Wireless security — SY0-701

WHAT IT IS

Wireless security is the practice of protecting a wireless local area network (WLAN) — defined by NIST SP 800-121 Rev. 2 as "a group of wireless access points and associated infrastructure within a limited geographic area… capable of radio communications" — from unauthorized access, interception, and disruption. Because radio signals propagate beyond physical perimeters, the attack surface extends to anyone within radio range, making encryption and strong authentication the primary controls.

Mental model

Think of a WLAN as a conversation happening in an open room. Anyone in the room can hear it. Wireless security is the combination of a locked door (authentication — who gets in the room), a soundproofing layer (encryption — what they can hear), and a protocol that detects if someone is replaying a recording of a previous conversation (integrity). All three must hold simultaneously; removing any one of them leaves a distinct, exploitable gap.

When to use it

The exam frequently tests which protocol or mechanism to apply in a given scenario. The critical comparison is between authentication modes and between protocol generations:

Scenario	Appropriate control	Why
Home or small office, single shared password	Pre-shared key (PSK) authentication	NIST SP 800-133 Rev. 2 defines PSK as "a secret key established between authorized parties by some secure method" — suitable when a central authentication server is unavailable
Enterprise network requiring per-user identity	EAP-based authentication (802.1X framework)	NIST SP 800-77 Rev. 1 defines EAP as "a framework for adding arbitrary authentication methods in a standardized way to any protocol" — supports per-user credentials and certificate-based methods
Legacy equipment that cannot be upgraded	Risk-acceptance with compensating controls	WEP appears in NIST SP 800-97 and SP 800-77 Rev. 1 as a recognized term, but NIST guidance consistently treats it as a deprecated option requiring mitigation
Untrusted guest WLAN	Network segmentation and access point isolation	Prevents guests from reaching internal resources

COMMON MISCONCEPTION

The trap: hiding the SSID makes the network secure.

NIST NISTIR 7621 Rev. 1 defines an SSID as "a name assigned to a wireless access point that allows stations to distinguish one wireless access point from another." Hiding it changes only the name broadcast — it does not change radio presence, does not encrypt traffic, and does not prevent an attacker who can observe probe-request frames from discovering the network name. Candidates often conflate "not visible in a client scan list" with "protected." A network with a hidden SSID but no strong authentication and encryption provides no meaningful confidentiality protection — NIST SP 800-113 defines confidentiality as "the ability to protect data so that unauthorized parties cannot view the data," which requires encryption, not name suppression.

A related misconception is that WPA2 PSK and WPA2 Enterprise are equivalent in security posture. They are not: PSK uses a single shared secret, so any party who knows the passphrase can decrypt traffic captured before the session; Enterprise mode uses per-session, per-user keying material derived through EAP, which limits the blast radius of a compromised credential.

How it shows up on the exam

The cognitive target is analysis: given a described network configuration or threat scenario, identify which control is missing or misapplied. Candidates often confuse the following:

• Rogue access point vs. evil twin: a rogue AP is an unauthorized device connected to the network; an evil twin is an attacker-controlled AP that mimics a legitimate SSID to intercept traffic. The distinction matters because the mitigations differ (network monitoring vs. client-side certificate validation). A man-in-the-middle attack, which NIST CNSSI 4009-2015 defines as "a form of active wiretapping attack in which the attacker intercepts and selectively modifies communicated data to masquerade as one or more entities," is the likely outcome of an evil-twin scenario — but the question may name the attack, not the mechanism.

• Replay attack vs. eavesdropping: NIST SP 800-63-4 defines a replay attack as one "in which the attacker is able to replay previously captured messages between a legitimate claimant and a verifier to masquerade as that claimant." This is distinct from passive eavesdropping. A protocol with strong per-session, per-packet integrity controls limits replay; encryption alone does not.

• Authentication vs. encryption: an access point can require a password (authentication) while using a weak or broken cipher (encryption). Candidates who treat "requires a password" as synonymous with "traffic is protected" will mis-apply controls in scenario questions.

Signal phrases to watch for: "intercept wireless traffic," "unauthorized AP," "mimics legitimate network," "shared passphrase," "per-user credentials," "decrypt captured frames," "probe requests."

Related concepts

• Secure Baselines — establish the minimum acceptable configuration state that wireless deployments must meet
• Hardening Targets — reducing the attack surface on access points and wireless infrastructure devices specifically
• Mobile Device Management — enforces wireless configuration policy on client devices, including required authentication methods and prohibited network types