Free CWSP-208 practice test: 30 questions with answers

WPA2-Personal relies on one pre-shared passphrase that all clients share, while WPA2-Enterprise uses 802.1X with an EAP method and an authentication server to authenticate each user or device. The other statements reverse the two modes or invent cipher and certificate rules that do not apply.

The switch port (or access point) is the authenticator: it relays EAP messages between the supplicant and the authentication server and keeps the controlled port blocked until authorization succeeds. The laptop is the supplicant and the RADIUS server is the authentication server, and 802.1X defines no separate credential issuer role.

EAP-TLS authenticates the client with a certificate and the server with its own certificate, so both sides are verified without relying on passwords. PEAP and LEAP depend on passwords, and EAP-MD5 does not authenticate the server or produce keying material.

If a client does not validate the server certificate, an attacker can run a rogue RADIUS server with its own certificate, and the client may send credential-related data during the exchange. The other options describe effects that a certificate setting does not cause, such as internet filtering or key rotation.

EAP-MD5 is a one-way challenge-response: the server never proves its identity and the method produces no session key, so WPA2-Enterprise has nothing to derive its keys from. The other options invent certificate, cipher and transport limits that do not describe the method.

WPA3-Enterprise 192-bit mode uses GCMP-256 for confidentiality and integrity of the wireless frames, along with stronger algorithms in the key hierarchy. TKIP and WEP are deprecated and broken, and a single static group key for all clients removes per-session protection.

SAE, based on the Dragonfly exchange, lets both peers prove knowledge of the passphrase without exposing it to offline guessing, and it produces per-session keys with forward secrecy. The other options describe a shortcut that skips key derivation, certificate-based authentication, or the deprecated WEP mechanism.

OWE uses an unauthenticated Diffie-Hellman exchange so that an open network encrypts each client's traffic without a password, which protects against passive eavesdropping but does not verify who is connecting. A shared printed passphrase gives no per-client protection, WEP is broken, and a captive portal controls access without encrypting the air interface.

WEP combines RC4 with a 24-bit initialization vector that is often reused and a CRC-based integrity check that can be forged, which lets collected traffic reveal the key. WEP has no 802.1X component and does not use AES, so the other options describe features that do not apply.

TKIP is deprecated because its weaknesses are built into the protocol, so a longer passphrase does not remove them, and WPA2 with AES-CCMP is the correct replacement. Adding WEP reintroduces a broken protocol, and MAC filtering is easily bypassed by spoofing an allowed address.

A WPA2-Personal handshake can be tested offline against passphrase guesses, so key strength depends entirely on the passphrase, and WPA3-Personal's SAE exchange resists this guessing. Hiding the SSID does not stop handshake capture, a longer SSID does not strengthen the derived key, and TKIP is deprecated.

A rogue access point that copies the corporate SSID is an evil twin, and the certificate warning shows the device is being offered an unexpected server identity. Validating the authentication server certificate stops the client from trusting the impostor. Deauthentication floods, KRACK and passive wardriving do not match these symptoms.

Disassociation and deauthentication frames are unprotected management frames in WPA2 unless 802.11w is enabled, so anyone can forge them. The RADIUS secret protects only the controller-to-server link, DHCP lease times do not stop forged frames, and hiding the SSID does not stop disassociation spoofing.

In KRACK, an attacker forces retransmission of message 3 of the 4-way handshake, so the client reinstalls a key it is already using and resets its nonce and replay counter. Patched clients and access points prevent the reinstallation. The other options describe beacon behaviour, passphrase rules and RADIUS storage, none of which is the flaw.

A WIPS monitors the airspace and alerts when an unapproved access point appears, and certificate validation stops clients from trusting an impostor authentication server. Hidden SSIDs are easy to discover and do not stop cloning, and WEP is broken whatever its key length.

Single loss expectancy is asset value times exposure factor, 40,000 x 0.25 = 10,000, and annualized loss expectancy is that figure times the annualized rate of occurrence, 10,000 x 2 = 20,000. The other values come from skipping a step or dividing where multiplication is needed.

A policy statement records management's intent in general terms, here that corporate data must be reached only through authenticated access. A standard would name mandatory technical settings, a procedure would list steps, and a guideline would offer optional advice.

PCI DSS does not accept WEP as a safeguard for cardholder data, and key rotation does not repair its RC4 and IV design. Hidden SSIDs and MAC filtering are not real security controls, and the problem exists even when no guest traffic shares the radio.

Under the HIPAA Security Rule, transmission encryption is an addressable implementation specification, so the clinic must assess whether it is reasonable and appropriate, then implement it or document why not and which equivalent measure it uses. The other options make encryption absolute, optional without records, or limited to stored data.

Risk acceptance belongs to the business owner who is accountable for the system and its outcomes, and it should follow a documented assessment by security staff. Security staff advise but should not own business risk, and vendor engineers and facilities staff have no authority to accept it.

GDPR's data minimization and purpose limitation principles require collecting only what the stated purpose needs, informing people through a privacy notice, and not keeping data longer than necessary. Encryption protects stored data but does not justify keeping unneeded data, and pre-ticked consent is not valid consent under GDPR.

Social engineering targets people, so training should teach staff that legitimate IT staff do not need a passphrase read aloud and that callers must be verified through known channels. Passphrase strength, WPA3 settings and Bluetooth are technical measures that do not stop a person from disclosing a secret.

A third-party access policy, supported by a contract, sets the security obligations, confidentiality duties and access end dates for outside parties. An employee acceptable use policy covers staff, the handbook has no security content, and a network diagram documents the architecture without setting obligations.

Good change management requires a documented request, approval, testing in a non-production environment and a rollback plan before a change reaches production. Applying changes without notice, recording them only after the fact or relying on a vendor's sales contact skips these controls.

Renewing certificates and applying firmware updates keep a deployed system secure, so they are maintenance tasks. Drafting next year's policy is policy design, and a one-time pre-deployment penetration test is a validation activity rather than routine upkeep.

Monitoring and forecasting uses trend data to predict future load, coverage and threat changes, so capacity and sensors can be added before problems appear. Auditing checks compliance, maintenance applies upkeep, and change management controls how planned changes are made, so none of them is the trend-based activity.

An audit finding should be tracked to closure: the fix goes through change management and is verified in a later audit, which keeps the record honest. Leaving a deprecated cipher in place, deleting the report, or renaming the SSID would hide the gap rather than close it.

Monitoring and forecasting uses alert trends and external threat information to anticipate problems before they occur. Rewriting policy is a governance task, and replacing hardware is maintenance rather than monitoring.

Decommissioning removes the device's credentials and configuration, revokes any certificates it held, and updates the inventory so that a retired device cannot authenticate or be mistaken for an active one. Keeping old configurations, reusing certificates on replacement units or storing equipment unlocked each leaves an exposure.

Change tickets with approvals, schedules and matching configuration history show that changes followed the approved process. Serial numbers, utilization graphs and vendor brochures do not show who approved what changed.