Wireless security PBQs test your ability to configure secure WiFi networks, select appropriate authentication methods, and identify wireless threats. This guide teaches you how to implement enterprise-grade wireless security.
Interactive simulation — no account required
Wireless security PBQs present you with WiFi configuration scenarios and ask you to select the correct security settings, identify vulnerable configurations, or detect wireless attacks. You'll work with settings like encryption protocols, authentication methods, and network segmentation.
These questions test whether you understand the practical differences between wireless security options. You might be asked to:
For the Security+ exam, WPA3 is the recommended encryption standard. WPA2 is acceptable when WPA3 isn't available. WEP and WPA (original) are always wrong answers for new deployments—they have known vulnerabilities and should never be selected.
When configuring wireless security, work through these decisions:
Know the differences between these protocols—the exam frequently tests them:
192-bit encryption, individual user authentication via 802.1X. Strongest option for organizations.
Use: Corporate networks with RADIUS infrastructureSAE (Simultaneous Authentication of Equals) replaces PSK. Resistant to offline dictionary attacks.
Use: Home networks, small offices without RADIUSAES encryption with 802.1X authentication. Still acceptable when WPA3 isn't supported.
Use: Legacy devices that don't support WPA3AES encryption with shared password. Vulnerable if PSK is weak or leaked.
Use: Home networks (minimum acceptable security)A company wants to secure their corporate wireless network. Employees should authenticate with their domain credentials. Guest WiFi should be separate. Here's the correct configuration:
Corporate network for employees with domain authentication
✓ Individual user authentication enables immediate revocation
✓ Certificate validation prevents evil twin attacks
Isolated guest network with captive portal
Complete network isolation from corporate resources
Captive portal provides legal protection and logging
Corporate SSID uses WPA3-Enterprise: Each employee authenticates with their own credentials. If someone leaves, their access is revoked immediately without changing a shared password.
802.1X with RADIUS: The access point forwards credentials to a RADIUS server, which validates against Active Directory. Centralized authentication and accounting.
PEAP-MSCHAPv2: This EAP (Extensible Authentication Protocol) method works with Windows domain credentials. The outer PEAP tunnel encrypts the MSCHAPv2 exchange.
Guest SSID on separate VLAN: Guest traffic is completely isolated from corporate traffic. Even if a guest device is compromised, it can't reach internal systems.
Captive portal: Guests must accept terms of service before accessing the internet. Provides legal protection and logging.
Configure secure WiFi settings in interactive scenarios.
The exam tests your ability to identify these wireless threats:
Evil Twin — Attacker creates an access point with the same SSID as a legitimate network. Victims connect thinking it's the real network, and the attacker intercepts their traffic. Defense: 802.1X authentication validates the RADIUS server certificate.
Rogue Access Point — Unauthorized AP connected to the corporate network, often by an employee wanting better coverage. Creates an uncontrolled entry point. Defense: Wireless IDS, network access control, regular site surveys.
Deauthentication Attack — Attacker sends forged deauth frames to disconnect clients from the legitimate AP, forcing them to reconnect (possibly to an evil twin). Defense: WPA3 includes Protected Management Frames (PMF).
Jamming — Radio interference preventing wireless communication. Can be intentional attack or accidental (microwave ovens, Bluetooth). Defense: Spectrum analysis, channel hopping, physical security.
War Driving — Attacker drives around scanning for vulnerable networks. Looking for WEP, open networks, or weak passwords. Defense: Strong encryption, hidden SSID (minimal benefit), regular audits.
Apply these principles when answering wireless PBQs:
A wireless security PBQ asks you to configure WiFi settings, select appropriate encryption protocols, or identify wireless vulnerabilities. You might configure WPA3-Enterprise with 802.1X, segment guest networks, or identify an evil twin attack from provided data.
WPA3 provides stronger encryption (192-bit in Enterprise mode) and replaces PSK with SAE (Simultaneous Authentication of Equals), which resists offline dictionary attacks. WPA3 also includes Protected Management Frames to prevent deauthentication attacks. WPA3 is the current recommended standard.
802.1X is a network access control protocol that authenticates devices before allowing network access. For wireless, it means each user authenticates individually (usually via RADIUS server) rather than everyone sharing one password. This provides better security and accountability for enterprise networks.
An evil twin is a malicious access point configured to look like a legitimate network (same SSID, similar settings). Victims connect thinking it's the real network, and the attacker can intercept their traffic. 802.1X with certificate validation prevents this by verifying the authentication server's identity.
Apply these concepts with an interactive Wireless Security simulation.