CCNA Wireless 200-355 Official Cert Guide (2016)

---

1. Which of the following are necessary components of a secure wireless connection? (Choose all that apply.)

a. Encryption

b. MIC

c. Authentication

d. All of these answers are correct.

2. Which one of the following is used to protect the integrity of data in a wireless frame?

a. WIPS

b. WEP

c. MIC

d. EAP

3. Which one of the following is a wireless encryption method that has been found to be vulnerable and is not recommended for use?

a. AES

b. WPA

c. EAP

d. WEP

4. Which one of the following is used as the 802.11 authentication method when 802.1x is used on a WLAN?

a. Open authentication

b. WEP

c. EAP

d. WPA

5. A Cisco WLC is configured for 802.1x authentication, using an external RADIUS server. The controller takes on which one of the following roles?

a. Authentication server

b. Supplicant

c. Authenticator

d. Adjudicator

6. Which one of the following authentication methods uses a certificate to authenticate the AS but not the client?

a. LEAP

b. PEAP

c. EAP-FAST

d. EAP-TLS

7. Which one of the following authentication methods requires digital certificates on both the AS and the supplicants?

a. TKIP

b. PEAP

c. WEP

d. EAP-TLS

8. Which one of the following is currently the most secure data encryption and integrity method for wireless data?

a. WEP

b. TKIP

c. CCMP

d. WPA

9. WPA2 differs from WPA in which one of the following ways?

a. Allows TKIP

b. Mandates CCMP

c. Allows WEP

d. Allows TLS

10. A pre-shared key is used in which of the following wireless security configurations?

a. WPA personal mode

b. WPA enterprise mode

c. WPA2 personal mode

d. WPA2 enterprise mode

11. Which of the following is required to implement MFP on a WLAN to protect both the wireless infrastructure and the client? (Select all that apply.)

a. WPA

b. WPA2

c. CCXv4 or v5

d. CCXv5

e. WEP

12. Which one of the following options should you select to configure WPA2 personal on a WLAN?

a. 802.1x

b. PSK

c. TKIP

d. CCMP

13. Which of the following wireless security methods have been deprecated due to their weaknesses? (Choose all that apply.)

a. AES

b. TKIP

c. WEP

d. CCMP

e. EAP

Foundation Topics

Anatomy of a Secure Connection

In the previous chapters of this book, you have learned about wireless clients forming associations with wireless access points (APs) and passing data back and forth across the air. The main focus has been on the radio frequency (RF) conditions, the modulation schemes, and the management of airtime that are all necessary to send data from one place to another successfully.

As long as all clients and APs conform to the 802.11 standard, they can all coexist—even on the same channel. Not every 802.11 device is friendly and trustworthy, however. Sometimes it is easy to forget that transmitted frames do not just go directly from the sender to the receiver, as in a wired or switched connection. Instead, they travel according to the transmitter’s antenna pattern, potentially reaching any receiver that is within range.

Consider the scenario in Figure 14-1. The wireless client opens a session with some remote entity and shares a confidential password. Because two untrusted users are also located within range of the client’s signal, they may also learn the password by capturing frames that have been sent on the channel. The convenience of wireless communication also makes it easy for transmissions to be overheard and exploited by malicious users.

Figure 14-1 Wireless Transmissions Reaching Unintended Recipients

If data is sent through open space, how can it be secured so that it stays private and intact? The 802.11 standard offers a framework of wireless security mechanisms that can be used to add trust, privacy, and integrity to a wireless network. A Cisco unified wireless network can go even further by detecting and preventing malicious activity. The following sections give an overview of the wireless security framework. Each element is described in more detail later in the chapter.

Authentication

In Chapter 6, “Understanding 802.11 Frame Types,” you learned that wireless clients must discover a basic service set (BSS) and then request permission to associate with it. Clients should be authenticated by some means before they can become functioning members of the wireless LAN. Why?

Suppose that your wireless network connects to corporate resources where confidential information can be accessed. In that case, only devices known to be trusted and expected should be given access. Guest users, if they are permitted at all, should be allowed to join a different guest WLANwhere they can access nonconfidential or public resources. Rogue clients, which are not expected or welcomed, should not be permitted to associate at all. After all, they are not affiliated with the corporate network and are likely to be unknown devices that happen to be within range of your network.

To control access, wireless networks can authenticate the client devices before they are allowed to associate. Potential clients must identify themselves by presenting some form of credentials to the APs. Figure 14-2 shows the basic client authentication process.

Figure 14-2 Authenticating a Wireless Client

Wireless authentication can take many forms. Some methods require only a static text string that is common across all trusted clients and APs. The text string is stored on the client device and presented directly to the AP when needed. What might happen if the device was stolen or lost? Most likely, any user who possessed the device could still authenticate to the network. Other more stringent authentication methods require interaction with a corporate user database. In those cases, the end user must enter a valid username and password—something that would not be known to a thief or an imposter.

If you have ever joined a wireless network, you might have focused on authenticating your device or yourself, while implicitly trusting the nearest AP. For example, if you turn on your wireless device and find a wireless network that is available at your workplace, you probably join it without hesitating. The same is true for wireless networks in an airport, a hotel, a hot spot, or in your home—you expect the AP that is advertising the SSID to be owned and operated by the entity where you are located. But how can you be sure?

Normally, the only piece of information you have is the SSID being broadcast or advertised by an AP. If the SSID looks familiar, you will likely choose to join it. Perhaps your computer is configured to automatically connect to a known SSID so that it associates without your intervention. Either way, you might unwittingly join the same SSID even if it was being advertised by an imposter.

Some common attacks focus on a malicious user pretending to be an AP. The fake AP can send beacons, answer probes, and associate clients just like the real AP it is impersonating. Once a client associates with the fake AP, the attacker can easily intercept all communication to and from the client from its central position. A fake AP could also send spoofed management frames to disassociate or deauthenticate legitimate and active clients, just to disrupt normal network operation.

To prevent this type of man-in-the-middle attack, the client should authenticate the AP before the client itself is authenticated. Figure 14-3 shows a simple scenario. Even further, any management frames received by a client should be authenticated too, as proof that they were sent by a legitimate and expected AP.

Figure 14-3 Authenticating a Wireless AP

Message Privacy

Suppose that the client in Figure 14-3 must authenticate before joining the wireless network. It might also authenticate the AP and its management frames after it associates but before it is itself authenticated. The client’s relationship with the AP might become much more trusted, but data passing to and from the client is still available to eavesdroppers on the same channel.

To protect data privacy on a wireless network, the data should be encrypted for its journey through free space. This is accomplished by encrypting the data payload in each wireless frame just prior to being transmitted, then decrypting it as it is received. The idea is to use an encryption method that the transmitter and receiver share, so the data can be encrypted and decrypted successfully.

In wireless networks, each WLAN may support only one authentication and encryption scheme, so all clients must use the same encryption method when they associate. You might think that having one encryption method in common would allow every client to eavesdrop on every other client. That is not necessarily the case because the AP should securely negotiate an encryption key to use for each associated client.

Ideally, the AP and a client are the only two devices that have the encryption keys in common so that they can understand each other’s data. No other device should know about or be able to use the same keys to eavesdrop and decrypt the data. In Figure 14-4, the client’s confidential password information has been encrypted before being transmitted. The AP can decrypt it successfully before forwarding it onto the wired network, but other wireless devices cannot.

Figure 14-4 Encrypting Wireless Data to Protect Data Privacy

The AP also maintains a “group key” that it uses when it needs to send encrypted data to all clients in its cell at one time. Each of the associated clients uses the same group key to decrypt the data.

Message Integrity

Encrypting data obscures it from view while it is traveling over a public or untrusted network. The intended recipient should be able to decrypt the message and recover the original contents, but what if someone managed to alter the contents along the way? The recipient would have a very difficult time discovering that the original data had been modified.

A message integrity check (MIC) is a security tool that can protect against data tampering. You can think of a MIC as a way for the sender to add a secret stamp inside the encrypted data frame. The stamp is based on the contents of the data bits to be transmitted. Once the recipient decrypts the frame, it can compare the secret stamp to its own idea of what the stamp should be, based on the data bits that were received. If the two stamps are identical, the recipient can safely assume that the data has not been tampered with. Figure 14-5 shows the MIC process.

Figure 14-5 Checking Message Integrity over a Wireless Network

Intrusion Protection

Many of the tools in the wireless security framework operate as choreographed steps between a client and an AP. Because both the client and the AP are active participants in securing the connection between them, the data they are exchanging can be protected. In other words, much of the security framework focuses on keeping attackers from joining the wireless network and from tampering with existing associations.

Wireless attacks do not stop there; they can involve malicious activity from a variety of angles or vectors. A wireless intrusion detection system (IDS) can monitor wireless activity and compare that against a database of known signatures or patterns. Cisco APs can recognize some signatures and inform their controllers. Controllers have a set of 17 signatures that can match against data coming from many APs. Controller-based IDS can also detect rogue APs and contain them, if needed.

Cisco Prime Infrastructure (PI) is a wireless management system that can go even further by offering a wireless intrusion protection system (wIPS). The wIPS can recognize a rich set of hundreds of signatures, implementing customizable policies to blacklist clients or rogue devices and block SSIDs. It can also integrate with Cisco Mobility Services Engine (MSE) for granular analysis. Chapter 18, “Managing Cisco Wireless Networks,” discusses the PI platform in greater detail.

For the CCNA Wireless exam, you should understand the basics of wireless IPS. Know that wireless security threats can be grouped into the following categories:

Rogue devices

Ad hoc networks

Client association issues

Passive or active attacks

Despite your best efforts to configure and secure every piece of your wireless network, someone could always bring in his own AP or wireless router and connect it to the wired network. A rogue AP is one that is not part of your wireless infrastructure but that is close enough to be overheard or to cause interference. Any clients that associate with a rogue AP are known as rogue clients. Cisco controllers can discover both.

Controllers can collect beacon information that is overheard by legitimate APs. Rogue AP detection algorithms running on the controllers and Prime Infrastructure can classify APs as rogue if they do not appear in the database of APs known to your network. As a wireless network administrator, you can override the classification and declare an AP as either friendly or rogue.

When coupled with an MSE, Prime Infrastructure can locate rogue APs so that you can go and find them. Controllers can even transmit special probe frames to determine if a rogue AP is connected to your wired network. This happens if the probe frames are received by the rogue AP over the air and then delivered back to the controller through the wired network.

Controllers can go one step further and attempt to contain the rogue AP so that it does not become a security risk to your own network. Over-the-air rogue containment works by listening for any wireless clients that associate with a rogue AP. The controller then sends spoofed deauthentication frames to those clients so that they think the rogue AP has dropped them.

Based on information gathered by the controllers, a wIPS can detect many types of wireless network attacks. Attacks can range from completely passive, such as an eavesdropper silently capturing wireless frames, to active ones that attempt to disrupt wireless service. For example, an attacker might send a flood of association requests to an AP to overwhelm it with fake potential clients—to the point where the AP can no longer service real clients. Another type of attack is similar to Cisco’s rogue containment, where the attacker sends spoofed deauthentication frames to legitimate clients to continually knock them off the network.