CWNP CWSP-208 Online Practice Questions and Exam Preparation

CWNP CWSP-208 Online Questions & Answers

• Question 111:

  ABC Company has deployed a Single Channel Architecture (SCA) solution to help overcome some of the common problems with client roaming. In such a network, all APs are configured with the same channel and BSSID. PEAPv0/EAP- MSCHAPv2 is the only supported authentication mechanism.

  As the Voice over Wi-Fi (STA-1) client moves throughout this network, what events are occurring?

  A. STA-1 initiates open authentication and 802.11 association with each AP prior to roaming.
  B. The WLAN controller is querying the RADIUS server for authentication before the association of STA-1 is moved from one AP to the next.
  C. STA-1 controls when and where to roam by using signal and performance metrics in accordance with the chipset drivers and 802.11k.
  D. The WLAN controller controls the AP to which STA-1 is associated and transparently moves this association in accordance with the physical location of STA-1.
  D. The WLAN controller controls the AP to which STA-1 is associated and transparently moves this association in accordance with the physical location of STA-1.

• Question 112:

  Which command or configuration ensures that a WLAN controller enforces role-based access policies dynamically from RADIUS?

  A. Enable VLAN pooling
  B. Apply RADIUS return-list attributes
  C. Configure static SSID-to-VLAN mapping
  D. Enable WPA3 Transition Mode
  B. Apply RADIUS return-list attributes

• Question 113:

  Given: A WLAN consultant has just finished installing a WLAN controller with 15 controller-based APs. Two SSIDs with separate VLANs are configured for this network, and both VLANs are configured to use the same RADIUS server. The SSIDs are configured as follows: SSID Blue - VLAN 10 - Lightweight EAP (LEAP) authentication - CCMP cipher suite SSID Red - VLAN 20 - PEAPv0/EAP-TLS authentication - TKIP cipher suite

  The consultant's computer can successfully authenticate and browse the Internet when using the Blue SSID.

  The same computer cannot authenticate when using the Red SSID.

  What is a possible cause of the problem?

  A. The Red VLAN does not use server certificate, but the client requires one.
  B. The TKIP cipher suite is not a valid option for PEAPv0 authentication.
  C. The client does not have a proper certificate installed for the tunneled authentication within the established TLS tunnel.
  D. The consultant does not have a valid Kerberos ID on the Blue VLAN.
  C. The client does not have a proper certificate installed for the tunneled authentication within the established TLS tunnel.

• Question 114:

  The IEEE 802.11 Pairwise Transient Key (PTK) is derived from what cryptographic element?

  A. Phase Shift Key (PSK)
  B. Group Master Key (GMK)
  C. Pairwise Master Key (PMK)
  D. Group Temporal Key (GTK)
  E. PeerKey (PK)
  F. Key Confirmation Key (KCK)
  C. Pairwise Master Key (PMK)

• Question 115:

  Given: Your network includes a controller-based WLAN architecture with centralized data forwarding. The AP builds an encrypted tunnel to the WLAN controller. The WLAN controller is uplinked to the network via a trunked 1 Gbps Ethernet port supporting all necessary VLANs for management, control, and client traffic.

  What processes can be used to force an authenticated WLAN client's data traffic into a specific VLAN as it exits the WLAN controller interface onto the wired uplink? (Choose 3)

  A. On the Ethernet switch that connects to the AP, configure the switch port as an access port (not trunking) in the VLAN of supported clients.
  B. During 802.1X authentication, RADIUS sends a return list attribute to the WLAN controller assigning the user and all traffic to a specific VLAN.
  C. In the WLAN controller's local user database, create a static username-to-VLAN mapping on the WLAN controller to direct data traffic from a specific user to a designated VLAN.
  D. Configure the WLAN controller with static SSID-to-VLAN mappings; the user will be assigned to a VLAN according to the SSID being used.
  B. During 802.1X authentication, RADIUS sends a return list attribute to the WLAN controller assigning the user and all traffic to a specific VLAN.
  C. In the WLAN controller's local user database, create a static username-to-VLAN mapping on the WLAN controller to direct data traffic from a specific user to a designated VLAN.
  D. Configure the WLAN controller with static SSID-to-VLAN mappings; the user will be assigned to a VLAN according to the SSID being used.

• Question 116:

  Given: A WLAN protocol analyzer trace reveals the following sequence of frames (excluding the ACK frames):

  1. 802.11 Probe Req and 802.11 Probe Rsp

  2. 802.11 Auth and then another 802.11 Auth

  3. 802.11 Assoc Req and 802.11 Assoc Rsp

  4. EAPOL-KEY

  5. EAPOL-KEY

  6. EAPOL-KEY

  7. EAPOL-KEY

  What security mechanism is being used on the WLAN?

  A. WEP-128
  B. WPA2-Personal
  C. EAP-TLS
  D. WPA-Enterprise
  E. 802.1X/LEAP
  B. WPA2-Personal

• Question 117:

  Given: You are the WLAN administrator in your organization and you are required to monitor the network and ensure all active WLANs are providing RSNs. You have a laptop protocol analyzer configured.

  In what frame could you see the existence or non-existence of proper RSN configuration parameters for each BSS through the RSN IE?

  A. Probe request
  B. Beacon
  C. RTS
  D. CTS
  E. Data frames
  B. Beacon

• Question 118:

  After completing the installation of a new overlay WIPS for the purpose of rogue detection and security monitoring at your corporate headquarters, what baseline function MUST be performed in order to identify security threats?

  A. Authorized PEAP usernames must be added to the WIPS server's user database.
  B. WLAN devices that are discovered must be classified (rogue, authorized, neighbor, etc.) and a WLAN policy must define how to classify new devices.
  C. Separate security profiles must be defined for network operation in different regulatory domains
  D. Upstream and downstream throughput thresholds must be specified to ensure that service-level agreements are being met.
  B. WLAN devices that are discovered must be classified (rogue, authorized, neighbor, etc.) and a WLAN policy must define how to classify new devices.

• Question 119:

  You are advising on security for a public guest WLAN that must remain open for simple user onboarding while still protecting user traffic from passive eavesdropping.

  What technology is specifically designed for this purpose?

  A. OWE
  B. WEP
  C. LEAP
  D. MAC filtering
  A. OWE

• Question 120:

  Given: Your organization is using EAP as an authentication framework with a specific type that meets the requirements of your corporate policies.

  Which one of the following statements is true related to this implementation?

  A. The client will be the authenticator in this scenario.
  B. The client STAs must use a different, but complementary, EAP type than the AP STAs.
  C. The client STAs may communicate over the uncontrolled port in order to authenticate as soon as Open System authentication completes.
  D. The client STAs may communicate over the controlled port in order to authenticate as soon as the Open System authentication completes.
  C. The client STAs may communicate over the uncontrolled port in order to authenticate as soon as Open System authentication completes.