Skip to content
AvailabilitySign inBook a DemoStart free lab
Topic: Wireless SecuritySwitch
All CCNP topics

5.0 Security

Wireless Security Practice Questions

WPA2/WPA3 and MACsec link-layer encryption.

One solved question, so you can see how these are marked

What password-authenticated key exchange does WPA3-Personal use instead of WPA2-Personal's PSK authentication method to resist offline dictionary attacks?

Simultaneous Authentication of Equals (SAE)

WPA3-Personal replaces PSK authentication with Simultaneous Authentication of Equals (SAE), a password-authenticated key exchange based on Dragonfly. WPA3 still uses a subsequent 4-way handshake to install session keys.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

All 5 Wireless Security questions in this set

Answers and explanations appear when you work through the set above.

  1. Which cipher and key-derivation suite does WPA3-Enterprise 192-bit mode require?

    • AES-CCMP-128 encryption with HMAC-SHA-256 key derivation
    • GCMP-256 encryption with HMAC-SHA-384 key derivation
    • TKIP encryption with the Michael message integrity check
    • WEP-104 encryption with a CRC-32 integrity check value

  2. At which OSI model layer does MACsec (IEEE 802.1AE) operate to provide point-to-point data confidentiality and integrity on Ethernet links?

    • Layer 1 (Physical Layer)
    • Layer 2 (Data Link Layer)
    • Layer 3 (Network Layer)
    • Layer 7 (Application Layer)

  3. What attack vector inherent in WPA2 Pre-Shared Key (PSK) networks is mitigated by WPA3 SAE key exchange?

    • Man-in-the-middle ARP cache poisoning on the wired distribution network
    • Offline dictionary and brute-force attacks on captured handshakes
    • Denial of service through TCP SYN flooding of the access point
    • Physical tampering with the access point's Ethernet uplink port

  4. What primary mechanism separates WPA3-Personal from WPA3-Enterprise security implementations?

    • Personal uses SAE with a shared passphrase; Enterprise uses 802.1X/EAP with a RADIUS server.
    • Personal requires AES-256 encryption, while Enterprise still keeps WEP available for legacy clients.
    • Enterprise operates only in the 2.4 GHz band, while Personal works in every band.
    • Personal uses a web pass-through portal at association instead of deriving dynamic keys.

  5. What is the primary operational outcome achieved upon successful completion of the IEEE 802.11i / WPA2 4-Way Handshake between a client and an Access Point?

    • The client receives its IPv4 address and default gateway from the wireless LAN controller's internal DHCP server.
    • Both sides prove they hold the PMK and derive a unique PTK, and the AP delivers the GTK, without sending the PMK.
    • The client's MAC address and identity are registered in Cisco Catalyst Center for Assurance.
    • The AP adds the client's address to its routing table and advertises it to the WLC.