CWNP CWAP-404 Online Practice Questions and Exam Preparation

CWNP CWAP-404 Online Questions & Answers

• Question 31:

  How many frames make up the Group Key Handshake excluding any Ack frames that may be required?

  A. 1
  B. 2
  C. 3
  D. 4
  B. 2

  ---

  Explanation/Reference:

  The Group Key Handshake consists of two frames excluding any Ack frames that may be required. The Group Key Handshake is used to distribute and update the Group Temporal Key (GTK) for encrypting broadcast and multicast traffic. The AP initiates the Group Key Handshake by sending a Group Key Message 1 frame to a STA, which contains the new GTK and other information. The STA responds with a Group Key Message 2 frame to the AP, which confirms the receipt of the GTK and other information. After this, both the AP and the STA can use the new GTK for encryption and decryption of broadcast and multicast traffic . References: CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 7: 802.11 Security, page 246; CWAP- 404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 7:

  802.11 Security, page 247.

• Question 32:

  A PHY Header is added to the PSDU at which layer?

  A. LLC
  B. Network
  C. PHY
  D. MAC
  C. PHY

  ---

  Explanation/Reference:

  A PHY header is added to the PSDU at the PHY layer. A PHY header is a part of the PPDU that contains information such as modulation, coding, and data rate. The PHY header is added by the PHY layer when it converts a PSDU to a PPDU for transmission, or removed by the PHY layer when it converts a PPDU to a PSDU for reception. The other layers do not add or remove a PHY header. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 4: 802.11 Physical Layer, page 97-98

• Question 33:

  You are performing a multiple adapter channel aggregation capture to troubleshoot a VoIP roaming problem and would like to measure the roaming time from the last VoIP packet sent on the old AP's channel to the first VoIP packet sent on the new AP's channel. Which timing column in the packet view would measure this for you?

  A. Roaming
  B. Relative
  C. Absolute
  D. Delta
  D. Delta

  ---

  Explanation/Reference:

  Delta is the timing column in the packet view that measures the time difference between two consecutive packets in a capture file. Delta can be used to measure the roaming time from the last VoIP packet sent on the old AP's channel to the first VoIP packet sent on the new AP's channel by selecting these two packets and looking at their delta values. The other timing columns are not suitable for this measurement because they do not show the time difference between two specific packets. Roaming is a column that shows whether a packet belongs to a roaming event or not. Relative is a column that shows the time elapsed since the beginning of the capture file. Absolute is a column that shows the date and time when a packet was captured5 References: CWAP-404 Study Guide, Chapter 2: Protocol Analysis, page 57 CWAP-404 Objectives, Section 2.4: Analyze timing values

• Question 34:

  Which one of the following statements is not true concerning DTIMs?

  A. Buffered Broadcast and Multicast traffic will be transmitted following a DTIM
  B. The DTIM interval can dictate when an STA will wake up to listen to beacon frames
  C. DTIM stands for Delivery Traffic Indication Map
  D. Every Beacon frame must contain a DTIM
  D. Every Beacon frame must contain a DTIM

  ---

  Explanation/Reference:

  Every Beacon frame must contain a DTIM is not a true statement concerning DTIMs. DTIM stands for Delivery Traffic Indication Message, and it is a subfield within the TIM (Traffic Indication Map) element in a Beacon frame. The DTIM indicates how many Beacon frames (including the current one) will appear before the next DTIM. For example, if the DTIM interval is set to 3, it means that every third Beacon frame will contain a DTIM. Buffered broadcast and multicast traffic will be transmitted following a DTIM, so that STAs in power save mode can wake up and receive them. The DTIM interval can also dictate when an STA will wake up to listen to Beacon frames, as some STAs may choose to only listen to Beacon frames that contain a DTIM . References: CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 200; CWAP-404 CertifiedWireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 201.

• Question 35:

  How is the length of an AIFS calculated?

  A. DIFS + SIFS + AIFSN
  B. SIFS + AIFS * Time Unit
  C. SIFS * Slot Time + AIFSN
  D. AIFSN * Slot Time + SIFS
  D. AIFSN * Slot Time + SIFS

  ---

  Explanation/Reference:

  The length of an AIFS (Arbitration Interframe Space) is calculated by multiplying the AIFSN (Arbitration Interframe Space Number) by the Slot Time and adding the SIFS (Short Interframe Space). An AIFS is a variable interframe space introduced by 802.11e to help prioritize medium access for different Access Categories (ACs). An AC is a logical queue that corresponds to a QoS (Quality of Service) level for different types of traffic. Each AC has a different AIFSN value, which determines how long it has to wait before attempting to access the medium. A lower AIFSN value means a higher priority and a shorter waiting time. The Slot Time is a fixed value that depends on the PHY type and channel width. The SIFS is the shortest interframe space that is used for high-priority transmissions, such as ACKs or CTSs. The formula for calculating the AIFS length is: AIFS = AIFSN * Slot Time + SIFS. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 7: QoS Analysis, page 194-195

• Question 36:

  Which piece of information is not transmitted in an HT PPDU header?

  A. Number of Spatial Streams
  B. PPDU length
  C. MCS index
  D. Channel number
  D. Channel number

  ---

  Explanation/Reference:

  The channel number is not transmitted in an HT PPDU header. An HT PPDU header is a part of the PPDU that contains information such as modulation, coding, data rate, and number of spatial streams for an 802.11n transmission. The channel number is not included in the HT PPDU header, as it is determined by the frequency band and channel width that are used by the transmitter and receiver. The channel number can be inferred from the frequency band and channel width, which are indicated by bits in different fields of the HT PPDU header, such as HT-SIG and HT-LTF. The other options are not correct, as they are transmitted in an HT PPDU header. The number of spatial streams, PPDU length, and MCS index are indicated by bits in the HT-SIG field of the HT PPDU header. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 4:

  802.11 Physical Layer, page 108-109

• Question 37:

  You're the WLAN administrator for a large retailer based at the HQ in New York. The London-based office has been complaining about WLAN disconnections around lunch time each day. You suspect this might be interference from the staff microwave, how might you test your theory from the New York office?

  A. Ask a local member of staff to change the frequency of the microwave and see if the disconnections stop
  B. Ask a local member of staff to take some pictures of the microwave, including some close-ups of the door seal so that you can assess it
  C. Access the microwave remotely and run a diagnostic check
  D. Place one of the London APs into spectrum analyzer mode and monitor the situation over lunch time
  D. Place one of the London APs into spectrum analyzer mode and monitor the situation over lunch time

  ---

  Explanation/Reference:

  The best way to test the theory of microwave interference from the New York office is to use a remote spectrum analyzer. By placing one of the London APs into spectrum analyzer mode, you can capture and analyze the RF spectrum in the London office over lunch time. You can then look for any signs of microwave interference, such as high duty cycle, high amplitude, or frequency hopping on the 2.4 GHz band. This method does not require any physical access tothe microwave or any changes to its frequency. References: [Wireless Analysis Professional Study Guide], Chapter 3: Spectrum Analysis, page 64

• Question 38:

  Which one of the following is not a valid acknowledgement frame?

  A. RTS
  B. CTS
  C. Ack
  D. Block Ack
  A. RTS

  ---

  Explanation/Reference:

  RTS is not a valid acknowledgement frame. RTS stands for Request To Send, and it is a control frame that is used to initiate an RTS/CTS exchange before sending a data frame. The purpose of an RTS/CTS exchange is to reserve the medium for a data transmission and avoid collisions with hidden nodes. An acknowledgement frame is a control frame that is used to confirm the successful reception of a data frame or a block of data frames. The valid acknowledgement frames are CTS (Clear To Send), Ack (Acknowledgement), and Block Ack (Block Acknowledgement) . References: CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 186; CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 187; CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 189; CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 190.

• Question 39:

  What does the value of the Listen Interval field in an Association Request frame indicate?

  A. How long a STA performing active scanning will listen for Probe Responses before changing channels
  B. How often a STA will go off channel to look for other BSSs
  C. How often a STA in power save mode wakes up to listen to Beacon frames
  D. How long a STA waits for an Ack before retransmitting the frame
  C. How often a STA in power save mode wakes up to listen to Beacon frames

  ---

  Explanation/Reference:

  The value of the Listen Interval field in an Association Request frame indicates how often a STA in power save mode wakes up to listen to Beacon frames. The Listen Interval is expressed in units of Beacon Intervals (typically 100 TU or 102.4 ms). For example, if the Listen Interval is set to 10, it means that the STA will wake up every 10 Beacon Intervals (or about 1 second) to check for buffered frames at the AP. The Listen Interval is used by the AP to determine how long it can hold frames for a STA in power save mode before discarding them . References: CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 197; CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 198.

• Question 40:

  802.11k Neighbor Requests and Neighbor Reports are sent in what type of Management Frames?

  A. RRM
  B. Action
  C. Beacon
  D. Reassociation Request and Reassociation Response
  B. Action

  ---

  Explanation/Reference:

  802.11k Neighbor Requests and Neighbor Reports are sent in Action frames. An Action frame is a Management frame that is used to perform various operations or functions related to the operation or maintenance of a wireless network. An Action frame consists of a Category field that indicates the type of action being performed, and a variable-length Action Details field that contains specific information related to the action. For example, an Action frame with a Category field value of 5 indicates a Radio Measurement action, and the Action Details field may contain a Neighbor Request or a Neighbor Report subelement . References: CWAP-404 CertifiedWireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 207; CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 208; CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 12: 802.11k/v/r/u/w/ai Amendments, page 434.