Examkin

Wireless Security Protocols (WPA, WPA2, WPA3)

27 questions

All types27Multiple choice15Multiple select6Matching6
Question 21Question →

A network administrator needs to deploy a secure wireless LAN for a small branch office. The security policy dictates that wireless client authentication must prevent offline dictionary attacks against pre-shared credentials and enforce Protected Management Frames (PMF), while avoiding the deployment cost and complexity of an external RADIUS or AAA server. Which wireless security deployment mode meets all of these requirements?

Show answer & explanation

Answer: WPA3-Personal using Simultaneous Authentication of Equals (SAE)

Answer

WPA3-Personal using Simultaneous Authentication of Equals (SAE)
WPA3-Personal uses Simultaneous Authentication of Equals (SAE), a peer-to-peer key exchange protocol based on the Dragonfly handshake. SAE prevents offline dictionary attacks even if weak passphrases are selected, provides forward secrecy, and mandates Protected Management Frames (PMF), fulfilling all requirements without requiring a RADIUS server.

Step-by-Step Solution

1
Analyze deployment constraints
Requirements are offline dictionary attack protection, mandatory Protected Management Frames (PMF), and operating without an external RADIUS/AAA server.
Branch offices without dedicated AAA infrastructure require a personal/passphrase mode rather than an enterprise mode.
2
Evaluate key exchange mechanisms
WPA3-Personal introduces Simultaneous Authentication of Equals (SAE), based on the Dragonfly key exchange algorithm.
SAE provides forward secrecy and renders captured handshakes immune to offline dictionary attacks.
3
Verify compliance with PMF standards
PMF (IEEE 802.11w) is optional in WPA2 but strictly mandatory in all WPA3 modes.
Selecting WPA3-Personal SAE ensures both PMF compliance and non-RADIUS operation.

Key Concept

WPA3-Personal key exchange via SAE and mandatory Protected Management Frames
Question 22Question →

An engineer audits an enterprise wireless deployment configured strictly for WPA3-Enterprise mode. During client connectivity testing, older legacy wireless client devices fail to associate with the SSID, even though their security profiles are configured with valid 802.1X EAP credentials. What mandatory feature of WPA3 security causes these legacy clients to fail association?

Show answer & explanation

Answer: Protected Management Frames (PMF) are strictly required for all associations.

Answer

Protected Management Frames (PMF) are strictly required for all associations.
Under the Wi-Fi Alliance WPA3 standard specification, Protected Management Frames (PMF / IEEE 802.11w) transition from being optional (as in WPA2) to strictly mandatory. Any legacy wireless client device that lacks support for PMF capability negotiation is rejected at association time by a WPA3-configured access point.

Step-by-Step Solution

1
Identify the protocol requirements introduced in the WPA3 wireless security standard.
WPA3 introduces mandatory Protected Management Frames (PMF / IEEE 802.11w) for both Personal and Enterprise operating modes.
PMF protects management frames such as deauthentication and disassociation from spoofing and eavesdropping attacks.
2
Evaluate the impact of mandatory PMF on legacy client devices.
Clients that do not support 802.11w PMF or only support optional PMF negotiation cannot complete the association handshake with an SSID running pure WPA3.
When an access point operates in WPA3 mode, PMF requirement is set to Required (Required/Mandatory), rejecting legacy clients lacking PMF support.

Key Concept

WPA3 Mandatory Protected Management Frames (PMF / IEEE 802.11w)
Question 23Question →

A network administrator is upgrading a wireless network from WPA2-Personal to WPA3-Personal to increase client authentication security. Which key exchange protocol does WPA3-Personal introduce to protect against offline dictionary attacks?

Show answer & explanation

Answer: Simultaneous Authentication of Equals (SAE)

Answer

Simultaneous Authentication of Equals (SAE)
Simultaneous Authentication of Equals (SAE) is the core key exchange protocol introduced in WPA3-Personal. Based on the Dragonfly handshake, SAE establishes a secure key exchange that prevents attackers from capturing handshakes over the air to perform offline dictionary attacks.

Step-by-Step Solution

1
Identify the authentication mechanism change between WPA2-Personal and WPA3-Personal.
WPA2-Personal uses a Pre-Shared Key (PSK) with a 4-Way Handshake, whereas WPA3-Personal upgrades to Simultaneous Authentication of Equals (SAE).
WPA3 mandates higher security standards to prevent offline password guessing attacks.
2
Analyze how SAE protects client authentication.
SAE provides a secure password-authenticated key exchange (based on the Dragonfly handshake) ensuring forward secrecy and resistance to passive capture/dictionary attacks.
Even if an attacker captures the wireless handshake, SAE prevents them from determining the pre-shared key offline.

Key Concept

WPA3-Personal Key Exchange (SAE vs PSK)
Question 24Question →

An network administrator is updating an enterprise wireless network configuration to implement WPA3-Personal. Which two enhancements does WPA3 provide over WPA2 to improve wireless connection security? (Select two)

Select all that apply

Show answer & explanation

Answer: Simultaneous Authentication of Equals (SAE) to defend against offline dictionary attacks; Mandatory Protected Management Frames (PMF) to protect management traffic against eavesdropping and forging

Answer

WPA3 improves security over WPA2 by introducing Simultaneous Authentication of Equals (SAE) to protect against offline dictionary attacks and mandating Protected Management Frames (PMF) to secure management frame exchanges.
WPA3 introduces Simultaneous Authentication of Equals (SAE) to replace the standard WPA2 pre-shared key 4-way handshake, offering protection against offline dictionary brute-force attempts. Additionally, WPA3 requires mandatory implementation of Protected Management Frames (PMF) to prevent malicious disassociation and deauthentication spoofing.

Step-by-Step Solution

1
Identify key authentication upgrades in WPA3-Personal
WPA3 replaces PSK with SAE (Simultaneous Authentication of Equals), rendering offline dictionary attacks ineffective even with weak passphrases.
SAE performs a resistant peer-to-peer key exchange (Dragonfly key exchange protocol).
2
Identify key management frame protections in WPA3
PMF (Protected Management Frames / IEEE 802.11w) is mandatory in WPA3 deployments.
PMF prevents attackers from forging management frames such as deauthentication attacks.

Key Concept

Wireless Security Protocols (WPA3 Features & Enhancements)
Question 25Question →

Which encryption cipher suite does the WPA2 wireless security standard use by default to ensure data confidentiality and integrity for wireless network traffic?

Show answer & explanation

Answer: AES-CCMP

Answer

AES-CCMP is the default encryption cipher suite used by WPA2.
WPA2 requires the use of Advanced Encryption Standard (AES) operating in Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP). This combination guarantees strong data confidentiality and frame authenticity.

Step-by-Step Solution

1
Identify the primary encryption mechanism required by the WPA2 standard.
WPA2 implements the full IEEE 802.11i standard, which specifies AES with CCMP as the mandatory cipher suite.
AES-CCMP provides strong 128-bit encryption along with Message Integrity Check (MIC) to ensure data privacy and authenticity.

Key Concept

WPA2 Default Encryption (AES-CCMP)
Question 26Question →

A network administrator configures a dual-mode WLAN on a Cisco Wireless LAN Controller (WLC) intended to support both modern WPA3-Personal devices and legacy WPA2-Personal client hardware during a corporate migration. WPA3-capable endpoints connect seamlessly; however, older WPA2-only devices consistently fail during the 802.11 association phase and cannot establish network connectivity. Frame captures reveal that the legacy stations receive association responses containing mandatory Protected Management Frames (PMF/802.11w) requirements. Which WLC configuration modification resolves this association failure for legacy endpoints while continuing to support WPA3-Personal clients?

Show answer & explanation

Answer: Set Management Frame Protection (MFP/PMF) to Optional (Capable) on the WLAN profile, allowing legacy stations without 802.11w support to associate.

Answer

Setting Management Frame Protection (MFP/PMF) to Optional (Capable) on the WLAN profile allows legacy stations without 802.11w support to associate.
The choice stating to set Management Frame Protection (MFP/PMF) to Optional (Capable) is correct because IEEE 802.11w PMF is mandatory in WPA3. When configuring WPA3-Personal Transition Mode to accommodate legacy WPA2 devices, setting PMF to Required prevents legacy clients that lack PMF code or hardware support from completing the 802.11 association process. Changing PMF to Optional enables WPA3 endpoints to use PMF while permitting WPA2 endpoints to connect without it.

Step-by-Step Solution

1
Analyze the WPA3-Personal vs WPA2-Personal migration requirements.
WPA3 mandates Protected Management Frames (PMF / IEEE 802.11w) and Simultaneous Authentication of Equals (SAE).
WPA3 security standards enforce PMF to prevent management frame spoofing attacks such as deauthentication attacks.
2
Evaluate the cause of the association failure for legacy WPA2 devices in transition mode.
Setting PMF to Required on the WLC forces all associating clients to support IEEE 802.11w. Legacy devices lacking 802.11w capabilities reject or are rejected during the association frame exchange.
Transition mode requires backward-compatible settings for optional feature negotiation.
3
Determine the correct WLC configuration adjustment.
Configuring PMF as Optional (Capable) on the WLAN allows WPA3 clients to negotiate PMF while permitting legacy WPA2 clients lacking 802.11w to complete association.
This configuration balances the strict security requirements of WPA3 with the physical hardware limitations of legacy WPA2 endpoints.

Key Concept

WPA3 Transition Mode and Protected Management Frames (PMF / IEEE 802.11w) compatibility requirements
Question 27Question →

A network technician is inspecting authentication behavior on a newly deployed Wi-Fi network configured for personal use. The security policy mandates protection against passive eavesdropping and offline password-dictionary attacks by utilizing a Dragonfly Key Exchange during association. Which wireless security protocol mechanism provides this specific key exchange functionality?

Show answer & explanation

Answer: Simultaneous Authentication of Equals (SAE)

Answer

Simultaneous Authentication of Equals (SAE)
Simultaneous Authentication of Equals (SAE) is the key exchange mechanism specified in WPA3-Personal. Built upon the Dragonfly Key Exchange protocol, SAE establishes a secure cryptographic key between the client and access point without revealing the passphrase, rendering captured authentication traffic immune to offline dictionary brute-force attempts.

Step-by-Step Solution

1
Identify the primary requirement in the scenario
The scenario requires a wireless security mechanism that uses Dragonfly Key Exchange to prevent offline dictionary attacks in a personal Wi-Fi deployment.
WPA3-Personal replaces the vulnerable WPA2 Pre-Shared Key (PSK) handshake with a secure zero-knowledge proof exchange.
2
Evaluate the key exchange protocol associated with WPA3-Personal
Simultaneous Authentication of Equals (SAE) is the standard protocol defined in IEEE 802.11-2016 / WPA3 for secure peer-to-peer key agreement using Dragonfly algorithm cryptography.
SAE guarantees forward secrecy and prevents brute-force dictionary attacks even when weak passwords are used.

Key Concept

WPA3-Personal Key Exchange via SAE
PreviousPage 2 / 2
Wireless Security Protocols (WPA, WPA2, WPA3) Practice Questions — Cisco CCNA — Page 2 | Examkin