CWNP CWNA-109 Online Practice Questions and Exam Preparation

CWNP CWNA-109 Online Questions & Answers

• Question 91:

  Lynne runs a small hotel, and as a value added service for his customers he has implemented a Wi-Fi hot-spot. Lynne has read news articles about how hackers wait at hot- spots trying to take advantage of unsuspecting users. He wants to avoid this problem at his hotel.

  What is an efficient and practical step that Lynne can take to decrease the likelihood of active attacks on his customers' wireless computers?

  A. Enable station-to-station traffic blocking by the access points in the hotel.
  B. Implement Network Access Control (NAC) and require antivirus and firewall software along with OS patches.
  C. Implement an SSL VPN in the WLAN controller that initiates after HTTPS login.
  D. Require EAP-FAST authentication and provide customers with a username/password on their receipt.
  A. Enable station-to-station traffic blocking by the access points in the hotel.

  ---

  Explanation/Reference:

  In a public Wi-Fi hotspot, like the one Lynne runs in his hotel, ensuring customer security against active attacks is crucial. Active attacks involve unauthorized access, eavesdropping, or manipulation of the network traffic. To mitigate such

  threats, an effective and practical step is:

  Station-to-Station Traffic Blocking: Also known as client isolation, this feature prevents direct communication between devices connected to the Wi-Fi network. By enabling this on the access points, Lynne can significantly decrease the

  likelihood of active attacks like man-in-the-middle (MITM) attacks, where an attacker intercepts and possibly alters the communication between two parties. The other options, while beneficial for network security, might not be as

  straightforward or practical for Lynne's situation:

  Network Access Control (NAC)requires a more complex infrastructure and management, which might not be ideal for a small hotel setup. Implementing an SSL VPNadds an extra layer of security but might complicate the login process for

  users, potentially affecting the user experience. Requiring EAP-FAST authenticationprovides secure authentication but may not be feasible for transient customers who expect quick and easy network access. Therefore, enabling station-tostation traffic blocking is a practical and efficient measure that Lynne can implement to enhance customer security on the Wi-Fi network.

  References:

  CWNA Certified Wireless Network Administrator Official Study Guide:

  ExamCWNA-109, by David D. Coleman and David A. Westcott. Best practices for securing a wireless network in a public hotspot environment.

• Question 92:

  In a mesh BSS (MBSS), according to the 802.11 standard, what device connect the mesh to an Ethernet network?

  A. Mesh Gate
  B. Mesh Switch
  C. Mesh Router
  D. Mesh Portal
  D. Mesh Portal

  ---

  Explanation/Reference:

  a mesh portal is a device that connects a mesh BSS (MBSS) to an Ethernet network, such as the Internet. A mesh portal acts as a bridge between the wired and wireless domains, and allows the mesh stations to communicate with external networks. A mesh portal is also a mesh point, which means it can forward traffic within the MBSS. The other options are not correct. Option A. Mesh Gate is a device that connects a mesh BSS (MBSS) to another mesh BSS or another wireless network, such as an infrastructure BSS or an ad hoc network2. A mesh gate acts as a gateway between different wireless domains, and allows the mesh stations to communicate with other wireless networks. A mesh gate is also a mesh point, which means it can forward traffic within the MBSS. Option B. Mesh Switch is not a valid term in the 802.11 standard. Option C. Mesh Router is also not a valid term in the 802.11 standard.

• Question 93:

  What is an advantage of using WPA3-Personal instead of WPA2-Personal as a security solution for 802.11 networks?

  A. WPA3-Personal, also called WPA3-SAE, uses an authentication exchange and WPA2- Personal does not
  B. WPA3-Personal, also called WPA3-SAE, uses a stronger authentication exchange to better secure the network
  C. WPA3-Personal, also called WPA3-SAE, uses AES for encryption and WPA2-Personal does not
  D. WPA3-Personal, also called WPA3-SAE, uses a better encryption algorithm than WPA2- Personal
  B. WPA3-Personal, also called WPA3-SAE, uses a stronger authentication exchange to better secure the network

  ---

  Explanation/Reference:

  An advantage of using WPA3-Personal instead of WPA2-Personal as a security solution for 802.11 networks is that WPA3-Personal, also called WPA3-SAE, uses a stronger authentication exchange to better secure the network. WPA3Personal uses Simultaneous Authentication of Equals (SAE) as the key exchange protocol, which provides stronger protection against offline dictionary attacks and password guessing than WPA2-Personal. SAE uses a Diffie-Hellman key exchange with elliptic curve cryptography (ECC) to establish a pairwise master key (PMK) between the AP and the client without revealing it to any eavesdropper. SAE also provides forward secrecy, which means that if one PMK is compromised, it does not affect the security of other PMKs. WPA2-Personal uses Pre- Shared Key (PSK) as the key exchangeprotocol, which is vulnerable to offline brute-force attacks if the passphrase is weak or leaked. Both WPA3Personal and WPA2-Personal use AES for encryption, so there is no difference in that aspect. WPA3-Personal does not use a different encryption algorithm than WPA2-Personal, but rather a different key exchange protocol. References: [CWNP Certified Wireless Network Administrator Official Study Guide: ExamCWNA-109], page 307; [CWNA: Certified Wireless Network Administrator Official Study Guide: ExamCWNA-109], page 297.

• Question 94:

  You are performing a post-implementation validation survey. What basic tool can be used to easily locate areas of high co-channel interference?

  A. Throughput tester
  B. Laptop-based spectrum analyzer
  C. Access point spectrum analyzer
  D. Wi-Fi scanner
  D. Wi-Fi scanner

  ---

  Explanation/Reference:

  A Wi-Fi scanner is a basic tool that can be used to easily locate areas of high co-channel interference. A Wi-Fi scanner is a software application that can run on a laptop, tablet, smartphone, or other device that has a Wi-Fi adapter. A Wi-Fi scanner can scan the wireless environment and display information about the detected access points and client stations, such as their SSID, BSSID, channel, signal strength, security, and data rate. A Wi-Fi scanner can also show the channel utilization and overlap of different access points, which can indicate the level of co-channel interference. Co-channel interference is a type of interference that occurs when multiple access points use the same or adjacent channels within the same coverage area. Co-channel interference can reduce the throughput and performance of the WLAN, as the access points and client stations have to contend for the channel access and avoid collisions. To identify areas of high co-channel interference, a Wi-Fi scanner can be used to measure the signal strength and channel utilization of different access points and compare them with a threshold or a baseline. Alternatively, a Wi-Fi scanner can also use a color-coded heat map to visualize the co-channel interference level in different locations. References: 1, Chapter 7, page 279; 2, Section 4.3

• Question 95:

  A dual-band 802.11ac AP must be powered by PoE. As a class 4 device, what power level should be received at the AP?

  A. 30 W
  B. 12.95 W
  C. 25.5 W D. 15.4 W
  C. 25.5 W D. 15.4 W

  ---

  Explanation/Reference:

  PoE has different standards that define different power levels for PSEs and PDs. The original standard, IEEE 802.3af, defines two classes of PSEs: Class 3 (15.4 W) and Class 4 (30 W). The newer standard, IEEE 802.3at, also known as PoE +, defines four classes of PSEs: Class 0 (15.4 W), Class 1 (4 W), Class 2 (7 W), and Class 3 (12.95 W). The power level received at the PD is always lower than the power level provided by the PSE, due to cable resistance and power dissipation. The IEEE standards specify the minimum power level that must be received at the PD for each class of PSE. For a Class 4 PSE, the minimum power level received at the PD is 25.5 W910. References: CWNA-109 Study Guide, Chapter 7: Power over Ethernet (PoE), page 295; CWNA-109Study Guide, Chapter

  7: Power over Ethernet (PoE), page 289.

• Question 96:

  What is the final step in an effective troubleshooting process?

  A. Disable the WLAN
  B. Verify the solution
  C. Notify the users of problem resolution
  D. Document the results
  D. Document the results

  ---

  Explanation/Reference:

  The final step in an effective troubleshooting process is to document the results. Documentation is essential for keeping track of the problem history, the actions taken, the solutions implemented, and the outcomes achieved. Documentation can also help to prevent future problems, improve best practices, and provide feedback for improvement. Documentation should include relevant information such as problem description, symptoms, root cause analysis, resolution steps, verification methods, and lessons learned. References: [CWNP Certified Wireless Network Administrator Official Study Guide: ExamCWNA-109], page 513; [CWNA: Certified Wireless Network Administrator Official Study Guide: ExamCWNA109], page 483.

• Question 97:

  What is required when operating 802.11ax APS in the 6 GHz band using passphrase- based authentication?

  A. VHT PHY
  B. HT PHY
  C. SAE
  D. CCMP
  C. SAE

  ---

  Explanation/Reference:

  SAE (Simultaneous Authentication of Equals) is required when operating 802.11ax APs in the 6 GHz band using passphrase-based authentication. SAE is a secure and robust authentication method that is defined in the IEEE 802.11s amendment and is also known as WPA3-Personal or WPA3-SAE. SAE is based on a cryptographic technique called Dragonfly Key Exchange, which allows two parties to establish a shared secret key using a passphrase, without revealing the passphrase or the key to an eavesdropper or an attacker. SAE also provides forward secrecy, which means that if the passphrase or the key is compromised in the future, it does not affect the security of past communications. SAE is required when operating 802.11ax APs in the 6 GHz band using passphrase-based authentication because of the new regulations and standards that apply to this band. The 6 GHz band is a new frequency band that was opened for unlicensed use by the FCC and other regulatory bodies in 2020. The 6 GHz band offers more spectrum and less interference than the existing 2.4 GHz and 5 GHz bands, which can enable higher performance and efficiency for Wi-Fi devices. However, the 6 GHz band also has some restrictions and requirements that are different from the other bands, such as: The 6 GHz band is divided into two sub-bands: U-NII-5 (5925-6425 MHz) and U- NII-7 (6525-6875 MHz). The U-NII-5 sub-band is subject to DFS (Dynamic Frequency Selection) rules, which require Wi-Fi devices to monitor and avoid using channels that are occupied by radar systems or other primary users. The U- NII-7 sub-band is not subject to DFS rules, but it has a lower maximum transmit power limit than the U-NII-5 sub-band. The Wi-Fi devices that operate in the 6 GHz band are called 6E devices, which stands for Extended Spectrum. 6E devices must support 802.11ax technology, which is also known as Wi-Fi 6 or High Efficiency (HE). 802.11ax is a new standard that improves the performance and efficiency of Wi-Fi networks by using features such as OFDMA (Orthogonal Frequency Division Multiple Access), MU- MIMO (Multi-User Multiple Input Multiple Output), BSS Coloring, TWT (Target Wake Time), and HE PHY and MAC enhancements. The 6E devices that operate in the 6 GHz band must also support WPA3 security, which is a new security protocol that replaces WPA2 and provides stronger encryption and authentication for Wi-Fi networks. WPA3 has two modes: WPA3Personal and WPA3-Enterprise. WPA3-Personal uses SAE as its authentication method, which requires a passphrase to establish a secure connection between two devices. WPA3-Enterprise uses EAP (Extensible Authentication Protocol) as its authentication method, which requires a certificate or a credential to authenticate with a server. Therefore, SAE is required when operating 802.11ax APs in the 6 GHz band using passphrase-based authentication because it is part of WPA3-Personal security, which is mandatory for 6E devices in this band. References: , Chapter 3, page 120; , Section 3.2 9of30

• Question 98:

  When considering data rates available in HT and VHT PHY devices, in addition to the modulation, coding, channel width, and spatial streams, what impacts the data rate according to the MCS tables?

  A. Frequency band in use
  B. client drivers
  C. guard interval
  D. Antenna Height
  C. guard interval

  ---

  Explanation/Reference:

  The guard interval is a short period of time inserted between the symbols of an OFDM signal to prevent inter-symbol interference and improve the robustness of the transmission1. The guard interval can have different values depending on

  the 802.11 standard and the configuration of the device. For example, 802.11n supports two guard intervals: 800 ns (normal) and 400 ns (short)2. 802.11ac supports the same guard intervals as 802.11n, plus an optional 200 ns guard interval

  for 80 MHz and 160 MHz channels3. 802.11ax supports three guard intervals: 800 ns, 1600 ns, and 3200 ns4. The guard interval affects the data rate because it determines the duration of each symbol. A shorter guard interval means more

  symbols can be transmitted in a given time, resulting in a higher data rate. However, a shorter guard interval also means less protection against inter-symbol interference, which may degrade the signal quality and increase the error rate.

  Therefore, there is a trade-off between data rate and reliability when choosing the guard interval.

  The MCS tables for HT and VHT PHY devices show the data rates for different combinations of modulation, coding, channel width, spatial streams, and guard intervals. For example, for a VHT device using MCS 9 with QAM-256 modulation,

  5/6 coding rate, 80 MHz channel width, and one spatial stream, the data rate is 433.3 Mbps with a normal guard interval (800 ns) and 486.7 Mbps with a short guard interval (400 ns)2. Therefore, the guard interval impacts the data rate

  according to the MCS tables.

• Question 99:

  During a post-implementation survey, you have detected a non-802.11 wireless device transmitting in the area used by handheld 802.11g scanners. What is the most important factor in determining the impact of this non-802.11 device?

  A. Receive sensitivity
  B. Channel occupied
  C. Airtime utilization
  D. Protocols utilized
  C. Airtime utilization

  ---

  Explanation/Reference:

  Airtime Utilization is a per-channel statistic that defines what percentage of the channel is currently being used, and what percentage is therefore free. Airtime usage can come from:

  Data traffic to and from client devices. Interference from WiFi and non-WiFi sources.

  Management overhead from APs and client

  devices.https://wyebot.com/2019/06/06/understanding-airtime-utilization/

• Question 100:

  An IEEE 802.11 amendment is in the daft state. What impact does this draft amendment have on the 802.11 standard?

  A. Devices will be released based on the draft amendment and the draft amendment features are part of the standard.
  B. No impact: Until an amendment is ratified, it does not become part of the standard.
  C. No impact: Draft amendments do not become part of the standard until a working group is formed.
  D. The standard is changed to reflect the new capabilities as soon as an amendment enters the draft stage.
  B. No impact: Until an amendment is ratified, it does not become part of the standard.

  ---

  Explanation/Reference:

  An IEEE 802.11 amendment is a proposed change or addition to the existing 802.11 standard, which defines the specifications and protocols for wireless LANs. An amendment goes through several stages of development, such as draft, sponsor ballot, and final approval, before it is ratified by the IEEE Standards Association and becomes part of the standard. Until then, it has no official impact on the standard, although some vendors may release products based on draft amendments to gain a competitive edge or to influence the final outcome of the amendment . References: [CWNA-109 Study Guide], Chapter 1: Overview of Wireless Standards, Organizations, and Fundamentals, page 25; [CWNA-109Study Guide], Chapter 1: Overview of Wireless Standards, Organizations, and Fundamentals, page 23; [IEEE website], IEEE-SA Standards Development Process.