CWNP CWAP-404 Online Practice Questions and Exam Preparation

CWNP CWAP-404 Online Questions & Answers

• Question 51:

  Why would a STA that supports 802.11k Radio Measurement send a Neighbor Request to an AP?

  A. To learn about neighboring interference sources and tune its RF radio accordingly
  B. To inform the current AP about the STA's intent to roam to a neighboring AP, ensuring a seamless handover
  C. To request a list of neighboring APs which the STA can use as roaming candidates
  D. To request a list of neighboring STAs which enables the STA to better pick the right protection mechanisms
  C. To request a list of neighboring APs which the STA can use as roaming candidates

  ---

  Explanation/Reference:

  A STA that supports 802.11k Radio Measurement would send a Neighbor Request to an AP to request a list of neighboring APs which the STA can use as roaming candidates. A Neighbor Request is an Action frame that contains a subelement specifying the type of information that the STA wants to receive from the AP. A Neighbor Report is an Action frame that contains a subelement with a list of neighboring APs that match the criteria specified in the Neighbor Request. The Neighbor Report provides information such as BSSID, channel, operating class, and PHY type of each neighboring AP. This information helps the STA to perform intelligent roaming decisions based on signal quality, load, and compatibility . References: CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 12: 802.11k/v/r/u/w/ai Amendments, page 434; CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter

  12: 802.11k/v/r/u/w/ai Amendments, page 435.

• Question 52:

  After examining a Beacon frame decode you see the SSID Element has a length of 0. What do you conclude about this frame?

  A. The frame is corrupted
  B. SSID elements always have a length of 0
  C. This is a common attack on WISP backend SQL databases
  D. The beacon is from a BSS configured to hide the SSID
  D. The beacon is from a BSS configured to hide the SSID

  ---

  Explanation/Reference:

  If the SSID element has a length of 0 in a Beacon frame decode, it means that the beacon is from a BSS configured to hide the SSID. The SSID element is a part of the Beacon frame that contains the name or identifier of the BSS. The SSID element has two fields: length and value. The length field indicates how many bytes are used for the value field, which contains the actual SSID string. If the length field is 0, it means that there is no value field or SSID string in the element. This is a common technique used by some APs to hide their SSID from passive scanning clients or potential attackers. However, this technique does not provide much security, as there are other ways to discover or reveal the hidden SSID, such as active scanning or capturing probe response or association frames. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 5:

  802.11 MAC Sublayer, page 122-123

• Question 53:

  What is an AIFS?

  A. A medium access method introduced by 802.lln, but never implemented
  B. A variable Interframe Space introduced by 802.lie to help prioritize medium access for different Access Categories
  C. A form of aggregation performed at the PHY layer based on 802.lie UP values interpreted from DSCP values
  D. The shortest period of time a STA can sleep
  B. A variable Interframe Space introduced by 802.lie to help prioritize medium access for different Access Categories

  ---

  Explanation/Reference:

  An AIFS is a variable interframe space introduced by 802.11e to help prioritize medium access for different Access Categories (ACs). An interframe space is a period of time that a STA (station) has to wait before attempting to access the medium. An AIFS is a type of interframe space that varies depending on the AC of the traffic. An AC is a logical queue that corresponds to a QoS (Quality of Service) level for different types of traffic. There are four ACs defined by 802.11e: AC_VO (Voice), AC_VI (Video), AC_BE (Best Effort), and AC_BK (Background). Each AC has a different AIFSN (Arbitration Interframe Space Number) value, which determines how long it has to wait before attempting to access the medium. A lower AIFSN value means a higher priority and a shorter waiting time. The other options are not correct, as they do not describe what an AIFS is. An AIFS is not a medium access method introduced by 802.11n, but never implemented, as it is part of the 802.11e standard and widely used in QoS-enabled WLANs. An AIFS is not a form of aggregation performed at the PHY layer based on 802.11e UP values interpreted from DSCP values, as aggregation is a technique that combines multiple frames into one larger frame to improve efficiency and throughput, not prioritization or medium access. An AIFS is not the shortest period of time a STA can sleep, as sleeping is a power saving mode that allows a STA to conserve battery power by periodically turning off its radio, not accessing the medium. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 7: QoS Analysis, page 194-195

• Question 54:

  Using a portable analyzer you perform a packet capture next to a client STA and you can see that the STA is associated to a BSS. You observe the STA sending packets to the AP and the AP sending packets to the STA. Less than 2% of all packets are retransmissions. You move to capture packets by the AP and, while the retry rate is still less than 2%, you now only see unidirectional traffic from the AP to the client. How do you explain this behavior?

  A. The portable analyzer is too close to the AP causing CCI, blinding the AP to the clients packets
  B. The STA is transmitting data using more spatial streams than the potable analyzer can support
  C. There is a transmit power mismatch between the client and the AP and while the client can hear the APs traffic, the AP cannot hear the client
  D. The portable analyzer has a lower receive sensitivity than the AP and while it can't capture the packets from the client STA, the AP can receive them OK
  D. The portable analyzer has a lower receive sensitivity than the AP and while it can't capture the packets from the client STA, the AP can receive them OK

  ---

  Explanation/Reference:

  Receive sensitivity is the minimum signal level that a receiver can detect and decode. Different devices may have different receive sensitivity levels depending on their hardware specifications and antenna configurations. In this scenario, the portable analyzer has a lower receive sensitivity than the AP, meaning that it requires a stronger signal to capture the packets from the client STA. The AP, on the other hand, has a higher receive sensitivity and can receive the packets from the client STA even if they have a weaker signal. This explains why the portable analyzer can only see unidirectional traffic from the AP to the client when capturing near the AP5 References: CWAP-403 Study Guide, Chapter 4: PHY Layer Analysis, page 121 CWAP-403 Objectives, Section 4.3: Analyze PHY layer metrics

• Question 55:

  What should the To DS and From DS flags be to set to in an Association Response frame?

  A. To DS = 1, From DS = 1
  B. To DS - 1, From DS = 0
  C. To DS - 0, From DS = 0
  D. To DS = 0, From DS = 1
  C. To DS - 0, From DS = 0

  ---

  Explanation/Reference:

  The To DS and From DS flags should be set to 0 in an Association Response frame. An Association Response frame is a type of management frame that is transmitted by an AP to accept or reject an association request from a STA. The To DS (To Distribution System) and From DS (From Distribution System) flags are two bits in the Frame Control field of the MAC header that indicate whether a frame is destined for or originated from the DS (Distribution System), which is a system that connects multiple BSSs together. The To DS and From DS flags can have four possible combinations: 00, 01, 10, or 11. For an Association Response frame, which is sent from an AP to a STA within a BSS, both flags should be set to 0. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 5: 802.11 MAC Sublayer, page 121-122

• Question 56:

  An RTS frame should be acknowledged by which frame?

  A. CTS
  B. Ack
  C. RTS-Ack
  D. Block Ack
  A. CTS

  ---

  Explanation/Reference:

  An RTS (Request to Send) frame should be acknowledged by a CTS (Clear to Send) frame. An RTS and CTS frame are types of control frames that are used to implement a virtual carrier sense mechanism called RTS/CTS. RTS/CTS is a technique that helps to avoid collisions and hidden node problems in wireless transmissions. When a STA (station) wants to send a data frame, it first sends an RTS frame to the intended receiver, indicating the duration of the transmission. The receiver then responds with a CTS frame, also indicating the duration of the transmission. The other STAs in the vicinity hear either the RTS or the CTS frame and update their NAV (Network Allocation Vector) timers accordingly, deferring their access to the medium until the transmission is over. The sender then sends the data frame, followed by an ACK (Acknowledgement) frame from the receiver. The other options are not correct, as they are not used to acknowledge an RTS frame. An ACK frame is used to acknowledge a data frame, not an RTS frame. An RTS- Ack frame does not exist, as there is no such type of control frame in 802.11. A Block Ack (BA) frame is used to acknowledge multiple data frames in a single frame, not an RTS frame. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 6:

  802.11 Frame Exchanges, page 166-167

• Question 57:

  The PHY layer provides framing by adding a header to create what type of data unit?

  A. MPDU
  B. PSDU
  C. MSDU
  D. PPDU
  D. PPDU

  ---

  Explanation/Reference:

  The PHY layer provides framing by adding a header to create a PPDU. A PPDU (PHY Protocol Data Unit) is the data unit that is transmitted or received over the wireless medium by the PHY layer. A PPDU consists of a PSDU (PHY Service Data Unit) and a PHY header, which contains information such as modulation, coding, and data rate. The PHY layer adds the PHY header to the PSDU to create a PPDU for transmission, or removes the PHY header from the PPDU to extract the PSDU for reception. The other options are not correct, as they are not created by adding a header at the PHY layer. An MPDU (MAC Protocol Data Unit) is created by adding a MAC header and FCS to an MSDU (MAC Service Data Unit) at the MAC layer. An MSDU is the data unit that is passed from the LLC sublayer to the MAC sublayer or vice versa. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 4: 802.11 Physical Layer, page 97-98

• Question 58:

  In which element of a Beacon frame would you look to identity the current HT protection mode in which an AP is operating?

  A. HT Protection Element
  B. HT Operations Element
  C. ERP Information Element
  D. HT Capabilities Element
  B. HT Operations Element

  ---

  Explanation/Reference:

  The HT protection mode in which an AP is operating can be identified by looking at the HT Operations element in a Beacon frame. The HT Operations element is a part of the Beacon frame that contains information about the High Throughput (HT) capabilities and operation of an 802.11n BSS. The HT Operations element has a field called HT Protection, which indicates how the BSS protects its HT transmissions from interference or collisions with non-HT devices or BSSs. The HT Protection field can have four values: No Protection, Nonmember Protection, 20 MHz Protection, or Non-HT Mixed Mode. The other options are not correct, as they do not contain information about the HT protection mode. The HT Protection element does not exist, the ERP Information element is used for Extended Rate PHY (ERP) protection mode for 802.11g devices, and the HT Capabilities element is used for indicating the supported HT features of an individual device. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 5:

  802.11 MAC Sublayer, page 125-126

• Question 59:

  What is the function of 802.11 Management frames?

  A. Prioritize network administration traffic
  B. Communicate configuration changes between WLAN controller and APs
  C. Manage the BSS
  D. Manage the flow of data
  C. Manage the BSS

  ---

  Explanation/Reference:

  The function of 802.11 management frames is to manage the BSS. A BSS (Basic Service Set) is a group of STAs (stations) that share a common SSID (Service Set Identifier) and communicate with each other through an AP (access point) or directly in an ad hoc mode. Management frames are one of the three types of 802.11 frames, along with control and data frames. Management frames are used to establish, maintain, and terminate associations between STAs and APs, as well as to advertise and discover BSSs, exchange security information, report errors, and perform other management functions. The other options are not correct, as they are not functions of 802.11 management frames. Prioritizing network administration traffic, communicating configuration changes between WLAN controller and APs, and managing the flow of data are functions of other types of frames or protocols. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 5: 802.11 MAC Sublayer, page 120-121

• Question 60:

  Finish the statement:

  It is possible to distinguish between_______22 MHz transmissions and________20 MHz transmissions when looking at an FFT plot.

  A. HR/DSSS and ERP
  B. OFDM and HT
  C. ERP and VHT
  D. HT and VHT
  B. OFDM and HT

  ---

  Explanation/Reference:

  It is possible to distinguish between OFDM 20 MHz transmissions and HT 20 MHz transmissions when looking at an FFT plot. OFDM and HT are two different modulation schemes used by 802.11 WLANs. OFDM is used by legacy 802.11a/g devices, while HT is used by newer 802.11n/ac devices. OFDM and HT have different spectral characteristics that can be observed on an FFT plot. OFDM transmissions have a flat spectrum with sharp edges, while HT transmissions have a tapered spectrum with rounded edges. This is because HT uses guard intervals and cyclic prefixes to reduce inter-symbol interference and improve performance. The other options are not correct, as they do not describe different modulation schemes or channel widths that can be distinguished on an FFT plot. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 3: Spectrum Analysis, page 70-71