CWNP CWAP-404 Online Practice Questions and Exam Preparation

CWNP CWAP-404 Online Questions & Answers

• Question 21:

  What is encrypted within the third message of the 4-Way Handshake?

  A. PMK
  B. PTK
  C. GMK
  D. GTK
  D. GTK

  ---

  Explanation/Reference:

  The GTK (Group Temporal Key) is encrypted within the third message of the 4-Way Handshake. The 4-Way Handshake is a process that establishes a secure connection between a STA (station) and an AP (access point) using WPA2 (Wi-Fi Protected Access 2), which is a security protocol that uses AES-CCMP (Advanced Encryption Standard-Counter Mode CBC-MAC Protocol) as its encryption algorithm. The 4- Way Handshake consists of four messages that are exchanged between the STA and the AP. The first message is sent by the AP to the STA, containing the ANonce (Authenticator Nonce), which is a random number generated by the AP. The second message is sent by the STA to the AP, containing the SNonce (Supplicant Nonce), which is a random number generated by the STA, and the MIC (Message Integrity Code), which is a value that verifies the integrity of the message. The third message is sent by the AP to the STA, containing the GTK, which is a key that is used to encrypt and decrypt multicast and broadcast data frames, and the MIC. The GTK is encrypted with the KEK (Key Encryption Key), which is derived from the PTK (Pairwise Temporal Key). The PTK is a key that is used to encrypt and decrypt unicast data frames, and it is derived from the PMK (Pairwise Master Key), the ANonce, and the SNonce. The fourth message is sent by the STA to the AP, containing only the MIC, to confirm the completion of the 4-Way Handshake. The other options are not correct, asthey are not encrypted within the third message of the 4-Way Handshake. The PMK is a key that is derived from a passphrase or obtained from an authentication server, and it is not transmitted in any message of the 4-Way Handshake. The PTK is a key that is derived from the PMK, the ANonce, and the SNonce, and it is not transmitted in any message of the 4-Way Handshake. The GMK (Group Master Key) is a key that is generated by the AP and used to derive the GTK, and it is not transmitted in any message of the 4-Way Handshake. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 8: Security Analysis, page 211-213

• Question 22:

  Which one of the following is an advantage of using display filters that is not an advantage of capture-time filters?

  A. They allow for focused analysis on just the packets of interest
  B. Once created they are reusable for later captures
  C. They only hide the packets from view and the filtered packets can be enabled for view later
  D. Multiple of them can be applied simultaneously
  C. They only hide the packets from view and the filtered packets can be enabled for view later

  ---

  Explanation/Reference:

  Display filters are applied after the capture is completed and they only hide the packets from view. The filtered packets are still present in the capture file and can be enabled for view later by changing or removing the display filter.

  This is an advantage over capture-time filters, which discard the packets that do not match the filter criteria and cannot be recovered later34 References:

  CWAP-403 Study Guide, Chapter 2: Protocol Analysis, page 37 CWAP-403 Objectives, Section 2.3: Apply display filters

• Question 23:

  What is the function of the PHY layer?

  A. Convert PPDUs to PSDUs for transmissions and PSDUs to PPDUs for receptions
  B. Convert MSDUs to PPDUs for transmissions and PPDUs to MSDUs for receptions
  C. Convert PPDUs to MSDUs for transmissions and MSDUs to PPDUs for receptions
  D. Convert PSDUs to PPDUs for transmissions and PPDUs to PSDUs for receptions
  D. Convert PSDUs to PPDUs for transmissions and PPDUs to PSDUs for receptions

  ---

  Explanation/Reference:

  The function of the PHY layer is to convert PSDUs to PPDUs for transmissions and PPDUs to PSDUs for receptions. A PSDU (PHY Service Data Unit) is the data unit that is passed from the MAC layer to the PHY layer for transmission, or from the PHY layer to the MAC layer for reception. A PPDU (PHY Protocol Data Unit) is the data unit that is transmitted or received over the wireless medium by the PHY layer. A PPDU consists of a PSDU and a PHY header, which contains information such as modulation, coding, and data rate. The PHY layer adds or removes the PHY header to or from the PSDU during the conversion process. References: [Wireless Analysis Professional Study Guide CWAP404], Chapter 4: 802.11 Physical Layer, page 97-98

• Question 24:

  During a VHT Transmit Beamforming sounding exchange, the beamformee transmits a Compressed Beamforming frame to the beamformer. What is communicated within this Compressed Beamforming frame?

  A. Steering Matrix
  B. Beamforming Matrix
  C. Feedback Matrix
  D. Beamformee Matrix
  C. Feedback Matrix

  ---

  Explanation/Reference:

  The beamformee transmits a Feedback Matrix within the Compressed Beamforming frame to the beamformer. The Feedback Matrix contains information about the channel state between the beamformee and each spatial stream of the beamformer. This information is used by the beamformer to adjust its transmit weights and optimize its signal for the beamformee34. References: CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 11: 802.11n/ac/ax PHYsical Layer Frame Exchanges, page 4033; CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 11: 802.11n/ac/ax PHYsical Layer Frame Exchanges, page 4064.

• Question 25:

  Given a protocol analyzer can decrypt WPA2-PSK data packets providing the PSK and SSID are configured in the analyzer software. When performing packet capture (in a non- FT environment) which frames are required in order for PSK frame decryption to be possible?

  A. Authentication
  B. 4-Way Handshake
  C. Reassociation
  D. Probe Response
  B. 4-Way Handshake

  ---

  Explanation/Reference:

  The 4-way handshake is the process that establishes the pairwise transient key (PTK) between the client and the AP in WPA2-PSK. The PTK is derived from the PSK, the SSID, and some random numbers exchanged in the handshake frames. The PTK is used to encrypt and decrypt the data frames between the client and the AP. Therefore, in order to decrypt WPA2-PSK data packets, a protocol analyzer needs to capture the 4-way handshake frames and have the PSK and SSID configured in the analyzer software12 References: CWAP-404 Study Guide, Chapter 3: 802.11 MAC Layer Frame Formats and Technologies, page 87 CWAP-404 Objectives, Section 3.5: Analyze security exchanges

• Question 26:

  Where would you look in a packet trace file to identify the configured Minimum Basic Rate (MBR) of a BSS?

  A. Supported Rates and Extended Supported Rates elements in a Beacon frame
  B. In the MBR Action frame
  C. In the MBR Information Element in an Association Response frame
  D. In the Minimum Basic Rate Element in a Beacon frame
  A. Supported Rates and Extended Supported Rates elements in a Beacon frame

  ---

  Explanation/Reference:

  The configured Minimum Basic Rate (MBR) of a BSS can be identified by looking at the Supported Rates and Extended Supported Rates elements in a Beacon frame. A Beacon frame is a type of management frame that is transmitted by an AP to advertise its presence and capabilities to potential clients. A Beacon frame contains various information elements (IEs) that provide details about the BSS configuration and operation. The Supported Rates andExtended Supported Rates IEs list the data rates that are supported by the AP for data transmission. The MBR is the lowest data rate among these supported rates that is required for all clients to join and communicate with the BSS. The MBR is usually marked with a flag bit in these IEs to indicate its mandatory status. The other options are not correct, as they do not exist or do not indicate the MBR of a BSS. References: [Wireless Analysis Professional Study Guide CWAP404], Chapter 5:

  802.11 MAC Sublayer, page 123-124

• Question 27:

  ABC International has installed a new smart ZigBee controlled lighting system. However, the network team is concerned that this new system will interfere with the existing WLAN and has asked you to investigate the impact of the two systems operating simultaneously in the 2.4 GHz band. When performing Spectrum Analysis, which question could you answer by looking at the FFT plot?

  A. Do the ZigBee channels used by the lighting system overlap with the WLAN channels?
  B. Is the ZigBee system using more than 50% of the available airtime?
  C. Is the WLAN corrupting ZigBee system messages?
  D. Is the ZigBee system causing an increase in WLAN retries?
  A. Do the ZigBee channels used by the lighting system overlap with the WLAN channels?

  ---

  Explanation/Reference:

  The FFT plot is a spectrum analysis plot that shows the RF power present at a particular frequency over a short period of time. It can help identify the sources and characteristics of RF signals in the spectrum. By looking at the FFT plot, you can determine which ZigBee channels are used by the lighting system and whether they overlap with the WLAN channels in the 2.4 GHz band. ZigBee channels are 5 MHz wide and WLAN channels are 20 MHz or 40 MHz wide, so there is a possibility of overlap and interference between them. The other questions cannot be answered by looking at the FFT plot alone, as they require other types of plots or analysis tools, such as duty cycle plot, airtime utilization plot, or protocol analyzer. References: [Wireless Analysis Professional Study Guide], Chapter 3: Spectrum Analysis, page 69-70

• Question 28:

  What is the default 802.11 authentication method for a STA when using Pre-RSNA?

  A. Open System
  B. Shared Key
  C. 4-Way Handshake
  D. PSK
  A. Open System

  ---

  Explanation/Reference:

  The default 802.11 authentication method for a STA when using Pre-RSNA is Open System. This is the simplest and most common authentication method, which does not provide any security or encryption. In Open System authentication, the STA sends an Authentication Request frame to the AP, and the AP responds with an Authentication Response frame with a status code of success. After this, the STA can proceed to association with the AP . References: CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 181; CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter

  6: MAC Sublayer Frame Exchanges, page 183.

• Question 29:

  In what scenario is Open Authentication without encryption not allowed based on the 802.11 standard?

  A. When operating a BS5 in the CBRS band
  B. When operating a BSS in FIPS mode
  C. When operating a BSS in a government facility
  D. When operating a BSS in the 6 GHz band
  D. When operating a BSS in the 6 GHz band

  ---

  Explanation/Reference:

  Open Authentication without encryption is not allowed when operating a BSS in the 6 GHz band, according to the 802.11 standard. Open Authentication is a type of authentication method that does not require any credentials or security information from a STA (station) to join a BSS (Basic Service Set). Open Authentication can be used with or without encryption, depending on the configuration of the BSS and the STA. Encryption is a technique that scrambles the data frames using an algorithm and a key to prevent unauthorized access or eavesdropping. However, in the 6 GHz band, which is a newly available frequency band for WLANs, OpenAuthentication without encryption is prohibited by the

  802.11 standard, as it poses security and interference risks for other users and services in the band. The 6 GHz band requires all WLANs to use WPA3-Personal or WPA3-Enterprise encryption methods, which are more secure and robust than previous encryption methods such as WPA2 or WEP. The other options are not correct, as they do not describe scenarios where Open Authentication without encryption is not allowed by the 802.11 standard. When operating a BSS in the CBRS band, which is another newly available frequency band for WLANs, Open Authentication without encryption is allowed, but not recommended, as it also poses security and interference risks for other users and services in the band. When operating a BSS in FIPS mode, which is a mode that complies with the Federal Information Processing Standards for cryptographic security, Open Authentication without encryption is allowed, but not compliant, as it does not meet the FIPS requirements for encryption algorithms and keys. When operating a BSS in a government facility, Open Authentication without encryption is allowed, but not advisable, as it may violate the government policies or regulations for wireless security. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 8: Security Analysis, page 220-221

• Question 30:

  What interframe space would be expected between a CIS and a Data frame?

  A. PIFS
  B. AIFS
  C. DIFS
  D. SIFS
  D. SIFS

  ---

  Explanation/Reference:

  The interframe space that would be expected between a CTS (Clear to Send) and a Data frame is SIFS (Short Interframe Space). A SIFS is the shortest interframe space that is used for high-priority transmissions, such as ACKs (Acknowledgements), CTSs, or data frames that are part of a fragmentation or aggregation process. A SIFS is a fixed value that depends on the PHY type and channel width. A CTS and a Data frame are part of a virtual carrier sense mechanism called RTS/CTS (Request to Send/Clear to Send), which is used to avoid collisions and hidden node problems in wireless transmissions. When a STA (station) wants to send a data frame, it first sends an RTS frame to the intended receiver, indicating the duration of the transmission. The receiver then responds with a CTS frame, also indicating the duration of the transmission. The other STAs in the vicinity hear either the RTS or the CTS frame and update their NAV (Network Allocation Vector) timers accordingly, deferring their access to the medium until the transmission is over. The sender then sends the data frame after waiting for a SIFS, followed by an ACK frame from the receiver after another SIFS. The other options are not correct, as they are not used between a CTS and a Data frame. A PIFS (PCF Interframe Space) is used for medium access by the PCF (Point Coordination Function), which is an optional and rarely implemented polling-based mechanism that provides contention-free service for time-sensitive traffic. An AIFS (Arbitration Interframe Space) is used for medium access by different ACs (Access Categories), which are logical queues that correspond to different QoS (Quality of Service) levels for different types of traffic. An AIFS is a variable interframe space that depends on the AIFSN (Arbitration Interframe Space Number) value of each AC. A DIFS (Distributed Interframe Space) is used for medium access by the DCF (Distributed Coordination Function), which is the default and mandatory contention-based mechanism that provides best-effort service for normal traffic. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 6: 802.11 Frame Exchanges, page 166-167; Chapter 7: QoS Analysis, page 194-195