMF) must be set to optional (capable) on the WLAN to allow legacy WPA2 clients to connect alongside WPA3 clients, and both WPA2-Enterprise and WPA3-Enterprise utilize the IEEE 802.1X framework and Extensible Authentication Protocol (EAP) for user authentication.
Both WPA2-Enterprise and WPA3-Enterprise utilize the IEEE 802.1X port-based authentication architecture paired with EAP for centralized client credential verification via RADIUS. Furthermore, because WPA3 mandates Protected Management Frames (802.11w) while WPA2 does not, enabling transition mode on a Wireless LAN Controller requires setting PMF to optional (capable) so both modern WPA3 and legacy WPA2 clients can successfully associate.

Step-by-Step Solution

1
Analyze authentication requirements across WPA2-Enterprise and WPA3-Enterprise.
Identify that both enterprise standards use IEEE 802.1X/EAP with a backend RADIUS server for identity management.
Enterprise wireless security relies on 802.1X port-based access control regardless of whether WPA2 or WPA3 framing is in use.
2
Evaluate Protected Management Frame (PMF / 802.11w) configuration requirements for WLAN transition mode.
Determine that setting PMF to optional (capable) allows WPA3 devices to negotiate management frame protection while permitting WPA2 devices without PMF support to join.
WPA3 mandates PMF, whereas WPA2 does not require it; setting PMF to optional on the WLC resolves client compatibility gaps.

Key Concept

WPA2/WPA3 Enterprise authentication frameworks and Protected Management Frame (PMF) transition mode settings
Question 177Question →

A network administrator needs to deploy a secure wireless LAN for a small branch office. The security policy dictates that wireless client authentication must prevent offline dictionary attacks against pre-shared credentials and enforce Protected Management Frames (PMF), while avoiding the deployment cost and complexity of an external RADIUS or AAA server. Which wireless security deployment mode meets all of these requirements?

Show answer & explanation

Answer: WPA3-Personal using Simultaneous Authentication of Equals (SAE)

Answer

WPA3-Personal using Simultaneous Authentication of Equals (SAE)
WPA3-Personal uses Simultaneous Authentication of Equals (SAE), a peer-to-peer key exchange protocol based on the Dragonfly handshake. SAE prevents offline dictionary attacks even if weak passphrases are selected, provides forward secrecy, and mandates Protected Management Frames (PMF), fulfilling all requirements without requiring a RADIUS server.

Step-by-Step Solution

1
Analyze deployment constraints
Requirements are offline dictionary attack protection, mandatory Protected Management Frames (PMF), and operating without an external RADIUS/AAA server.
Branch offices without dedicated AAA infrastructure require a personal/passphrase mode rather than an enterprise mode.
2
Evaluate key exchange mechanisms
WPA3-Personal introduces Simultaneous Authentication of Equals (SAE), based on the Dragonfly key exchange algorithm.
SAE provides forward secrecy and renders captured handshakes immune to offline dictionary attacks.
3
Verify compliance with PMF standards
PMF (IEEE 802.11w) is optional in WPA2 but strictly mandatory in all WPA3 modes.
Selecting WPA3-Personal SAE ensures both PMF compliance and non-RADIUS operation.

Key Concept

WPA3-Personal key exchange via SAE and mandatory Protected Management Frames
Question 178Question →

An engineer audits an enterprise wireless deployment configured strictly for WPA3-Enterprise mode. During client connectivity testing, older legacy wireless client devices fail to associate with the SSID, even though their security profiles are configured with valid 802.1X EAP credentials. What mandatory feature of WPA3 security causes these legacy clients to fail association?

Show answer & explanation

Answer: Protected Management Frames (PMF) are strictly required for all associations.

Answer

Protected Management Frames (PMF) are strictly required for all associations.
Under the Wi-Fi Alliance WPA3 standard specification, Protected Management Frames (PMF / IEEE 802.11w) transition from being optional (as in WPA2) to strictly mandatory. Any legacy wireless client device that lacks support for PMF capability negotiation is rejected at association time by a WPA3-configured access point.

Step-by-Step Solution

1
Identify the protocol requirements introduced in the WPA3 wireless security standard.
WPA3 introduces mandatory Protected Management Frames (PMF / IEEE 802.11w) for both Personal and Enterprise operating modes.
PMF protects management frames such as deauthentication and disassociation from spoofing and eavesdropping attacks.
2
Evaluate the impact of mandatory PMF on legacy client devices.
Clients that do not support 802.11w PMF or only support optional PMF negotiation cannot complete the association handshake with an SSID running pure WPA3.
When an access point operates in WPA3 mode, PMF requirement is set to Required (Required/Mandatory), rejecting legacy clients lacking PMF support.

Key Concept

WPA3 Mandatory Protected Management Frames (PMF / IEEE 802.11w)
Question 179Question →

A network engineer is troubleshooting an IPsec site-to-site VPN tunnel established between a main office router and a remote branch router situated behind an intermediate Port Address Translation (PAT) gateway. During tunnel negotiation, Phase 1 completes successfully, but encrypted data packets fail to pass between the sites when NAT-Traversal (NAT-T) is disabled on both gateways. Which operational characteristic of IPsec explains why the PAT gateway drops the data phase traffic?

Show answer & explanation

Answer: Native Encapsulating Security Payload (ESP) operates directly over IP protocol 50 without Layer 4 TCP/UDP port headers, preventing PAT gateways from mapping multiple translated sessions.

Answer

Native Encapsulating Security Payload (ESP) operates directly over IP protocol 50 without Layer 4 TCP/UDP port headers, preventing PAT gateways from mapping multiple translated sessions.
The correct answer identifies that native Encapsulating Security Payload (ESP) uses IP protocol 50 without Layer 4 TCP or UDP port headers. Because Port Address Translation (PAT) relies on modifying Layer 4 port numbers to multiplex multiple private IP streams across a single public IP address, it cannot translate native ESP packets. Enabling NAT-Traversal (NAT-T) solves this issue by encapsulating ESP packets within UDP port 4500 headers, allowing PAT gateways to translate the traffic successfully.

Step-by-Step Solution

1
Analyze IPsec protocol headers for Phase 2 data plane traffic.
IPsec Encapsulating Security Payload (ESP) resides directly above the IP layer using IP protocol 50.
ESP does not contain Layer 4 source or destination port fields such as TCP or UDP.
2
Evaluate the operational mechanics of Port Address Translation (PAT).
PAT requires Layer 4 TCP or UDP port numbers to translate multiple internal IP addresses onto a single public IP address.
Without Layer 4 port identifiers, a PAT device cannot create unique translation entries in its translation table.
3
Determine the impact of disabling NAT-Traversal (NAT-T).
Without NAT-T, ESP packets are sent in their native format (IP protocol 50) rather than being encapsulated inside UDP port 4500 wrappers.
The intermediate PAT device cannot translate native ESP packets, causing Phase 2 data traffic to be dropped.

Key Concept

IPsec NAT-Traversal (NAT-T) and ESP Encapsulation Mechanics
Question 180Question →

An enterprise router is configured with the following extended IPv4 access control list applied inbound on interface GigabitEthernet0/0/0:

text ip access-list extended SECURE_APP permit tcp 172.16.5.0 0.0.0.255 host 10.0.1.20 eq 80 permit ip host 172.16.5.10 host 10.0.1.20

Host A (IP address 172.16.5.15) attempts to establish an HTTPS connection (TCP port 443) to the application server at 10.0.1.20. Which statement accurately describes how the router processes this traffic?

Show answer & explanation

Answer: The router drops the packet because it fails to match the TCP destination port in the first line and does not match the source host in the second line, causing it to fall through to the implicit deny.

Answer

The router drops the traffic because it fails to match both explicit permit rules and consequently hits the unwritten implicit deny clause at the end of the access list.
The correct response identifies that extended access control lists process rules top-down, checking source address, destination address, and protocol port numbers. For host 172.16.5.15 using HTTPS (port 443), line 1 fails because the destination port is 443 instead of 80. Line 2 fails because the source host address 172.16.5.15 does not match host 172.16.5.10. Consequently, the packet reaches the default implicit deny clause at the end of the list and is dropped.

Step-by-Step Solution

1
Evaluate the packet against the first access-list entry (`permit tcp 172.16.5.0 0.0.0.255 host 10.0.1.20 eq 80`).
The packet source IP 172.16.5.15 matches `172.16.5.0 0.0.0.255` and destination IP `10.0.1.20` matches `host 10.0.1.20`. However, the destination port is 443 (HTTPS), which does not equal port 80 (HTTP). Line 1 does not match.
Extended ACLs process criteria sequentially and require all specified Layer 3 and Layer 4 fields to match.
2
Evaluate the packet against the second access-list entry (`permit ip host 172.16.5.10 host 10.0.1.20`).
The packet source IP is 172.16.5.15, which does not match `host 172.16.5.10`. Line 2 does not match.
The `host` keyword strictly matches only the specific IP address designated.
3
Evaluate the packet against the end of the ACL structure.
Having failed all preceding explicit permit statements, the packet encounters the default implicit `deny ip any any` statement.
Cisco IOS automatically appends an invisible implicit deny statement to the end of every IPv4 access control list.

Key Concept

Extended Access Control List Sequential Matching and Implicit Deny Behavior
PreviousPage 9 / 15Next