10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The GAWN exam has 75 questions and runs 2 hours.
These 10 free GAWN questions are organized by exam domain, so you can see how each part of the GIAC Assessing and Auditing Wireless Networks (GAWN) blueprint is tested. Reveal the answer and explanation under each question.
In a WEP shared-key authentication exchange, a capture includes both the AP's cleartext challenge and the client's encrypted copy. XORing the corresponding bytes yields a sequence that decrypts those challenge bytes when applied to the response. No statistical key-recovery attack has been run. What has been recovered?
Correct answer: C - The RC4 keystream for the matching positions under that IV and secret key.
After discoverability is disabled on a Bluetooth Classic barcode scanner, it no longer appears in inquiry results. A technician who knows its device address can still establish a link and enumerate a serial-port service; an unauthenticated attempt to use that service is rejected. How should the assessor continue evaluating the scanner's exposure?
Correct answer: D - Continue service-authorization tests; non-discoverable devices can still be connectable.
A BLE peripheral and a phone complete LE Secure Connections pairing using Just Works, then enable link encryption with a 128-bit key. The product requirement calls for LE Security Mode 1 Level 4 before accepting configuration writes. Why does the observed pairing fall short?
Correct answer: A - Just Works does not authenticate the peer against an active man-in-the-middle.
All clients on a 5 GHz WLAN lose connectivity in brief bursts. Protected Management Frames (PMF) were negotiated on every affected association. A synchronized spectrum trace shows a strong, undecodable emission overlapping the channel during each outage; the AP's wired uplink remains healthy. Which diagnosis best fits the combined evidence?
Correct answer: D - RF interference disrupting reception below the layer protected by PMF.
A site replaces its older badges with MIFARE DESFire EV3 cards. At one door, an emulator presenting an enrolled card's UID is accepted even though it has no application keys. The reader trace contains no cryptographic challenge-response exchange. What change would address the demonstrated access-control weakness?
Correct answer: B - Require cryptographic card authentication before authorizing door access.
An SDR operator increases receiver gain while examining a nearby transmitter. Several new spectral peaks appear, and the saved I/Q samples repeatedly hit the converter's maximum and minimum values. Before treating the peaks as additional transmitters, the operator should:
Correct answer: D - Reduce front-end gain and repeat the capture to check for clipping artifacts.
A passive wireless alert identifies an unfamiliar BSSID using the corporate SSID. Follow-up work traces the device to a dedicated switch port, and the network owner confirms that a personal travel router was connected there without approval. No other device depends on that port. Which containment step removes the verified unauthorized LAN path with the least collateral impact?
Correct answer: A - Quarantine the verified port and preserve the device and connection records.
A monitor-mode adapter is hopping among channels while a lab client joins a WPA2-Personal network on channel 44. The saved trace has EAPOL-Key messages 1 and 4, but no message carrying the client's SNonce. The SSID and passphrase have been verified. An operator is available to reconnect this client. What is the most useful change for the next capture?
Correct answer: B - Keep the adapter on channel 44 during the client's operator-initiated reconnection.
Two locations are being considered for a wireless sensor gateway. The project requires received signal strength of at least -72 dBm and SNR of at least 25 dB. Using the same calibrated receiver and channel width, the survey records: East: signal -56 dBm, noise -67 dBm. West: signal -68 dBm, noise -97 dBm. Which location meets both requirements?
Correct answer: A - West; its -68 dBm signal and 29 dB SNR satisfy both limits.
An authorized evil-twin test against a Windows WPA2-Enterprise deployment obtains an inner MSCHAPv2 response from a managed laptop. Its PEAP profile validates certificate chains but specifies no permitted authentication-server names. The approved server is radius.corp.example; the test server presents a valid certificate for radius.test.example from a CA the laptop trusts. Which profile change prevents this acceptance while preserving the existing EAP method?
Correct answer: C - Require the approved CA and expected RADIUS server names, with no user bypass.
The GAWN exam also covers these domains. Drill them in the full free practice test:
The full bank has 1,020 more GAWN questions with explanations.
Continue in the free practice test →
View plans