10. Network, Wireless and Infrastructure Security Testing

Introduction and Context

Network and infrastructure security testing examines whether the systems that connect users, applications, devices, sites, and cloud environments can resist unauthorized access, disruption, interception, and misuse. Unlike an application assessment, which concentrates primarily on software behaviour, infrastructure testing evaluates the technical environment in which applications operate: routing, switching, firewalls, remote-access gateways, directory services, wireless networks, virtualization platforms, network management interfaces, and externally exposed services.

The subject is especially important because infrastructure weaknesses often provide the conditions through which application vulnerabilities become more damaging. A vulnerable web service may expose one application, whereas a poorly segmented network, unrestricted administrative protocol, or compromised wireless controller may provide access to many systems. Modern enterprises also operate hybrid architectures in which on-premises data centres, public cloud networks, software-defined connectivity, branch offices, mobile users, and third-party services are interdependent. Consequently, security testing must evaluate not only individual devices but also trust relationships and paths through the environment.

A professional infrastructure assessment is not an unstructured search for open ports. It is an authorized, risk-based examination of attack surface, control effectiveness, configuration, resilience, and monitoring. The tester must determine what is exposed, what is reachable, what is trusted, what is protected, and whether security controls operate as intended. Testing must also account for availability: an action that is technically effective but causes an outage may be professionally unacceptable.

Learning Objectives

By the end of this chapter, students should be able to:

• explain the scope and purpose of network, wireless, and infrastructure security testing;
• distinguish discovery, enumeration, vulnerability validation, configuration review, and exploitation;
• assess network services, remote access, firewalls, segmentation, encrypted protocols, and wireless controls;
• interpret infrastructure findings in terms of attack paths and business risk;
• design a controlled assessment for enterprise and hybrid environments;
• identify common technical, organizational, ethical, and operational limitations; and
• recommend practical improvements, including automation and continuous validation.

The Object of Assessment: Connectivity, Trust, and Exposure

Infrastructure security is best understood through three related ideas: exposure, reachability, and trust. Exposure describes whether a service or device can be contacted from an untrusted location. Reachability describes whether network controls permit communication between two points. Trust describes what a system assumes about the identity, integrity, or authority of another system.

These ideas are not identical. A database may not be exposed to the public internet but may still be reachable from a compromised employee workstation. A firewall may block inbound connections while permitting excessive outbound communication. A wireless network may use strong encryption but still place guest devices on an internal administrative segment. A cloud security group may appear restrictive until an inherited route or peering relationship creates an unintended path.

A useful assessment therefore models the environment as a graph. Nodes represent users, devices, services, networks, cloud resources, or management planes; edges represent permitted communication or trust. The security significance of a weakness depends partly on its position in this graph. An exposed administrative interface on a critical server is usually more serious than an equivalent interface on an isolated test system. Similarly, a moderate weakness located between a user segment and a payment environment may enable a high-impact attack path.

Important Terminology

A network service is a process that accepts or initiates communication, such as HTTP, DNS, SSH, SMTP, database protocols, or directory services. A listening port is a transport-layer endpoint associated with such a service. Enumeration is the structured collection of details about a service, including version, configuration, authentication method, and supported features. Attack surface is the set of reachable interfaces through which an adversary might interact with an organization’s technology.

A management plane contains interfaces used to administer infrastructure, including device consoles, hypervisor panels, cloud control APIs, network controllers, and monitoring systems. The data plane carries ordinary user or application traffic. A control plane manages routing, policy, identity, or configuration. Separating these planes reduces the chance that compromise of ordinary traffic directly exposes administration.

A security boundary is a control point intended to limit communication or authority. Segmentation divides an environment into zones with different trust or sensitivity levels. Microsegmentation applies more granular policy, frequently at the workload or identity level. Lateral movement is the expansion of an attacker’s access from an initially compromised asset to other assets. A pivot is the use of one compromised system as a position from which another network or service can be reached.

A Risk-Based Testing Process

Authorization and Rules of Engagement

Infrastructure testing begins before technical activity. The assessor and system owner should agree on scope, assets, source addresses, permitted techniques, test windows, emergency contacts, data-handling requirements, and stop conditions. The rules of engagement should state whether denial-of-service testing, password testing, social engineering, wireless disruption, exploitation of production services, or cloud control-plane testing is permitted. Third-party hosting contracts may require separate approval.

A useful distinction is between discovery, validation, and exploitation. Discovery identifies assets and services. Validation determines whether an apparent weakness is real and relevant. Exploitation demonstrates impact under controlled conditions. Exploitation should not be automatic; it is justified when evidence from safer methods is insufficient and the expected value exceeds operational risk.

Asset Discovery and Service Enumeration

Discovery combines authorized documentation with technical observation. Sources may include address inventories, cloud asset lists, DNS records, firewall policies, configuration-management databases, vulnerability-management platforms, and network-flow data. Active scanning can identify hosts and services, but it may miss assets that are offline, filtered, virtual, ephemeral, or accessible only through a particular route.

Enumeration should answer questions rather than merely collect banners:

• Which services are reachable from each trust zone?
• Are unnecessary protocols enabled?
• Is the service supported and patched?
• Does it disclose version, operating-system, or internal naming information?
• What authentication and authorization mechanisms are used?
• Does encryption protect confidentiality and integrity?
• Is the service connected to a sensitive management or identity system?

Results must be normalized and correlated. A port scan, a firewall rule review, and a cloud route table may each appear acceptable in isolation while revealing a serious path when considered together.

Vulnerability and Configuration Assessment

Vulnerability scanning can identify known weaknesses, obsolete software, weak cryptographic settings, default credentials, and common configuration errors. It is valuable for breadth but produces false positives and false negatives. A scanner may report an old version even when a vendor backport has fixed the issue, or fail to identify a logic flaw in a firewall rule.

Configuration review is therefore essential. The assessor compares actual settings with approved baselines and security requirements. Relevant evidence includes firewall policies, router access-control lists, VPN profiles, wireless-controller settings, identity policies, logging configurations, cloud security groups, routing tables, and administrative-role assignments. The review should consider both explicit permissions and implicit defaults.

Controlled Validation and Attack-Path Analysis

Validation may involve safe protocol negotiation tests, authenticated configuration checks, access-control tests using designated accounts, and carefully bounded exploitation. The objective is to establish whether a weakness permits a meaningful security consequence. For example, discovering that a management service is reachable is not equivalent to proving administrative compromise; however, reachability from an untrusted zone may itself violate policy and justify remediation.

Attack-path analysis links findings. Suppose an internet-facing VPN has weak authentication controls, a user segment can reach a server-management subnet, and the management interface accepts a legacy protocol. Each issue may receive a different technical severity, but together they create a credible route to infrastructure control. Risk assessment should therefore consider likelihood, business impact, required privileges, detectability, and the number of assets affected.

Testing Network Services and Protocols

Network services should be assessed for necessity, exposure, authentication, authorization, patch status, protocol security, and monitoring. Common concerns include administrative services exposed beyond the management network, anonymous access, insecure defaults, weak access controls, excessive information disclosure, and services that communicate without integrity protection.

Encrypted protocols require more than the presence of encryption. Testing should examine certificate validity and ownership, protocol versions, cipher negotiation, key exchange, authentication strength, revocation or renewal processes, and resistance to downgrade. A service can use TLS and still be insecure if certificates are improperly validated, obsolete protocols are accepted, private keys are poorly protected, or internal clients silently ignore validation errors.

Legacy protocols deserve special attention. Cleartext administration, unauthenticated file transfer, insecure name resolution, and older remote-management methods can expose credentials or permit manipulation. Replacement is preferable, but where legacy systems cannot immediately be removed, compensating controls may include strict segmentation, jump hosts, allow-listing, monitoring, and limited service accounts.

DNS is both a core service and a security boundary. Testing may examine unauthorized zone transfer, weak separation between internal and external records, recursive-query exposure, stale records, and inconsistent protective policies. Email infrastructure should be evaluated for secure transport, authentication alignment, relay restrictions, and administrative exposure. Directory services require attention to protected protocols, privileged groups, trust relationships, and the reachability of authentication infrastructure.

Firewalls, Segmentation, and Zero-Trust Design

A firewall assessment evaluates whether policy reflects business requirements and whether enforcement matches documented design. Important questions include whether rules are specific, whether source and destination objects are accurate, whether risky services are unnecessarily allowed, whether temporary rules expire, whether shadowed or contradictory rules exist, and whether administrative access is separated from ordinary traffic.

The most dangerous firewall weakness is often not a single permissive rule but cumulative policy complexity. A rule may be reasonable in one context yet unsafe when combined with network address translation, routing, cloud peering, or a second firewall. Testing should use a communication matrix that records required flows between zones and compares it with observed reachability.

Traditional perimeter segmentation assumes that internal networks are relatively trusted. Modern security architecture increasingly adopts zero-trust principles: access is evaluated continuously using identity, device condition, application context, and least privilege rather than network location alone. Zero trust does not mean that firewalls are unnecessary. It means that network position is not treated as sufficient evidence of trust.

Effective segmentation should protect high-value assets such as identity services, backup systems, payment environments, industrial controls, and management platforms. It should also be tested from realistic positions: external internet, guest wireless, employee workstation, compromised server, remote-access session, and cloud workload. A segmentation control is effective only if unauthorized paths are blocked and authorized paths remain usable.

Remote Access and Administrative Control

Remote access expands the organization’s boundary. VPN gateways, virtual desktop infrastructure, remote administration portals, bastion hosts, and cloud consoles should be assessed for strong authentication, device posture, session management, authorization, logging, and resilience. Multi-factor authentication is valuable, but its effectiveness depends on implementation. Weak recovery processes, bypass accounts, legacy protocols, or unprotected administrative interfaces can undermine it.

A mature design separates user remote access from privileged administration. Administrators should use hardened jump hosts or privileged-access workstations, narrowly defined roles, time-limited elevation, and session logging. Direct administration from unmanaged personal devices creates uncertainty about malware, credential theft, and data handling.

Testing should also consider what happens after a remote session is established. Can a general employee reach management interfaces? Can a contractor access systems outside the approved project? Are split-tunnel settings consistent with policy? Are disconnected sessions terminated? Are emergency accounts monitored? These questions connect technical configuration with governance and accountability.

Wireless Security Testing

Wireless assessment covers radio configuration, authentication, encryption, segmentation, client behaviour, and administrative control. The assessment should begin with authorization and safety because wireless testing can affect neighboring networks and operational devices. Passive observation is generally less disruptive than active interference and can reveal service identifiers, channels, encryption modes, rogue access points, and unexpected client associations.

Enterprise wireless networks should use strong authentication and protected management frames where supported. Shared passwords create accountability and rotation problems, particularly when employees, contractors, and guests use the same network. Certificate-based or identity-based authentication improves traceability, but certificate validation must be correctly implemented on clients; otherwise, users may be vulnerable to fraudulent infrastructure.

Wireless testing should verify that:

• guest traffic is isolated from internal and management networks;
• employee devices cannot bypass policy through unauthorized hotspots or bridging;
• access points and controllers receive updates and use secure administration;
• rogue or impersonating access points can be detected;
• wireless client isolation is applied where appropriate;
• default identifiers, credentials, and insecure encryption modes are removed; and
• monitoring records authentication failures, unusual associations, and configuration changes.

The presence of a strong wireless cipher does not prove a secure deployment. A correctly encrypted network may still be connected to an overly permissive internal segment, use weak identity controls, or expose its controller to an untrusted network.

Enterprise, Cloud, and Hybrid Infrastructure

Hybrid environments complicate testing because responsibility is distributed. The organization may control operating-system configuration and identity, while a cloud provider controls physical infrastructure and some underlying services. Assessment must distinguish customer-controlled settings from provider responsibilities and respect provider testing policies.

Cloud testing should examine virtual networks, subnets, route tables, security groups, network access-control lists, load balancers, private endpoints, peering, transit gateways, container networks, and management APIs. Public exposure can arise through an intended service, an inherited policy, a storage or management interface, or a route that was created for temporary integration. Identity and network controls must be analyzed together because cloud administration is frequently API-driven.

Containers and orchestration platforms introduce additional boundaries. The assessor should consider exposed dashboards, overly broad service accounts, insecure control-plane access, host-network use, unrestricted east-west communication, and secrets exposed through configuration. Kubernetes or similar platforms should be assessed within authorized boundaries, with special care around production availability.

Hybrid testing should trace representative paths across environments. For example, a remote user may enter through an identity provider, access a VPN or software-defined perimeter, reach an on-premises application, and then invoke a cloud API. Each transition can alter authentication, logging, and policy. A control that is strong in one environment may be weakened at the boundary between them.

Evidence, Reporting, and Remediation

A high-quality report explains what was tested, from where, under what constraints, and with what evidence. Each finding should state the affected asset, condition, security consequence, likelihood, impact, evidence, and recommended action. Screenshots and logs are useful, but sensitive information should be minimized and protected.

Recommendations should be prioritized rather than presented as an undifferentiated list. Immediate actions may include removing public exposure, disabling obsolete protocols, correcting an overly broad firewall rule, or enforcing multi-factor authentication. Structural actions may include redesigning segmentation, improving asset ownership, implementing privileged-access management, or integrating cloud and on-premises policy review.

Remediation verification is a separate professional activity. A finding is not closed merely because a configuration file changed. The assessor should retest the original condition, examine possible alternate paths, and confirm that the change did not introduce operational failure. Metrics such as unresolved critical exposures, mean time to remediate, percentage of assets covered, policy exceptions past expiry, and segmentation-test success can support governance.

Illustrative Case Study: Hybrid Retail Infrastructure Assessment

Background

A fictional national retailer operates stores, a central data centre, a public cloud analytics platform, corporate wireless networks, and a remote-access service for administrators and suppliers. Payment systems are intended to be isolated from office users. Store networks connect to headquarters through managed links, while cloud services connect through a transit gateway.

Situation and Problem

An internal audit reported that the organization had no recent evidence that segmentation worked as designed. The security team also suspected that temporary firewall exceptions created during a cloud migration remained active. The assessment was authorized for production systems but excluded denial-of-service activity and destructive exploitation.

Analysis

The assessment began with architecture review, asset inventories, firewall policies, cloud route tables, and wireless-controller configuration. External discovery identified only approved public services, but authenticated internal testing revealed that a store employee segment could reach a management service used by several infrastructure devices. The service required authentication, yet it accepted a legacy protocol and was not restricted to the administrative jump host.

A review of cloud connectivity found that an analytics subnet had a route to an on-premises integration segment. The route was required for data transfer, but the corresponding firewall rule allowed more protocols than the application needed. In addition, guest wireless was correctly separated from payment systems but could communicate with a corporate monitoring endpoint that exposed unnecessary information.

No destructive action was taken. The findings were correlated into an attack path: compromise of a store workstation could provide access to the legacy management service; compromised infrastructure credentials could then enable movement toward the integration segment; excessive cloud permissions increased the possible impact. The wireless issue was lower risk but demonstrated that segmentation had been assessed by intended design rather than actual reachability.

Approach and Solution

The organization immediately restricted the management service to the jump-host network, replaced the legacy protocol, rotated associated credentials, and added monitoring for attempts from store segments. The cloud rule was narrowed to required destinations and ports, while route ownership and expiry dates were recorded. The monitoring endpoint was redesigned so that guest networks received no internal operational information.

Longer-term actions included a segmentation matrix, quarterly rule recertification, separate administrative identities, continuous cloud-configuration monitoring, and periodic validation from representative user zones. Wireless and hybrid routes were added to the annual infrastructure testing scope.

Outcome

Retesting confirmed that the previously demonstrated paths were blocked while legitimate payment, analytics, and administrative functions continued to operate. The organization also improved its reporting by recording control owners and business justifications for exceptions.

Learning Points

The case illustrates that infrastructure risk is relational. No single observation fully represented the danger; the impact emerged from the combination of workstation access, legacy administration, cloud routing, and excessive policy. It also demonstrates why documentation, authenticated testing, segmentation validation, and remediation retesting must be treated as connected activities.

Challenges, Limitations, and Common Mistakes

Infrastructure testing is constrained by incomplete inventories, undocumented dependencies, dynamic cloud assets, encrypted traffic, device sensitivity, and limited test windows. Network address translation, load balancing, and filtering can make results appear inconsistent. A scanner may miss a service accessible only through a particular identity or route, while an aggressive scan may overload fragile equipment.

Common mistakes include treating a port scan as a complete assessment, assuming that internal networks are trusted, reviewing firewall rules without testing effective reachability, ignoring outbound paths, accepting encryption without checking certificate validation, and testing wireless encryption while overlooking network placement. Another mistake is reporting vulnerabilities without identifying asset ownership or business consequence. Conversely, a technically accurate report can still fail if it provides no practicable remediation sequence.

Assessors should avoid credential spraying, uncontrolled password attacks, wireless deauthentication, exploitation of fragile legacy devices, and collection of unnecessary personal or payment data unless explicitly authorized. Safety controls include rate limits, test accounts, maintenance windows, backups, emergency contacts, and immediate cessation when instability appears.

Ethical, Governance, and Professional Considerations

Authorization is the central ethical requirement. Permission must be specific enough to define systems, techniques, dates, and data access. Testing outside scope can constitute unauthorized access even when the assessor believes it would improve security. Confidential findings, credentials, packet captures, and architecture diagrams must be protected and destroyed according to agreement.

Professional independence matters when testers are also responsible for implementing the controls they evaluate. Reports should distinguish observed facts, reasonable inferences, and untested assumptions. Findings should not be exaggerated, suppressed, or ranked solely to satisfy a stakeholder. Applicable privacy, telecommunications, financial, critical-infrastructure, and contractual requirements may affect collection and storage of network data.

Third-party and cloud environments require coordinated responsibility. The organization should confirm provider terms, obtain necessary approvals, and ensure that supplier contracts support assessment, logging, incident notification, and remediation. Governance should also address exceptions: every exception needs an owner, rationale, compensating control, expiry date, and review process.

Automation, Analytics, and Emerging Practice

Automation supports continuous asset discovery, configuration comparison, certificate monitoring, attack-surface management, cloud-policy analysis, and segmentation validation. Infrastructure-as-code pipelines can test security groups, routes, and identity policies before deployment. Network telemetry and flow analytics can identify unexpected communication, dormant services, and deviations from approved patterns.

Machine-learning techniques may help prioritize anomalies or correlate events across large hybrid environments, but they do not replace human validation. Models can misclassify legitimate administrative activity, overlook novel paths, or reproduce bias in historical data. Automated remediation also requires safeguards because an incorrect block can interrupt critical services.

Emerging practice is moving toward continuous control validation, identity-aware access, software-defined segmentation, secure access service edge architectures, confidential computing, and stronger protection of network-management interfaces. The enduring principle is not adoption of a particular product but verifiable reduction of unauthorized reachability and excessive trust.

Best Practices for Professional Testing

A mature program should:

1. maintain an authoritative inventory of physical, virtual, cloud, wireless, and third-party assets;

2. test from multiple trust positions rather than only from the internet;

3. combine technical scanning with authenticated configuration and policy review;

4. model communication paths and validate effective segmentation;

5. protect management planes with dedicated networks, strong identity, and least privilege;

6. evaluate encryption, certificate validation, key management, and legacy-protocol exposure;

7. include wireless, cloud routes, APIs, containers, and remote access in scope where relevant;

8. use safe test methods, explicit stop conditions, and protected evidence handling;

9. correlate findings into attack paths and business consequences; and

10. retest remediation and continuously monitor exceptions and configuration drift.

Chapter Summary

Network, wireless, and infrastructure security testing evaluates the exposure, reachability, trust, and resilience of the environment supporting organizational services. A sound assessment progresses from authorization and discovery through enumeration, configuration review, controlled validation, attack-path analysis, reporting, and remediation verification. It examines services, encrypted protocols, firewalls, segmentation, remote access, wireless networks, cloud connectivity, management planes, and hybrid trust boundaries.

The chapter emphasized that infrastructure risk is rarely explained by one open port or one weak setting. Risk often emerges from relationships among routes, identities, services, policies, and zones. Effective testing therefore combines technical evidence with architecture and business context. Professional practice requires authorization, operational safety, confidentiality, accurate reporting, and respect for provider and regulatory boundaries. Automation and analytics improve scale and continuity, but human judgment remains essential for interpreting reachability, impact, and acceptable risk.

Key Terms

Attack surface: The set of reachable interfaces through which an unauthorized party may interact with an environment.

Attack path: A sequence of permitted relationships or weaknesses that can lead from an initial position to a target.

Bastion host: A hardened system designed to provide controlled administrative access to protected resources.

Control plane: The functions used to manage routing, identity, policy, or configuration.

Data plane: The part of an infrastructure that carries ordinary user or application traffic.

Enumeration: Structured collection of details about hosts, services, protocols, versions, and configurations.

Firewall rule: A policy statement controlling permitted or denied network communication.

Hybrid infrastructure: An environment combining on-premises, cloud, and often third-party or remote-access resources.

Lateral movement: Expansion from a compromised asset to additional systems or networks.

Microsegmentation: Fine-grained separation of workloads or identities using narrowly defined policies.

Network segmentation: Division of an environment into zones with controlled communication between them.

Pivot: Use of one accessible or compromised system to reach another network or service.

Reachability: The practical ability of one endpoint or identity to communicate with another.

Remote access gateway: A service that enables users or administrators to connect to internal resources from outside.

Security group: A logical cloud control that filters traffic to or from virtual resources.

Service enumeration: Identification of a service’s characteristics, authentication, configuration, and supported features.

Wireless controller: A platform that centrally manages enterprise access points and wireless policy.

Zero trust: A security approach that does not treat network location as sufficient evidence of trust and continuously evaluates access.

Review Questions

Short Answer Questions

1. Distinguish exposure, reachability, and trust in infrastructure security.

2. Why is service enumeration more valuable than a simple list of open ports?

3. What is the purpose of a rules-of-engagement document?

4. Why does strong wireless encryption not guarantee a secure wireless deployment?

5. What evidence should be used to verify that a remediation is complete?

Long Answer Questions

1. Explain a complete risk-based process for conducting an enterprise infrastructure security assessment.

2. Discuss how firewall policy review and segmentation testing complement each other.

3. Analyze the security requirements of remote-access and privileged-administration services.

4. Explain the principal challenges of testing hybrid cloud and on-premises infrastructure.

5. Discuss the ethical, governance, and operational safeguards required during infrastructure testing.

Analytical / Application Questions

1. An employee network can reach a server-management interface that uses a legacy protocol, while a cloud integration network has broad access to the same environment. Construct an attack-path analysis and recommend prioritized controls.

2. A guest wireless network is isolated from payment systems but can reach internal monitoring services. Determine the likely risks and design a validation and remediation plan.

3. A vulnerability scanner reports an obsolete service version, but the vendor has applied a security backport. Explain how you would validate the finding and decide its risk rating.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes reachability from exposure?

A. Exposure concerns whether a service is reachable from an untrusted location, while reachability concerns whether communication is possible between two points.

B. Exposure refers only to wireless networks, while reachability refers only to cloud networks.

C. Exposure is a business-impact rating, while reachability is a vulnerability score.

D. They are identical terms used for different network layers.

Correct Answer: A. Exposure concerns whether a service is reachable from an untrusted location, while reachability concerns whether communication is possible between two points.

Question 2

During an assessment, which activity most directly tests effective segmentation?

A. Checking whether every server has the latest operating-system version

B. Testing permitted and denied communication from representative trust zones against an approved communication matrix

C. Replacing all firewall rules with default-deny rules without review

D. Collecting wireless network names from a building entrance

Correct Answer: B. Testing permitted and denied communication from representative trust zones against an approved communication matrix

Question 3

Why should encryption testing include certificate validation and protocol negotiation?

A. Because encryption is useful only on public networks

B. Because a service may use encryption while accepting obsolete protocols or untrusted certificates

C. Because certificates determine firewall routing

D. Because protocol negotiation eliminates the need for authentication

Correct Answer: B. Because a service may use encryption while accepting obsolete protocols or untrusted certificates

Question 4

Which control most directly reduces the risk of direct privileged administration from unmanaged devices?

A. A public DNS resolver

B. A hardened administrative jump host with strong identity controls

C. A larger wireless coverage area

D. An unrestricted split-tunnel VPN

Correct Answer: B. A hardened administrative jump host with strong identity controls

Question 5

A cloud security group appears restrictive, but a peering route permits access from another virtual network. What does this illustrate?

A. The need to analyze policy together with routing and trust relationships

B. That cloud security groups always override routes

C. That network segmentation is irrelevant in cloud environments

D. That vulnerability scanners cannot identify any cloud issue

Correct Answer: A. The need to analyze policy together with routing and trust relationships

Question 6

Which wireless finding represents a segmentation problem rather than merely a cryptographic problem?

A. The access point uses a supported strong cipher

B. Guest wireless clients can communicate with internal management endpoints

C. The wireless controller records authentication events

D. The network uses identity-based authentication

Correct Answer: B. Guest wireless clients can communicate with internal management endpoints

Question 7

What is the primary reason controlled exploitation should not automatically follow every discovered vulnerability?

A. Exploitation is never useful in security testing

B. Exploitation may create operational risk and should be justified by expected evidentiary value

C. Vulnerability scanners already prove business impact

D. Rules of engagement apply only to wireless testing

Correct Answer: B. Exploitation may create operational risk and should be justified by expected evidentiary value

Question 8

Which reporting practice best supports remediation prioritization?

A. Listing findings alphabetically without affected assets

B. Reporting only scanner output and omitting business context

C. Correlating evidence, affected assets, attack paths, likelihood, and impact

D. Assigning the same severity to every open service

Correct Answer: C. Correlating evidence, affected assets, attack paths, likelihood, and impact

Question 9

What is a significant limitation of automated infrastructure analytics?

A. They cannot process any network-flow information

B. They may misclassify legitimate activity or recommend harmful changes without human validation

C. They eliminate the need for asset inventories

D. They are useful only for physical networks

Correct Answer: B. They may misclassify legitimate activity or recommend harmful changes without human validation

Question 10

In the illustrative retail case, which combination created the most significant attack path?

A. Strong wireless encryption and current certificates

B. A store workstation path, legacy management access, and excessive hybrid connectivity

C. Guest isolation from payment systems and monitored authentication

D. A documented cloud route limited to required destinations

Correct Answer: B. A store workstation path, legacy management access, and excessive hybrid connectivity