CWSP CWSP-208 Syllabus Exam Questions Answers

A Denial-of-Service (DoS) attack focuses on preventing legitimate users from accessing network resources. In this case, the attacker has not accessed files or data but is interrupting services. This aligns perfectly with a DoS attack scenario.

Clients seek connectivity when their connection is lost. If the attacker broadcasts a matching SSID on a different channel and the client is disconnected (via RF jamming or deauthentication), the client will often reassociate with the stronger signal or first-responding AP broadcasting the same SSID, even if it's rogue.

Incorrect:

A. SNR alone doesn't force reassociation—clients consider multiple factors.

B. SSID priority is not a standardized field influencing client behavior.

D. Clients won’t reassociate based purely on advertised data rates unless connectivity is disrupted and other AP parameters are more attractive.

The GTK (Group Temporal Key) is used to encrypt multicast/broadcast traffic.

Each SSID has a unique GTK.

Only clients on the same SSID (ABCData) will receive and be able to decrypt multicast traffic encrypted with ABCData’s GTK.

Incorrect:

A. Application-layer authentication does not affect GTK distribution.

C. Clients on other SSIDs (e.g., Guest, ABCVoice) have different GTKs and cannot decrypt ABCData’s multicast traffic.

D. Each SSID uses a unique GTK; GTKs are not shared across SSIDs.

The PTK (Pairwise Transient Key) is derived during the 4-Way Handshake using:

PMK (from PSK or EAP authentication)

ANonce and SNonce (nonces from authenticator and supplicant)

MAC addresses of client and AP

The PTK is then split into keys used for encryption and integrity protection.

Incorrect:

A. PSK can derive the PMK, but not the PTK directly.

B. GMK is used to derive the GTK, not PTK.

D. GTK is for group traffic encryption.

E & F. PK and KCK are components of PTK or alternate key usage—not used to derive PTK.