Chapter 9 — Network Security Capabilities, Access Control, and Monitoring

0.0(0)

Studied by 0 people

Call Kai

Learn

Practice Test

Spaced Repetition

Match

Flashcards

Knowt Play

Card Sorting

1/514

There's no tags or description

Looks like no tags are added yet.

Last updated 6:50 PM on 6/11/26

Name	Mastery	Learn	Test	Matching	Spaced	Call with Kai

No analytics yet

Send a link to your students to track their progress

515 Terms

New cards

Secure baseline

A secure baseline is a standardized minimum set of security settings that systems, networks, and applications are expected to follow.Example: All managed workstations must use approved authentication, logging, and update settings.Memory trick: Baseline = minimum safe starting point.Trick question tip: A baseline defines the approved configuration; hardening applies and strengthens that configuration.

New cards

Purpose of secure baselines

Secure baselines create consistent security requirements across similar assets and make deviations easier to identify.Example: Administrators compare a server’s current settings with the approved server baseline.Memory trick: Same asset type, same minimum rules.Trick question tip: Standardization, consistency, and configuration comparison indicate secure baselines.

New cards

Secure baseline scope

Secure baselines can be developed for operating systems, network devices, applications, and other configurable IT assets.Example: An organization maintains separate baselines for servers, routers, and business applications.Memory trick: Every asset type needs its own safe starting point.Trick question tip: One universal baseline may not fit assets with different purposes and risks.

New cards

Hardening

Hardening reduces a system’s attack surface and vulnerabilities by applying secure configurations and removing unnecessary functionality.Example: An administrator disables unused services and restricts permissions on a server.Memory trick: Hardening removes easy ways in.Trick question tip: Disabling unnecessary services, patching, and tightening permissions are hardening actions.

New cards

Hardening activities

Common hardening activities include disabling unnecessary services, applying patches, limiting permissions, and enforcing secure configuration settings.Example: A network device is updated and unused management features are turned off.Memory trick: Disable, patch, restrict, configure.Trick question tip: Hardening is an ongoing process rather than a one-time setup task.

New cards

Secure baseline vs hardening

A secure baseline defines the minimum approved security configuration, while hardening is the process of applying and strengthening secure settings to reduce risk.Example: The baseline requires unused services to be disabled, and hardening implements that requirement.Memory trick: Baseline is the standard; hardening is the action.Trick question tip: Asking what settings should exist means baseline. Asking how the system is secured means hardening.

New cards

Attack surface

The attack surface is the total number of exposed services, interfaces, accounts, applications, and other paths an attacker might target.Example: Disabling an unused network service removes one possible attack path.Memory trick: Attack surface = all the doors an attacker could try.Trick question tip: Hardening attempts to reduce the attack surface.

New cards

Wireless security

Wireless security protects wireless networks and communications from unauthorized access, interception, and misuse.Example: An organization uses strong encryption and authentication for its wireless network.Memory trick: Protect data traveling through the air.Trick question tip: Encryption, secure authentication, rogue access points, and wireless monitoring indicate wireless security.

New cards

Wi-Fi Protected Access 3 (WPA3)

Wi-Fi Protected Access 3 is a wireless security standard that provides stronger protection for Wi-Fi communications than older wireless security methods.Example: A company configures supported wireless devices to use WPA3 encryption.Memory trick: WPA3 = newer, stronger Wi-Fi protection.Trick question tip: Choose WPA3 when the scenario asks for the strongest supported modern wireless security option.

New cards

Enterprise wireless authentication

Enterprise wireless authentication validates individual users or devices through centralized authentication services rather than relying only on one shared password.Example: Employees authenticate with unique credentials before joining the corporate wireless network.Memory trick: Enterprise Wi-Fi knows each user separately.Trick question tip: Central authentication and individual credentials indicate enterprise mode.

New cards

Remote Authentication Dial-In User Service (RADIUS)

Remote Authentication Dial-In User Service is a centralized authentication, authorization, and accounting service commonly used for enterprise network access.Example: A wireless controller sends an employee’s authentication request to a RADIUS server.Memory trick: RADIUS checks access from one central place.Trick question tip: Enterprise wireless authentication and centralized AAA commonly point to RADIUS.

New cards

Rogue access point

A rogue access point is an unauthorized wireless access point connected to or operating near an organization’s network.Example: Monitoring detects an unapproved wireless device broadcasting inside the office.Memory trick: Rogue AP = wireless device that does not belong.Trick question tip: Wireless monitoring helps identify rogue access points that may bypass approved controls.

New cards

Wireless monitoring

Wireless monitoring observes wireless activity to detect unauthorized devices, suspicious behavior, interference, and security-policy violations.Example: A security system alerts administrators to an unknown access point.Memory trick: Watch the airwaves.Trick question tip: Monitoring is detective; encryption and authentication are preventive.

New cards

Network Access Control (NAC)

Network Access Control enforces security policy on users and devices attempting to connect to network resources.Example: A device must meet security requirements before receiving normal network access.Memory trick: NAC checks before letting devices onto the network.Trick question tip: Device compliance checks and access enforcement indicate NAC.

New cards

NAC device identification

NAC identifies and categorizes devices connecting to the network so the organization can apply appropriate policies.Example: The system distinguishes a managed laptop from an unapproved personal device.Memory trick: First know what the device is.Trick question tip: Device discovery and classification occur before access decisions.

New cards

NAC posture assessment

NAC posture assessment evaluates whether a connecting device complies with required security conditions.Example: A laptop is checked for approved security settings before receiving full access.Memory trick: Posture asks, “Is this device healthy enough to connect?”Trick question tip: Compliance checks involving patches, security software, or configuration indicate posture assessment.

New cards

NAC policy enforcement

NAC grants, limits, redirects, or denies network access according to device identity and compliance status.Example: A noncompliant device receives restricted access until required corrections are completed.Memory trick: Compliant gets access; noncompliant gets limited.Trick question tip: Quarantine or restricted network access is a common NAC response.

New cards

Continuous NAC monitoring

NAC can continue monitoring devices after connection to ensure they remain compliant with security policy.Example: A device’s access is restricted after its security status changes.Memory trick: NAC checks before and watches after.Trick question tip: NAC is not limited to a one-time login decision.

New cards

NAC vs wireless authentication

Wireless authentication verifies who or what may connect to a wireless network, while NAC evaluates device identity, compliance, and permitted network access.Example: RADIUS validates the user, and NAC checks whether the device meets security requirements.Memory trick: Authentication checks identity; NAC checks identity plus device health and policy.Trick question tip: A user may authenticate successfully but still receive restricted access because the device is noncompliant.

New cards

Multilayered network security

Secure baselines, hardening, wireless protection, and NAC work together as complementary layers of network defense.Example: Devices follow approved baselines, use hardened settings, authenticate securely to Wi-Fi, and pass NAC checks.Memory trick: Standardize, harden, protect wireless, control access.Trick question tip: The strongest design combines multiple controls rather than relying on one security measure.

New cards

Secure baseline

A secure baseline is a standardized collection of approved minimum settings for securely configuring a particular type of system, application, or device.Example: All company servers must follow the same approved logging, access-control, and update requirements.Memory trick: Baseline = minimum safe setup.Trick question tip: The baseline defines the required configuration; hardening applies those settings to an asset.

New cards

Secure baseline coverage

Secure baselines may define requirements for network devices, software, updates, access controls, logging, monitoring, passwords, encryption, and endpoint protection.Example: A workstation baseline requires encryption, antimalware, strong authentication, and security logging.Memory trick: Configure, patch, control, log, encrypt, protect.Trick question tip: Baselines cover more than operating-system settings.

New cards

Benefits of secure baselines

Secure baselines improve security, manageability, and operational efficiency by creating consistent configuration rules across similar assets.Example: Administrators manage hundreds of workstations using one approved configuration standard.Memory trick: Consistent settings are easier to secure and manage.Trick question tip: Standardization and centralized configuration requirements point to secure baselines.

New cards

Center for Internet Security (CIS)

The Center for Internet Security publishes widely used security best practices and secure configuration guidance.Example: An organization consults CIS guidance when developing its server baseline.Memory trick: CIS publishes secure-setting guidance.Trick question tip: Community-developed configuration recommendations for many commercial technologies commonly indicate CIS.

New cards

CIS Benchmark

A CIS Benchmark is a secure configuration guide containing recommended settings for a particular technology or product.Example: Administrators use a CIS Benchmark to secure a Linux server.Memory trick: CIS Benchmark = secure configuration checklist.Trick question tip: CIS Benchmarks provide recommendations; organizations must still evaluate and implement the appropriate settings.

New cards

CIS Benchmark scope

CIS Benchmarks are available for technologies such as operating systems, network devices, browsers, servers, databases, virtualization platforms, and applications.Example: Separate benchmarks are selected for a server operating system and a web browser.Memory trick: CIS covers many asset types.Trick question tip: Select a benchmark matching the exact product, version, and organizational use.

New cards

CIS Benchmark updates

CIS Benchmarks are maintained and updated as security risks, technologies, and recommended practices change.Example: An organization reviews a newer benchmark version before updating its baseline.Memory trick: Changing threats require changing guidance.Trick question tip: Baselines should be reviewed periodically rather than treated as permanent.

New cards

Security Technical Implementation Guide (STIG)

A Security Technical Implementation Guide is standardized security configuration guidance developed by the Defense Information Systems Agency for United States Department of Defense systems.Example: A government system is configured according to the applicable STIG.Memory trick: STIG = DoD secure configuration guide.Trick question tip: DISA or Department of Defense requirements strongly indicate a STIG.

New cards

Defense Information Systems Agency (DISA)

The Defense Information Systems Agency develops and maintains STIG guidance for securing Department of Defense information systems.Example: An administrator checks DISA guidance before deploying a government server.Memory trick: DISA delivers STIGs.Trick question tip: Match DISA with STIG secure baselines.

New cards

CIS Benchmark vs STIG

A CIS Benchmark provides broadly used secure configuration recommendations, while a STIG provides standardized configuration requirements designed for Department of Defense environments.Example: A private organization adopts CIS guidance, while a defense environment follows the applicable STIG.Memory trick: CIS is broad guidance; STIG is DoD-focused.Trick question tip: Government defense requirements point to STIG; general industry best practices often point to CIS.

New cards

Baseline compliance mapping

Secure configuration guidance may be mapped to security frameworks and compliance requirements to show how settings support required controls.Example: An organization maps configuration recommendations to its payment-card security obligations.Memory trick: Map technical settings to compliance rules.Trick question tip: A mapping helps demonstrate alignment but does not automatically guarantee full compliance.

New cards

Configuration management tool

A configuration management tool automates the deployment, enforcement, and maintenance of approved settings across systems.Example: A management platform applies the approved server baseline to newly deployed systems.Memory trick: Automate the approved configuration.Trick question tip: Deploying settings and correcting drift indicate configuration management.

New cards

Configuration drift

Configuration drift occurs when a system’s current settings deviate from its approved baseline over time.Example: An undocumented troubleshooting change leaves an unnecessary service enabled.Memory trick: Drift = settings wander from the baseline.Trick question tip: Compare actual settings with approved settings to detect drift.

New cards

Automated baseline enforcement

Automated baseline enforcement applies required settings and may correct unauthorized deviations from the approved configuration.Example: A management tool restores a security setting that was changed outside the approved process.Memory trick: Detect the drift and put it back.Trick question tip: Automatic remediation is stronger than merely reporting noncompliance.

New cards

Puppet, Chef, and Ansible

Puppet, Chef, and Ansible are configuration-management and automation tools that can deploy standardized settings across systems.Example: An organization uses automation to configure many servers consistently.Memory trick: Automation tools push repeatable configurations.Trick question tip: These tools support configuration deployment and consistency rather than vulnerability scoring.

New cards

Group Policy

Group Policy centrally configures and enforces settings for users and computers in a Microsoft domain environment.Example: Administrators enforce password, logging, and security settings across managed workstations.Memory trick: Group Policy pushes Windows rules centrally.Trick question tip: Centralized domain-based Windows configuration commonly indicates Group Policy.

New cards

Configuration deployment vs compliance assessment

Configuration-deployment tools apply baseline settings, while compliance-assessment tools inspect systems to determine whether those settings are present.Example: One tool configures a server, and another scans it for deviations.Memory trick: Deployment sets; assessment checks.Trick question tip: Do not confuse enforcing a baseline with measuring adherence to it.

New cards

Security Content Automation Protocol (SCAP)

Security Content Automation Protocol is a collection of standards that supports automated security configuration assessment and standardized reporting.Example: A compatible scanner checks a system against machine-readable baseline content.Memory trick: SCAP standardizes automated security checking.Trick question tip: SCAP is a standards framework, not one specific scanner.

New cards

OpenSCAP

OpenSCAP is an SCAP-compatible tool used to evaluate systems against security and compliance configuration content.Example: A server is assessed to identify settings that do not meet its approved baseline.Memory trick: OpenSCAP checks SCAP content.Trick question tip: Automated SCAP-based configuration assessment indicates OpenSCAP.

New cards

CIS-CAT Pro

CIS-CAT Pro is a CIS assessment tool used to compare system configurations with applicable CIS Benchmarks.Example: An organization generates a report showing which workstation settings meet CIS recommendations.Memory trick: CIS-CAT checks CIS Benchmarks.Trick question tip: Measuring compliance specifically against CIS guidance points to CIS-CAT.

New cards

SCAP Compliance Checker (SCC)

The SCAP Compliance Checker is a DISA-maintained tool used to measure system compliance with applicable STIG requirements.Example: A defense system is scanned to identify STIG configuration findings.Memory trick: SCC checks STIG compliance.Trick question tip: DISA, SCAP, and STIG assessment together indicate SCC.

New cards

OpenSCAP vs CIS-CAT vs SCC

OpenSCAP evaluates SCAP-compatible content, CIS-CAT assesses systems against CIS Benchmarks, and SCC is used to measure compliance with STIG guidance.Example: The assessment tool is selected according to the baseline being evaluated.Memory trick: OpenSCAP for SCAP, CIS-CAT for CIS, SCC for STIG.Trick question tip: Match the tool to the configuration standard named in the scenario.

New cards

Hardening

Hardening improves security by changing insecure defaults, applying approved baseline settings, and reducing unnecessary exposure.Example: An administrator removes unused services and enables secure management protocols.Memory trick: Hardening closes unnecessary doors.Trick question tip: Disabling, restricting, patching, and securely configuring are hardening actions.

New cards

Default configuration risk

Default configurations often prioritize compatibility and ease of setup and may include insecure services, weak policies, or well-known credentials.Example: A newly installed device still uses its manufacturer-provided administrative login.Memory trick: Default means predictable to attackers.Trick question tip: Never assume a device is secure simply because it is newly installed.

New cards

Default credentials

Default credentials are manufacturer-provided usernames or passwords that must be changed before a system is placed into service.Example: An administrator replaces the original management password during deployment.Memory trick: Default password = attacker may know it too.Trick question tip: Changing default credentials is one of the first hardening actions.

New cards

Disabling unnecessary services

Disabling unnecessary services reduces the number of software functions attackers can target.Example: A network device has an unused management service turned off.Memory trick: If it is not needed, do not run it.Trick question tip: Fewer running services means a smaller attack surface.

New cards

Disabling unused interfaces

Disabling unused physical and logical interfaces prevents unauthorized connections through ports that have no business purpose.Example: Unused switch ports are administratively disabled.Memory trick: Unused port, closed door.Trick question tip: Disabling an interface prevents connectivity; port security controls devices on an enabled switch port.

New cards

Secure management protocol

A secure management protocol protects administrative sessions with encryption and secure authentication.Example: Administrators use an encrypted protocol to manage a router remotely.Memory trick: Protect the administrator’s connection.Trick question tip: Replace plaintext management protocols with encrypted alternatives.

New cards

Secure Shell (SSH) vs Telnet

Secure Shell encrypts remote command-line management traffic, while Telnet transmits session information without equivalent protection.Example: A router permits SSH administration and disables Telnet.Memory trick: SSH is secure; Telnet tells in plaintext.Trick question tip: Choose SSH for secure remote command-line administration.

New cards

HTTPS vs HTTP

Hypertext Transfer Protocol Secure encrypts web-management traffic, while ordinary HTTP does not provide equivalent transport encryption.Example: A switch’s administrative web interface accepts only protected HTTPS sessions.Memory trick: The S means secured in transit.Trick question tip: Use HTTPS rather than HTTP for browser-based device management.

New cards

Access Control List (ACL)

An Access Control List is a set of rules that permits or denies traffic or access according to defined conditions.Example: A router allows management connections only from an approved administrative network.Memory trick: ACL = who or what is allowed through.Trick question tip: Restricting access by source, destination, protocol, or service commonly indicates an ACL.

New cards

Management-plane restriction

Management-plane restriction limits administrative access to approved users, devices, and networks.Example: Only a protected administrator workstation can connect to a router’s management interface.Memory trick: Only trusted systems manage the device.Trick question tip: Restricting who can configure network equipment protects the management plane.

New cards

Network-device logging and monitoring

Logging and monitoring record and review events such as login failures, configuration changes, and suspicious activity on switches and routers.Example: Repeated failed administrator logins generate an alert.Memory trick: Record changes and watch for trouble.Trick question tip: Logging creates evidence; monitoring reviews or alerts on that evidence.

New cards

Switch port security

Switch port security limits which devices can connect through a particular switch port.Example: A switch port permits only an approved device identifier and rejects an unexpected device.Memory trick: Port security controls who plugs in.Trick question tip: Port security applies to access through a switch port and is different from disabling an unused port.

New cards

Strong password policy

A strong password policy defines requirements that reduce the likelihood of passwords being guessed, reused, or otherwise compromised.Example: Administrative accounts must use organization-approved password requirements.Memory trick: Strong rules make passwords harder to attack.Trick question tip: Password controls help, but multifactor authentication provides an additional protection layer.

New cards

Physical security for network devices

Network devices should be placed in secured rooms, cabinets, or racks to prevent unauthorized physical access.Example: Core switches are installed in a locked network room.Memory trick: A locked console still needs a locked room.Trick question tip: Physical access may allow attackers to reset, disconnect, replace, or directly configure equipment.

New cards

Server hardening

Server hardening applies secure configuration, patching, access control, monitoring, endpoint protection, and physical safeguards to reduce server risk.Example: A server is patched, stripped of unnecessary services, and configured according to an approved benchmark.Memory trick: Patch, minimize, restrict, monitor, protect.Trick question tip: Server hardening combines several controls rather than one setting.

New cards

Server attack surface

Every enabled service, application, account, interface, and open port can increase a server’s attack surface.Example: Removing an unused server application eliminates a possible attack path.Memory trick: More running features mean more possible doors.Trick question tip: Reduce attack surface by removing or disabling unnecessary functionality.

New cards

Patch management for servers

Patch management identifies, tests, deploys, and tracks updates that correct known server vulnerabilities.Example: A centralized process deploys an approved operating-system security update.Memory trick: Find, test, patch, verify.Trick question tip: Automated patching improves consistency, but critical updates should still be managed and validated.

New cards

Principle of least privilege

The principle of least privilege grants users, accounts, and processes only the permissions needed to perform their required functions.Example: A service account receives access only to the application resources it uses.Memory trick: Give only what the job needs.Trick question tip: Least privilege reduces the damage caused by compromised or misused accounts.

New cards

Server firewall

A server firewall filters network traffic entering or leaving the host according to defined security rules.Example: The server accepts connections only for its required application service.Memory trick: Host firewall protects the individual server.Trick question tip: A network firewall and host firewall can be used together as defense in depth.

New cards

Intrusion Detection System (IDS)

An Intrusion Detection System monitors activity for suspicious patterns and generates alerts for investigation.Example: An IDS alerts security personnel to unusual traffic targeting a server.Memory trick: IDS detects and reports.Trick question tip: Detection and alerting indicate an IDS; automatic blocking more strongly suggests an intrusion prevention function.

New cards

Strong server access controls

Strong server access controls may combine password policies, multifactor authentication, and privileged-access restrictions.Example: Administrators must use approved MFA before accessing a critical server.Memory trick: Strong login plus limited privilege.Trick question tip: Authentication proves identity; authorization controls what the authenticated account may do.

New cards

Multifactor authentication (MFA)

Multifactor authentication requires two or more different factor types before granting access.Example: An administrator provides a password and an approved possession factor.Memory trick: Two different kinds of proof.Trick question tip: Two passwords are not MFA because both are knowledge factors.

New cards

Privileged Access Management (PAM)

Privileged Access Management controls, monitors, and protects accounts with elevated administrative permissions.Example: Administrator credentials are checked out through a controlled system and their use is recorded.Memory trick: PAM protects powerful accounts.Trick question tip: Vaulting, approval, session monitoring, and control of administrator credentials indicate PAM.

New cards

Server logging and monitoring

Server logging and monitoring provide evidence of authentication events, configuration changes, failures, and suspicious activity.Example: Security personnel investigate repeated failed attempts to access an administrator account.Memory trick: Logs remember; monitoring notices.Trick question tip: Enable logging, centralize important records, and monitor them for actionable events.

New cards

Antivirus and antimalware

Antivirus and antimalware solutions detect, block, and quarantine known or suspicious malicious software.Example: Endpoint protection isolates a malicious file found on a server.Memory trick: Detect, block, quarantine.Trick question tip: Antimalware is one security layer and does not replace patching, least privilege, or secure configuration.

New cards

Physical security for servers

Server racks, server rooms, and datacenters should restrict physical access to authorized personnel.Example: Critical servers are housed in locked racks inside a controlled room.Memory trick: Protect the server’s body as well as its software.Trick question tip: Physical access can bypass or undermine many logical security controls.

New cards

Network-device hardening vs server hardening

Network-device hardening emphasizes secure management, ACLs, port security, and disabled interfaces, while server hardening emphasizes service reduction, patching, host protection, and strong account controls.Example: A switch restricts its management network while a server removes an unnecessary application service.Memory trick: Network devices control traffic; servers protect hosted services.Trick question tip: Both require changed defaults, logging, strong access controls, secure baselines, and physical protection.

New cards

Baseline compliance lifecycle

A baseline compliance lifecycle includes selecting appropriate guidance, tailoring requirements, deploying settings, assessing compliance, correcting deviations, and reviewing the baseline over time.Example: An organization applies a benchmark, scans for drift, remediates findings, and updates the standard when requirements change.Memory trick: Select, apply, check, correct, update.Trick question tip: Secure configuration management is continuous and should include both enforcement and verification.

New cards

Wireless network installation considerations

Wireless network installation considerations include access-point placement, radio-band selection, channel planning, coverage, interference, capacity, and signal testing.Example: An organization performs a site survey before deciding where to install its access points.Memory trick: Place, measure, configure, verify.Trick question tip: Coverage gaps, channel overlap, signal strength, and WAP placement are wireless-installation concerns.

New cards

Wireless coverage

Wireless coverage is the physical area in which authorized devices can receive a usable signal from an approved access point.Example: Employees can maintain reliable wireless access throughout the office.Memory trick: Coverage asks, “Where can the Wi-Fi reach?”Trick question tip: Weak or missing coverage can push users toward unauthorized or deceptive access points.

New cards

Wireless coverage gap

A wireless coverage gap is an area where the authorized wireless signal is unavailable or too weak for reliable use.Example: Employees lose connectivity in a conference room far from the nearest access point.Memory trick: Coverage gap = Wi-Fi dead zone.Trick question tip: Dead zones may require WAP relocation, transmit-power adjustment, or an additional access point.

New cards

Patchy wireless coverage risk

Patchy coverage increases the chance that users will connect to unauthorized or deceptive wireless networks offering a stronger signal.Example: A user chooses an unknown network because the approved company signal is unreliable.Memory trick: Weak trusted Wi-Fi makes fake Wi-Fi tempting.Trick question tip: Reliable authorized coverage helps reduce exposure to rogue and evil twin access points.

New cards

Wireless Access Point (WAP)

A Wireless Access Point connects wireless client devices to a wired network and forwards traffic between them.Example: A laptop communicates wirelessly with a WAP that forwards its traffic to the switched network.Memory trick: WAP bridges wireless devices to the wired network.Trick question tip: Client Wi-Fi traffic entering a wired infrastructure passes through a WAP.

New cards

Infrastructure wireless network

An infrastructure wireless network uses one or more access points connected to a wired network to provide wireless connectivity.Example: Several office WAPs connect mobile devices to the company’s switched network.Memory trick: Infrastructure mode uses access points.Trick question tip: Connections through centralized WAPs indicate infrastructure mode rather than direct peer-to-peer communication.

New cards

WAP placement

WAP placement determines where access points are physically installed to provide suitable coverage, capacity, and signal quality.Example: Access points are positioned to cover work areas while avoiding major sources of interference.Memory trick: Put the WAP where the signal is needed.Trick question tip: WAP placement should be based on measured conditions rather than convenience alone.

New cards

Basic Service Set Identifier (BSSID)

A Basic Service Set Identifier is the MAC address that identifies a specific wireless access point radio.Example: Two WAPs broadcasting the same network name have different BSSIDs.Memory trick: BSSID identifies the specific base station.Trick question tip: A MAC-address identifier for one AP radio is the BSSID.

New cards

Service Set Identifier (SSID)

A Service Set Identifier is the human-readable name used to identify a wireless network.Example: Several access points broadcast the same approved company wireless-network name.Memory trick: SSID = Wi-Fi network name.Trick question tip: The SSID names the network, while the BSSID identifies a particular WAP radio.

New cards

SSID vs BSSID

The SSID identifies the wireless network by name, while the BSSID identifies a specific access point radio by MAC address.Example: Several WAPs share one SSID but each has a unique BSSID.Memory trick: SSID is the network name; BSSID is the specific radio.Trick question tip: Roaming networks commonly use one SSID across multiple BSSIDs.

New cards

Wireless radio band

A wireless radio band is a frequency range used to carry Wi-Fi communications.Example: An access point provides service using the 2.4 GHz, 5 GHz, or 6 GHz band.Memory trick: Band = frequency neighborhood.Trick question tip: Radio-band selection affects range, interference, channel availability, and device compatibility.

New cards

2.4 GHz band

The 2.4 GHz band generally provides broad coverage and device compatibility but has limited nonoverlapping channels and is commonly affected by interference.Example: A distant device maintains connectivity through a 2.4 GHz signal.Memory trick: 2.4 travels farther but is more crowded.Trick question tip: Longer range and greater interference are common 2.4 GHz clues.

New cards

5 GHz band

The 5 GHz band provides more channel space and typically experiences less interference than 2.4 GHz, though its effective range may be shorter.Example: An office uses 5 GHz to provide higher-capacity wireless access in work areas.Memory trick: 5 GHz = more channels, shorter reach.Trick question tip: More nonoverlapping channels and reduced congestion favor 5 GHz.

New cards

6 GHz band

The 6 GHz band provides additional wireless spectrum and channel capacity for compatible modern devices.Example: Supported clients use 6 GHz while older devices remain on other bands.Memory trick: 6 GHz = newer, wider wireless space.Trick question tip: Verify client and access-point compatibility before relying on 6 GHz coverage.

New cards

2.4 GHz vs 5 GHz vs 6 GHz

2.4 GHz generally offers greater range and compatibility, while 5 GHz and 6 GHz provide more channel capacity with typically shorter effective range and stricter compatibility requirements.Example: An organization uses different bands according to device support, coverage, and performance needs.Memory trick: Lower travels farther; higher provides more space.Trick question tip: Band selection is a trade-off among range, interference, capacity, and compatibility.

New cards

Wireless channel

A wireless channel is a defined portion of a radio band used by an access point to transmit and receive wireless traffic.Example: Nearby WAPs are assigned different channels to reduce interference.Memory trick: Channel = lane inside the radio band.Trick question tip: Each WAP radio must use an appropriate channel within its configured frequency band.

New cards

Channel planning

Channel planning assigns channels to access points to reduce interference and improve wireless performance.Example: Neighboring WAPs use sufficiently separated channels rather than competing on the same channel.Memory trick: Nearby WAPs need different lanes.Trick question tip: Channel planning is based on both channel use and physical proximity.

New cards

Nonoverlapping channels

Nonoverlapping channels use frequency ranges that do not significantly interfere with one another.Example: Nearby access points are configured on channels that do not overlap.Memory trick: Separate channels avoid talking over each other.Trick question tip: The 5 GHz band generally offers more nonoverlapping-channel options than 2.4 GHz.

New cards

Co-channel interference

Co-channel interference occurs when nearby access points or clients compete for airtime on the same wireless channel.Example: Several neighboring WAPs using one channel cause reduced performance.Memory trick: Same channel means everyone takes turns.Trick question tip: Reusing the same channel too closely can create congestion even when the channels do not overlap.

New cards

Adjacent-channel interference

Adjacent-channel interference occurs when nearby wireless channels overlap and disrupt one another’s transmissions.Example: Two nearby WAPs use partially overlapping channels and experience poor performance.Memory trick: Neighboring lanes overlap and collide.Trick question tip: Widely spacing channels helps reduce adjacent-channel interference.

New cards

Co-channel vs adjacent-channel interference

Co-channel interference involves devices competing on the same channel, while adjacent-channel interference involves partially overlapping channels disrupting one another.Example: Two WAPs on one channel compete for airtime, while WAPs on overlapping channels create additional signal interference.Memory trick: Same channel competes; overlapping channels collide.Trick question tip: Proper channel reuse addresses co-channel congestion, while nonoverlapping selection addresses adjacent-channel interference.

New cards

Channel bonding

Channel bonding combines adjacent wireless channels to create a wider channel and increase potential bandwidth.Example: A WAP combines channel space to support higher data rates.Memory trick: Bond channels to make one wider lane.Trick question tip: Wider channels may increase speed but consume more spectrum and increase interference risk.

New cards

Channel-bonding trade-off

Channel bonding can improve bandwidth but reduces the number of separate channels available and may increase interference.Example: A wide channel performs well in a quiet environment but interferes with nearby wireless networks.Memory trick: Wider channel, fewer lanes for everyone else.Trick question tip: More bandwidth is not always better in crowded wireless environments.

New cards

Wireless interference

Wireless interference is unwanted radio-frequency energy that reduces signal quality, throughput, or reliability.Example: A nearby microwave appliance disrupts communication in part of an office.Memory trick: Interference makes wireless signals harder to hear.Trick question tip: Walls, reflective materials, motors, other radios, and overlapping channels can contribute to interference.

New cards

Physical obstruction

A physical obstruction is a building feature or object that weakens, blocks, reflects, or redirects wireless signals.Example: A thick stone wall reduces signal strength in an adjacent room.Memory trick: Dense objects block the radio path.Trick question tip: Metal, concrete, stone, and elevator enclosures commonly reduce wireless coverage.

New cards

Reflective surface interference

Reflective surfaces can redirect wireless signals and create inconsistent coverage or multipath effects.Example: Metal surfaces cause signals to arrive through several reflected paths.Memory trick: Radio waves can bounce like echoes.Trick question tip: Metal walls, enclosures, and similar surfaces should be noted during a site survey.

New cards

Radio-frequency interference source

An interference source is equipment or activity that emits energy within or near the wireless frequency range.Example: Motors and microwave appliances are marked on the site map before access-point placement.Memory trick: Other electronics can make noise in the air.Trick question tip: A site survey should document predictable environmental interference sources.

New cards

Site survey

A wireless site survey measures signal coverage, channel use, interference, and environmental conditions throughout the intended service area.Example: A technician records wireless measurements at regularly spaced office locations.Memory trick: Site survey measures the real wireless environment.Trick question tip: Use a site survey to determine WAP placement and configuration rather than relying only on a floor plan.

New cards

Site survey architectural map

A site survey begins with a map showing the physical layout and features that may affect wireless propagation.Example: The survey map marks thick walls, reflective surfaces, elevators, and interference-producing equipment.Memory trick: Map the obstacles before measuring the signal.Trick question tip: Architectural features help explain why signal strength differs across locations.

100

New cards

Wi-Fi analyzer

A Wi-Fi analyzer is software that measures wireless signals, channels, network identifiers, and related radio conditions.Example: A technician uses a managed mobile device to record signal strength throughout a building.Memory trick: Wi-Fi analyzer sees the wireless environment.Trick question tip: Signal measurement and channel-use analysis point to a Wi-Fi analyzer.