Examkin

Question

Difficulty: EasyNetwork and Wireless Attack Indicators

A network security administrator is analyzing wireless performance logs after users report sudden network disconnection across an entire office floor. The administrator suspects a physical Radio Frequency (RF) jamming attack rather than an 802.11 deauthentication attack. Which of the following indicators specifically suggest an RF jamming attack is occurring? (Select TWO)

  1. A sudden, significant increase in the physical layer noise floor across wireless frequency bandsAnswer
  2. Simultaneous loss of wireless signal and throughput across all local channels regardless of access point BSSIDAnswer
  3. C
    A high volume of spoofed 802.11 management frames containing disassociation reason codes
  4. D
    An unauthorized access point broadcasting a duplicate corporate SSID with a stronger signal

Answer

The indicators of an RF jamming attack are a sudden, significant increase in the physical layer noise floor across wireless frequency bands, and simultaneous loss of wireless signal and throughput across all local channels regardless of access point BSSID.
RF jamming attacks flood the physical radio frequency bands with continuous electromagnetic noise. This manifests as a sharp increase in the physical layer noise floor and causes widespread signal degradation across all wireless channels within range of the jamming device, irrespective of specific network SSIDs or access point identifiers.

Step-by-Step Solution

1
Differentiate between Layer 1 physical attacks and Layer 2 protocol attacks.
RF jamming is a Layer 1 (Physical layer) attack that disrupts radio signals directly, whereas deauthentication attacks operate at Layer 2 (Data Link layer) using 802.11 management frames.
Identifying the OSI layer of the symptom helps narrow down the correct attack indicators.
2
Evaluate physical RF noise metrics and channel-wide disruption.
Jammers flood radio frequencies with noise, which increases the noise floor measurement on spectrum analyzers and blocks all transmissions across affected channels.
RF jammers degrade the Signal-to-Noise Ratio (SNR) physically without relying on valid Wi-Fi frames.

Key Concept

RF Jamming vs. 802.11 Frame-Based Attacks
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic