CND (312-38) Network Defense Simulation

You will learn how to identify and validate wireless encryption standards for secure enterprise deployment. This simulation tests your knowledge of WPA3 cryptographic suites.

Network Scenario

Your organization is performing a comprehensive wireless security upgrade. The current infrastructure relies on WPA2-Enterprise for the corporate SSID. Due to increasing risks of offline dictionary attacks and the need for higher data confidentiality, the CISO has mandated a migration to WPA3-Enterprise utilizing the mandatory 192-bit security suite for all sensitive corporate communications.

Traffic & Logs

You review the proposed Wireless LAN Controller (WLC) configuration changes for the new security profile:

WLC-CORE# show wlan profile Corp_WPA3_Secure WLAN Profile Name................................ Corp_WPA3_Secure SSID............................................. Corp_Secure Status........................................... Enabled Security Policy 802.11 Authentication........................ Open System AKM Suites................................... 802.1X (EAP-TLS) WPA3 Transition Mode......................... Disabled WPA3-Enterprise 192-bit Security............. Enabled Protected Management Frames (PMF)............ Required Encryption Cipher............................

* The network team is requesting confirmation of the correct cipher standard to input for the 192-bit security requirement.

Question

Which encryption algorithm is used by WPA3 encryption?

Network Hint: WPA2 primarily relies on CCMP. WPA3 upgrades this to provide 192-bit cryptographic strength for enterprise environments, leveraging a different Galois mode for block cipher operation.

Expert Analysis

1. What is happening in the network

The enterprise is upgrading its wireless LAN controller (WLC) configuration from legacy or WPA2 standards to WPA3-Enterprise to fulfill strict compliance requirements demanding higher cryptographic strength (192-bit mode).

2. Identify attack or behavior

By enforcing WPA3-Enterprise with 192-bit security and Protected Management Frames (PMF), the network is defensively blocking offline dictionary attacks, KRACK vulnerabilities, and management frame spoofing/deauthentication attacks.

3. Why correct answer is correct

C. AES-GCMP 256 is correct. The WPA3 standard (specifically WPA3-Enterprise 192-bit mode) utilizes the Galois/Counter Mode Protocol (GCMP) with a 256-bit Advanced Encryption Standard (AES) key for robust data confidentiality and integrity.

4. Why others are wrong

A (RC4): An obsolete and highly vulnerable stream cipher used in WEP.
B (AES-CCMP): The primary encryption algorithm used in WPA2, not the upgraded standard required for WPA3's 192-bit suite.
D (RC4, TKIP): Temporal Key Integrity Protocol (TKIP) layered over RC4 was the stopgap encryption standard for WPA (WPA1) and is now deprecated and insecure.

5. Defensive action

When provisioning wireless networks, immediately disable TKIP and WEP. Where supported by client endpoints, strictly enforce WPA3-Enterprise (or SAE for personal/IoT networks). Ensure PMF (802.11w) is set to 'Required' to prevent deauthentication attacks.

6. MINI LESSON

Wireless Cryptography Evolution: Understanding protocol behavior is critical for a network defender. WEP (RC4) was easily cracked via weak Initialization Vectors (IVs). WPA (RC4+TKIP) mitigated this temporarily. WPA2 (AES-CCMP) introduced hardware-level encryption standardizing security for over a decade. WPA3 introduces AES-GCMP-256 for high-security enterprise tiers, Simultaneous Authentication of Equals (SAE) to replace Pre-Shared Keys (preventing offline dictionary attacks), and mandates PMF to secure management traffic.

Explore more CND simulations

Practice More Scenarios