Chapter 10
Review Questions
1. Each of the following is a reason to monitor a wireless network except
a. predict when an attack may occur
b. identify security threats
c. verify compliance with federal regulations
d. monitor scare wireless bandwidth
2. Managing a WLAN can be accomplished by using either a system specifically
designed for wireless networks or
a. Simple Network Management Protocol (SNMP)
b. File Transfer Protocol (FTP)
c. Wireless Management Protocol (WMP)
d. Wired Equivalent Protocol (WEP)
3. Each of the following is a U.S. federal regulation that wireless monitoring can be
used to verify compliance except
a. Gramm-Leach-Bliley Act (GLBA)
b. Sarbanes-Oxley Act
c. Health Insurance Portability and Accountability Act (HIPAA)
d. Federal Wireless Security Act
4. Each of the following is a WLAN discovery tool to locate a wireless device
except
a. farthest sensor
b. triangulation
c. RF fingerprinting
d. Received signal strength indication
5. The disadvantage of a mobile sniffing audit is
a. sniffing software is hard to locate
b. rogue access points do not send RF signals
c. it is very time consuming
d. only the network administrator can perform the function
6. Only a laptop computer and not a desktop computer can be used as a wireless
probe. True or False?
7. Dedicated probes resemble standard access points. True or False?
8. An SNMP inform request acknowledges the message with an SNMP response.
True or False?
9. An intrusion detection system is identical to a firewall. True or False?
10. A signature detection WIDS is susceptible to attacks if the matching attack
signature is not in the database. True or False?
11. A(n) _____detection WIDS monitors the normal activity of the wireless LAN and
“learns” its normal characteristics to create a baseline. anomaly
12. A(n) _____ is an attack alert that turns out to be false. false positive
13. A(n) _____ attempts to uncover and prevent an attack before it harms the WLAN.
wireless intrusion prevention system (WIPS)
14. A WIPS that uses an existing access point to monitor the RF is known as a(n)
_____ probe. integrated or embedded
15. One of the most important features of a WIPS is its ability to learn about the other
_____ that are in the area and classify them. access points
16. Explain the difference between triangulation and trilateration.
Triangulation measures the angles between three or more nearby APs; where the
measurements intersect this can be used to calculate the location of the device.
Trilateration measures the distance between APs rather than the angles between
them.
17. How does RF fingerprinting work?
RF fingerprinting uses intelligent algorithms to improve precision by accounting for
the environmental effects on the wireless signal itself. A "fingerprint" of the wireless
environment is first calculated by conducting a physical “walk-around” using a
mobile spectrum analysis device. These measurements are later compared to
deviations in the real-time environment to locate the client device.
18. What is a desktop probe?
Instead of using a mobile wireless device as a probe, a desktop probe utilizes a
standard desktop PC instead. A universal serial bus (USB) wireless network
interface card adapter is plugged into the desktop computer and it monitors the RF
frequency in the area for transmissions.
19. Describe an SNMP trap.
This data reported by these monitors can be important to determining the “health”
of a wireless LAN: a spike in a network’s bandwidth or a decrease in the time to
respond to a request are signs that the network is running slow. These events are
known as an SNMP trap. There are different actions that can be taken when an
SNMP trap occurs. Generally an event alarm is issued and the proper personnel
are notified.
20. How can a WLAN management system be used to upgrade access point
firmware?
WLAN management systems provide the functionality of upgrading the firmware of
access points. Firmware upgrade images can be imported and then applied to one
AP, all APs, or groups of access points. Grouping APs allow firmware images to be
separated distributed based on vendor or model. This allows for upgrades to be
performed at night when there is less traffic.