CWNP CWAP-404 Online Practice Questions and Exam Preparation

CWNP CWAP-404 Online Questions & Answers

• Question 11:

  When would you expect to see a Reassociation Request frame?

  A. Every time a STA associates to an AP to which it has previously been associated
  B. Only when a STA is using FT roaming
  C. Only when a STA roams back to an AP it has previously been associated with
  D. Every time a STA roams
  D. Every time a STA roams

  ---

  Explanation/Reference:

  A Reassociation Request frame is sent every time a STA roams from one AP to another within the same ESS. A Reassociation Request frame is similar to an Association Request frame, but it also contains the BSSID of the current AP that the STA is leaving. This allows the new AP to coordinate with the old AP and transfer the STA's context information, such as security keys, QoS parameters, and buffered frames. This way, the STA can maintain its connectivity and session continuity during roaming . References: CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 195;CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 196.

• Question 12:

  Which one of the following should be the first step when troubleshooting a WLAN issue?

  A. Identify probable causes
  B. Identify capture locations
  C. Perform an initial WLAN scan and see if any obvious issues stand out
  D. Define the problem
  D. Define the problem

  ---

  Explanation/Reference:

  The first step in any troubleshooting process is to define the problem. This involves gathering information from various sources, such as users, network administrators, network documentation, and network monitoring tools.

  Defining the problem helps to narrow down the scope of the issue and identify the symptoms, causes, and effects of the problem12 References:

  CWAP-403 Study Guide, Chapter 1: Troubleshooting Methodology, page 7 CWAP-403 Objectives, Section 1.1: Define the problem

• Question 13:

  As a wireless network consultant you have been called in to troubleshoot a high-priority issue for one of your customers. The customer's office is based on two floors within a multi- tenant office block. On one of these floors (floor 5) users cannot connect to the wireless network. During their own testing the customer has discovered that users can connect on floor 6 but not when they move to the floor 5. This issue is affecting all users on floor 5 and having a negative effect on productivity.

  To troubleshoot this issue, you perform both Spectrum and Protocol Analysis. The Spectrum Analysis shows the presence of Bluetooth signals which you have identified as coming from wireless mice. In the protocol analyzer you see the top frame on the network is Deauthentication frames. On closer investigation you see that the Deauthentication frames' source addresses match the BSSIDs of your customers APs and the destination address is FF:FF:FF:FF:FF:FF:FF.

  What do you conclude from this troubleshooting exercise?

  A. The customer should replace all their Bluetooth wireless mice as they are stopping the users on floor 5 from connecting to the wireless network
  B. The users on floor 5 are being subjected to a denial of service attack, as this is happening across the entire floor it is likely to be a misconfigured WIPS solution belonging to the tenants on the floor below
  C. The customers APs are misbehaving and a technical support case should be open with the vendor
  D. The CCI from the APs on the floor 4 is the problem and you need to ask the tenant below to turn down their APs Tx power
  B. The users on floor 5 are being subjected to a denial of service attack, as this is happening across the entire floor it is likely to be a misconfigured WIPS solution belonging to the tenants on the floor below

  ---

  Explanation/Reference:

  The users on floor 5 are being subjected to a denial of service attack, as this is happening across the entire floor it is likely to be a misconfigured WIPS solution belonging to the tenants on the floor below. This is because the

  Deauthentication frames have a source address that matches the BSSIDs of the customer's APs and a destination address that is a broadcast address (FF:FF:FF:FF:FF:FF). This indicates that someone is sending spoofed Deauthentication

  frames to all STAs associated with the customer's APs, causing them to disconnect from the wireless network. This is a common type of DoS attack on wireless networks, and it could be caused by a rogue device or a WIPS solution that is

  configured to protect the wireless network of another tenant on the floor below12. References: CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 13: Troubleshooting Common Wi-Fi Issues, page 4961;

  CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 14:

  Troubleshooting Tools, page 5272.

• Question 14:

  When configuring a long-term, forensic packet capture and saving all packets to disk which of the following is not a consideration?

  A. Real-time packet decodes
  B. Analyzer location
  C. Total capture storage space
  D. Individual trace file size
  A. Real-time packet decodes

  ---

  Explanation/Reference:

  Real-time packet decodes are not a consideration when configuring a long- term, forensic packet capture and saving all packets to disk. Real-time packet decodes are useful for live analysis and troubleshooting, but they consume CPU and memory resources that could affect the performance of the capture process. For a long-term, forensic packet capture, it is more important to consider the analyzer location, the total capture storage space, and the individual trace file size. These factors affect the quality and quantity of the captured packets and the ease of post-capture analysis34 References: CWAP-404 Study Guide, Chapter 2: Protocol Analysis, page 49 CWAP-404 Objectives, Section 2.1: Configure protocol analyzers

• Question 15:

  The network administrator at ABC Engineering has taken a large packet capture from one of their APs running in monitor mode. She has very little knowledge of 802.11 protocols but would like to use the capture file to evaluate the overall health and performance of their wireless network. When she asks your advice, which tool do you recommend she opens the packet capture file with?

  A. Spectrum analyzer
  B. Python
  C. Capture visualization tool
  D. WLAN scanner
  C. Capture visualization tool

  ---

  Explanation/Reference:

  A capture visualization tool is a software application that can open a packet capture file and display various graphs, charts, tables, and statistics that illustrate the characteristics and behavior of the wireless network. A capture visualization tool can help a network administrator with little knowledge of 802.11 protocols to evaluate the overall health and performance of their wireless network by providing a visual and intuitive representation of the captured data. A spectrum analyzer is a hardware device that measures the radio frequency signals in a given frequency range and displays their amplitude, frequency, and modulation. A spectrum analyzer can help identify sources of interference and noise in the wireless environment, but it cannot open a packet capture file. Python is a programming language that can be used to write scripts or applications that manipulate or analyze packet capture files, but it requires coding skills and knowledge of 802.11 protocols. A WLAN scanner is a software application that scans for available wireless networks and displays information such as SSID, BSSID, channel, signal strength, security type, and vendor. A WLAN scanner can help discover wireless networks and their basic parameters, but it cannot open a packet capture file345 References: CWAP-404 Study Guide, Chapter 2: Protocol Analysis, page 63 CWAP-404 Objectives, Section 2.5: Use capture visualization tools CWAP-404 Study Guide, Chapter 4: Spectrum Analysis and Troubleshooting, page 117 CWAP-404 Objectives, Section 4.1: Use spectrum analysis tools CWAP-404 Study Guide, Chapter 2: Protocol Analysis, page 33 CWAP-404 Objectives, Section 2.2: Analyze field values

• Question 16:

  Which one of the following is not an 802.11 Management frame?

  A. PS-Poll
  B. Action
  C. Beacon
  D. Authentication
  A. PS-Poll

  ---

  Explanation/Reference:

  A PS-Poll (Power Save Poll) frame is not an 802.11 management frame. A PS-Poll frame is a type of control frame that is used by a STA in power save mode to request data frames from an AP. A STA in power save mode can conserve battery power by periodically sleeping and waking up. When a STA sleeps, it cannot receive any data frames from the AP, so it informs the AP of its power save status by setting a bit in its MAC header. The AP then buffers any data frames destined for the sleeping STA until it wakes up. When a STA wakes up, it sends a PS-Poll frame to the AP, indicating its association ID and requesting any buffered data frames. The AP thenresponds with one or more data frames, followed by an ACK or BA frame from the STA. The other options are not correct, as they are types of 802.11 management frames. An Action frame is used to perform various management actions, such as spectrum management, QoS management, radio measurement, etc. A Beacon frame is used to advertise the presence and capabilities of an AP or BSS. An Authentication frame is used to establish or terminate an authentication relationship between a STA and an AP. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 6: 802.11 Frame Exchanges, page 169-170

• Question 17:

  In a Spectrum Analyzer the Swept Spectrogram plot displays what information?

  A. RF power present at a particular frequency over the course of time
  B. Reductions in frame transmissions
  C. Wi-Fi Device information
  D. The RF time domain
  A. RF power present at a particular frequency over the course of time

  ---

  Explanation/Reference:

  The Swept Spectrogram plot is a spectrum analysis plot that shows the RF power present at a particular frequency over the course of time. It can help identify trends and patterns in the RF spectrum over a longer period of time. It can also show how the RF environment changes over time and how different sources of RF signals affect each other. The other options are not correct, as they describe different types of plots or information that are not related to the Swept Spectrogram plot. References: [Wireless Analysis Professional Study Guide], Chapter 3: Spectrum Analysis, page 72-73

• Question 18:

  Protocol analyzers may present field values in either binary, decimal or hexadecimal. What preceeds a hexadecimal value to indicate it is hexadecimal?

  A. 0x
  B. 16x
  C. %
  D. HEX
  A. 0x
  C. %

• Question 19:

  In the 2.4 GHZ band, what data rate are Probe Requests usually sent at from an unassociated STA?

  A. 1 Mbps
  B. The minimum basic rate
  C. MCS 0
  D. 6 Mbps
  B. The minimum basic rate

  ---

  Explanation/Reference:

  In the 2.4 GHz band, probe requests are usually sent at the minimum basic rate from an unassociated STA. A probe request is a type of management frame that is transmitted by a STA to discover available BSSs in its vicinity. A probe request can be sent on one or more channels in either passive or active scanning mode. In passive scanning mode, a STA listens for beacon frames from APs on each channel. In active scanning mode, a STA sends probe requests on each channel and waits for probe responses from APs. A probe request is usually sent at the minimum basic rate, which is the lowest data rate among the supported rates that is required for all STAs to join and communicate with a BSS. The minimum basic rate can vary depending on the configuration of each BSS, but it is typically one of these values: 1 Mbps, 2 Mbps, 5.5 Mbps, or 11 Mbps in the 2.4 GHz band. The other options are not correct, as they do not reflect how probe requests are usually sent in the 2.4 GHz band. MCS 0 is a modulation and coding scheme used by 802.11n/ac devices in either band, but it is not a data rate per se. 6 Mbps is a data rate used by OFDM devices in either band, but it is not usually configured as a minimum basic rate in the 2.4 GHz band. References: [Wireless Analysis Professional Study Guide CWAP- 404], Chapter 5: 802.11 MAC Sublayer, page 123-124

• Question 20:

  When a data frame is encrypted with WPA2, to which portion of the frame is the encryption applied?

  A. Frame body and MAC Header
  B. Frame body excluding the LLCPDU
  C. Frame body including the LLCPDU
  D. The whole MPDU
  C. Frame body including the LLCPDU

  ---

  Explanation/Reference:

  When a data frame is encrypted with WPA2, the encryption is applied to the frame body including the LLCPDU. The LLCPDU (Logical Link Control Protocol Data Unit) is a part of the frame body that contains information such as protocol type, source and destination service access points (SAPs), and control fields. The LLCPDU is added by the LLC (Logical Link Control) sublayer to provide multiplexing and flow control functions for different upper layer protocols. When a data frame is encrypted with WPA2, which uses AES-CCMP as its encryption algorithm, both the payload and the LLCPDU are encrypted as a single unit. The MAC header and FCS are not encrypted, as they are needed for addressing and error detection purposes. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 5: 802.11 MAC Sublayer, page 115-116