Wireless Reconnaissance & Traffic Analysis

OSWP · 40 questions

• A city RoE allows only passive discovery in phase one of a municipal WLAN assessment. What best defines that passive wireless recon?
• An assessor reads ENC and AUTH columns on a municipal Wi-Fi survey. What should those fields primarily help distinguish?
• A library WLAN assessment must avoid targeting neighboring cafés that share the same channel. What scope discipline is required?
• A parks department survey shows many clients listed under one municipal BSSID. Why do those client lists matter to an assessor?
• A municipal team asks when active probe scanning is justified versus passive listening. What is the best guidance?
• A civic SOC wants a tool that inventories Wi-Fi devices over time with logging, not only a quick live dump glance. Which purpose class best fits?
• An assessor considers bettercap during a municipal wireless engagement. How should its assessment purpose class be described?
• A municipal capture file is huge. What analysis approach best focuses work on one target BSS?
• A city asks what signal power columns roughly indicate during a municipal Wi-Fi walkthrough. What is the best answer?
• An intern marks every open municipal-area network as 'in scope' because encryption shows OPN. What correction is required?
• A civic survey shows the same SSID on two channels with different BSSIDs. How should an assessor read that multi-AP ESS pattern?
• A hospital wing uses a hidden staff SSID that suppresses the name in beacons. How can authorized recon still discover it?
• An assessor needs to confirm whether a municipal BSS advertises WPA2 versus WPA3 from on-air frames. What should be examined?
• A city wants a channel utilization sense-check before wireless testing. Why do busy channels matter?
• A municipal capture includes EAPOL frames. What role should an assessor recognize for those frames?
• A municipal playbook prefers writing PCAP to disk during Wi-Fi surveys. What is the primary evidence benefit?
• An assessor sees MGT in an AUTH-class survey column for a city SSID. What does that indicator most likely suggest?
• A student continuously hops channels while trying to capture one municipal AP. What method correction is appropriate?
• A city asks whether GPS tagging of Wi-Fi surveys belongs in OSWP-style assessment skills. What is the balanced answer?
• An analyst uses tshark to extract certificate fields from an Enterprise municipal capture. What analysis purpose does that serve?
• A city library asks whether a wireless recon survey alone can prove that its staff Wi-Fi passphrase is weak. What should the assessor explain?
• During a parks department WLAN assessment, the team notes manufacturer OUIs derived from BSSIDs. What is the most accurate use of that observation?
• A municipal rules of engagement document bans deauthentication entirely during a wireless assessment. Which approach remains appropriate for observing handshake-class traffic?
• A city SOC plans to correlate wireless recon results with DHCP logs after a campus survey. What is the primary benefit of that multi-source approach?
• An assessor nearly targets a printer softAP after spotting an SSID that resembles the city's corporate ESS. What should happen before any active testing?
• A capture inside city hall shows repeated client probe requests for a home SSID. How should the assessor treat that finding?
• A timed municipal wireless assessment uses two wireless cards: one hopping for survey and one locked for capture. What is the main operational reason for that design?
• A municipal wireless report requires screenshots of survey output before describing later testing. Why include those recon screenshots?
• An intern enables verbose frame injection during early recon 'to be thorough' on a live city WLAN. What guidance should the lead give?
• A new assessor opens bettercap and feels overwhelmed by the module list on a municipal engagement. What is the professional approach?
• A city asks what Kismet adds beyond simply listing nearby SSIDs during wireless monitoring. What is the best answer?
• During analysis of an authorized municipal capture, an assessor filters Wireshark for EAP identity strings. What can those fields usefully reveal?
• A campus survey discovers mesh backhaul SSIDs alongside user-facing city Wi-Fi names. How should those backhaul SSIDs be handled?
• A student on a city lab engagement saves only ASCII terminal logs and discards PCAP files. Why is that a problem for wireless evidence?
• A municipal red team wants a quick map of which access points advertise WPS capability before deeper testing. Which tool-purpose class fits that recon goal?
• While surveying a county WLAN, an assessor starts deep-diving DTIM and beacon interval quirks before recording crypto mode or clients. What prioritization correction fits OSWP-style goals?
• At a city special-event venue, recon shows access points still using vendor-default SSID naming patterns. What should the assessor conclude from that observation?
• An assessor reviews a capture intended for a specific city AP and finds handshake and data frames of interest missing. The radio was tuned to a different channel than the AP. What explains the gap?
• An analyst labels both 'LAB-CITYWIFI' and 'CityWifi' as the same municipal target without comparing BSSIDs. What is the correct challenge to that assumption?
• Before any active wireless testing on a municipal engagement, a recon brief asks which survey facts should be recorded at minimum. Which answer best matches that checklist?