CWNP CWAP-405 Exam Prep Guide: Prep guide for the CWAP-405 Exam
2025 New Preparation Guide of CWNP CWAP-405 Exam
NEW QUESTION # 55
You are analyzing a packet decode of a Probe Request and notice the SSID element has a length of zero.
What do you conclude about the transmitting STA?
- A. The STA is operating in Ad-Hoc mode
- B. The WLAN adaptor is configured in promiscuous mode
- C. The STA's WLAN adaptor is disabled
- D. The STA is discovering a list of available BSSs
Answer: D
Explanation:
The STA is discovering a list of available BSSs by sending a Probe Request with an empty SSID element.
This is also known as a broadcast Probe Request, as it does not specify any particular SSID to probe for. Any AP that receives this Probe Request will respond with a Probe Response containing its own SSID and other information about its BSS. This way, the STA can learn about all the BSSs in its vicinity and choose which one to associate with . References: CWAP-405Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 191; CWAP-405Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 193.
NEW QUESTION # 56
In which element of a Beacon frame would you look to identity the current HT protection mode in which an AP is operating?
- A. ERP Information Element
- B. HT Operations Element
- C. HT Protection Element
- D. HT Capabilities Element
Answer: B
Explanation:
The HT protection mode in which an AP is operating can be identified by looking at the HT Operations element in a Beacon frame. The HT Operations element is a part of the Beacon frame that contains information about the High Throughput (HT) capabilities and operation of an 802.11n BSS. The HT Operations element has a field called HT Protection, which indicates how the BSS protects its HT transmissions from interference or collisions with non-HT devices or BSSs. The HT Protection field can have four values: No Protection, Nonmember Protection, 20 MHz Protection, or Non-HT Mixed Mode. The other options are not correct, as they do not contain information about the HT protection mode. The HT Protection element does not exist, the ERP Information element is used for Extended Rate PHY (ERP) protection mode for 802.11g devices, and the HT Capabilities element is used for indicating the supported HT features of an individual device. References: [Wireless Analysis Professional Study Guide CWAP-405], Chapter 5: 802.11 MAC Sublayer, page 125-126
NEW QUESTION # 57
What is used to respond with an uplink transmission to an MU-RTS trigger frame in the 802.11ax PHY?
- A. VHT PPDU
- B. HE TB PPDU
- C. HE SU PPDU
- D. HE MU PPDU
Answer: B
Explanation:
An HE TB PPDU (High Efficiency Trigger-Based Packet Data Unit) is used to respond with an uplink transmission to an MU-RTS trigger frame in the 802.11ax PHY (Physical Layer). An MU-RTS trigger frame is a frame that initiates a multi-user transmission opportunity (MU-TXOP) by requesting multiple stations (STAs) to send clear-to-send (CTS) frames on different spatial streams or resource units (RUs). An HE TB PPDU is a frame that contains data from multiple STAs that have been allocated RUs by an MU-RTS trigger frame or another type of trigger frame. An HE SU PPDU (High Efficiency Single User Packet Data Unit) is a frame that contains data from a single STA using all available spatial streams or RUs. An HE MU PPDU (High Efficiency Multi User Packet Data Unit) is a frame that contains data from multiple STAs using different spatial streams or RUs without being triggered by another frame. A VHT PPDU (Very High Throughput Packet Data Unit) is a frame that uses the 802.11ac PHY and does not support multi-user transmissions.
References:
CWAP-405Study Guide, Chapter 3: 802.11 MAC Layer Frame Formats and Technologies, page 101 CWAP-405Objectives, Section 3.4: Analyze multi-user transmissions CWAP-405Study Guide, Chapter 3: 802.11 MAC Layer Frame Formats and Technologies, page 99
NEW QUESTION # 58
You have received reports of performance problems in a BSS. One specific user is indicating that her downloads are taking a very long time compared to other users around her. You want to determine if the AP is sending frames multiple times to get through to the user's computer.
Where should you monitor with the protocol analyzer to see retries from the AP in this scenario?
- A. Capture from another AP in another BSS
- B. Very near the client STA
- C. Directly in the middle of the AP and client STA
- D. Very near the AP
Answer: D
NEW QUESTION # 59
In the 2.4 GHZ band, what data rate are Probe Requests usually sent at from an unassociated STA?
- A. 6 Mbps
- B. The minimum basic rate
- C. 1 Mbps
- D. MCS 0
Answer: B
Explanation:
In the 2.4 GHz band, probe requests are usually sent at the minimum basic rate from an unassociated STA. A probe request is a type of management frame that is transmitted by a STA to discover available BSSs in its vicinity. A probe request can be sent on one or more channels in either passive or active scanning mode. In passive scanning mode, a STA listens for beacon frames from APs on each channel. In active scanning mode, a STA sends probe requests on each channel and waits for probe responses from APs. A probe request is usually sent at the minimum basic rate, which is the lowest data rate among the supported rates that is required for all STAs to join and communicate with a BSS. The minimum basic rate can vary depending on the configuration of each BSS, but it is typically one of these values: 1 Mbps, 2 Mbps, 5.5 Mbps, or 11 Mbps in the 2.4 GHz band. The other options are not correct, as they do not reflect how probe requests are usually sent in the 2.4 GHz band. MCS 0 is a modulation and coding scheme used by 802.11n/ac devices in either band, but it is not a data rate per se. 6 Mbps is a data rate used by OFDM devices in either band, but it is not usually configured as a minimum basic rate in the 2.4 GHz band. References: [Wireless Analysis Professional Study Guide CWAP-405], Chapter 5: 802.11 MAC Sublayer, page 123-124
NEW QUESTION # 60
You are troubleshooting throughput problems for a WLAN cell. The cell is provisioned with an 802.11ac dual- band AP. Users connected with both 5 GHz and 2.4 GHz connections are reporting performance problems.
The AP settings are properly optimized. No interface issues have been detected (either co-channel interference or non-Wi-Fi interference) and the number of associated users is low.
What should you analyze to resolve the issue?
- A. the Ethernet uplink and the network infrastructure
- B. The 5 GHz radio configuration
- C. The 2.4 GHz radio configuration
- D. The antennas used on the client devices
Answer: A
NEW QUESTION # 61
The PHY layer provides framing by adding a header to create what type of data unit?
- A. PSDU
- B. PPDU
- C. MPDU
- D. MSDU
Answer: B
Explanation:
The PHY layer provides framing by adding a header to create a PPDU. A PPDU (PHY Protocol Data Unit) is the data unit that is transmitted or received over the wireless medium by the PHY layer. A PPDU consists of a PSDU (PHY Service Data Unit) and a PHY header, which contains information such as modulation, coding, and data rate. The PHY layer adds the PHY header to the PSDU to create a PPDU for transmission, or removes the PHY header from the PPDU to extract the PSDU for reception. The other options are not correct, as they are not created by adding a header at the PHY layer. An MPDU (MAC Protocol Data Unit) is created by adding a MAC header and FCS to an MSDU (MAC Service Data Unit) at the MAC layer. An MSDU is the data unit that is passed from the LLC sublayer to the MAC sublayer or vice versa. References: [Wireless Analysis Professional Study Guide CWAP-405], Chapter 4: 802.11 Physical Layer, page 97-98
NEW QUESTION # 62
ABC International has installed a new smart ZigBee controlled lighting system. However, the network team is concerned that this new system will interfere with the existing WLAN and has asked you to investigate the impact of the two systems operating simultaneously in the 2.4 GHz band. When performing Spectrum Analysis, which question could you answer by looking at the FFT plot?
- A. Is the ZigBee system using more than 50% of the available airtime?
- B. Is the WLAN corrupting ZigBee system messages?
- C. Is the ZigBee system causing an increase in WLAN retries?
- D. Do the ZigBee channels used by the lighting system overlap with the WLAN channels?
Answer: D
Explanation:
The FFT plot is a spectrum analysis plot that shows the RF power present at a particular frequency over a short period of time. It can help identify the sources and characteristics of RF signals in the spectrum. By looking at the FFT plot, you can determine which ZigBee channels are used by the lighting system and whether they overlap with the WLAN channels in the 2.4 GHz band. ZigBee channels are 5 MHz wide and WLAN channels are 20 MHz or 40 MHz wide, so there is a possibility of overlap and interference between them. The other questions cannot be answered by looking at the FFT plot alone, as they require other types of plots or analysis tools, such as duty cycle plot, airtime utilization plot, or protocol analyzer. References: [Wireless Analysis Professional Study Guide], Chapter 3: Spectrum Analysis, page 69-
70
NEW QUESTION # 63
Protocol analyzers may present field values in either binary, decimal or hexadecimal. What preceeds a hexadecimal value to indicate it is hexadecimal?
- A. 16x
- B. %
- C. HEX
- D. 0x
Answer: D
Explanation:
A hexadecimal value is a value that uses base 16 notation, which means it can have digits from 0 to 9 and letters from A to F.
A hexadecimal value is usually preceded by 0x to indicate that it is hexadecimal and not decimal or binary.
For example, 0x0A is hexadecimal for 10 in decimal or 00001010 in binary. The other options are not valid prefixes for hexadecimal values.
References:
CWAP-405Study Guide, Chapter 2: Protocol Analysis, page 35
CWAP-405Objectives, Section 2.2: Analyze field values
NEW QUESTION # 64
Which one of the following statements is not true concerning DTIMs?
- A. The DTIM interval can dictate when an STA will wake up to listen to beacon frames
- B. DTIM stands for Delivery Traffic Indication Map
- C. Every Beacon frame must contain a DTIM
- D. Buffered Broadcast and Multicast traffic will be transmitted following a DTIM
Answer: C
Explanation:
Every Beacon frame must contain a DTIM is not a true statement concerning DTIMs. DTIM stands for Delivery Traffic Indication Message, and it is a subfield within the TIM (Traffic Indication Map) element in a Beacon frame. The DTIM indicates how many Beacon frames (including the current one) will appear before the next DTIM. For example, if the DTIM interval is set to 3, it means that every third Beacon frame will contain a DTIM. Buffered broadcast and multicast traffic will be transmitted following a DTIM, so that STAs in power save mode can wake up and receive them. The DTIM interval can also dictate when an STA will wake up to listen to Beacon frames, as some STAs may choose to only listen to Beacon frames that contain a DTIM . References: CWAP-405Certified Wireless Analysis Professional Study and Reference Guide, Chapter
6: MAC Sublayer Frame Exchanges, page 200; CWAP-405Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 201.
NEW QUESTION # 65
What is an AIFS?
- A. A medium access method introduced by 802.lln, but never implemented
- B. A variable Interframe Space introduced by 802.lie to help prioritize medium access for different Access Categories
- C. The shortest period of time a STA can sleep
- D. A form of aggregation performed at the PHY layer based on 802.lie UP values interpreted from DSCP values
Answer: B
Explanation:
An AIFS is a variable interframe space introduced by 802.11e to help prioritize medium access for different Access Categories (ACs). An interframe space is a period of time that a STA (station) has to wait before attempting to access the medium. An AIFS is a type of interframe space that varies depending on the AC of the traffic. An AC is a logical queue that corresponds to a QoS (Quality of Service) level for different types of traffic. There are four ACs defined by 802.11e: AC_VO (Voice), AC_VI (Video), AC_BE (Best Effort), and AC_BK (Background). Each AC has a different AIFSN (Arbitration Interframe Space Number) value, which determines how long it has to wait before attempting to access the medium. A lower AIFSN value means a higher priority and a shorter waiting time. The other options are not correct, as they do not describe what an AIFS is. An AIFS is not a medium access method introduced by 802.11n, but never implemented, as it is part of the 802.11e standard and widely used in QoS-enabled WLANs. An AIFS is not a form of aggregation performed at the PHY layer based on 802.11e UP values interpreted from DSCP values, as aggregation is a technique that combines multiple frames into one larger frame to improve efficiency and throughput, not prioritization or medium access. An AIFS is not the shortest period of time a STA can sleep, as sleeping is a power saving mode that allows a STA to conserve battery power by periodically turning off its radio, not accessing the medium. References: [Wireless Analysis Professional Study Guide CWAP-405], Chapter 7:
QoS Analysis, page 194-195
NEW QUESTION # 66
The data rate for a data frame is 150 Mbps in 5 GHz.
What rate is used to transmit the PHY header information?
- A. 6 Mbps
- B. 75 Mbps
- C. 1 Mbps
- D. 150 Mbps
Answer: C
Explanation:
References:
NEW QUESTION # 67
Given a protocol analyzer can decrypt WPA2-PSK data packets providing the PSK and SSID are configured in the analyzer software. When performing packet capture (in a non-FT environment) which frames are required in order for PSK frame decryption to be possible?
- A. 4-Way Handshake
- B. Probe Response
- C. Reassociation
- D. Authentication
Answer: A
Explanation:
The 4-way handshake is the process that establishes the pairwise transient key (PTK) between the client and the AP in WPA2-PSK. The PTK is derived from the PSK, the SSID, and some random numbers exchanged in the handshake frames. The PTK is used to encrypt and decrypt the data frames between the client and the AP. Therefore, in order to decrypt WPA2-PSK data packets, a protocol analyzer needs to capture the 4-way handshake frames and have the PSK and SSID configured in the analyzer software12 References:
* CWAP-405Study Guide, Chapter 3: 802.11 MAC Layer Frame Formats and Technologies, page 87
* CWAP-405Objectives, Section 3.5: Analyze security exchanges
NEW QUESTION # 68
How many frames are exchanged for 802.11 authentication in the 6 GHz band when WPA3-Enterprise is not used, and a passphrase is used instead?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: D
Explanation:
Two frames are exchanged for 802.11 authentication in the 6 GHz band when WPA3-Enterprise is not used, and a passphrase is used instead. Authentication is a process that establishes an identity relationship between a STA (station) and an AP (access point) before joining a BSS (Basic Service Set). There are two types of authentication methods defined by 802.11: Open System Authentication and Shared Key Authentication.
Open System Authentication does not require any credentials or security information from a STA to join a BSS, and it consists of two frames: an Authentication Request frame sent by the STA to the AP, and an Authentication Response frame sent by the AP to the STA. Shared Key Authentication requires a shared secret key from a STA to join a BSS, and it consists of four frames: two challenge-response frames in addition to the request-response frames. However, Shared Key Authentication uses WEP (Wired Equivalent Privacy) as its encryption algorithm, which is insecure and deprecated. In the 6 GHz band, which is a newly available frequency band for WLANs, Shared Key Authentication is prohibited by the 802.11 standard, as it poses security and interference risks for other users and services in the band. The 6 GHz band requires all WLANs to use WPA3-Personal or WPA3-Enterprise encryption methods, which are more secure and robust than previous encryption methods such as WPA2 or WEP. WPA3-Personal uses a passphrase to derive a PMK (Pairwise Master Key), while WPA3-Enterprise uses an authentication server to obtain a PMK. Both methods use SAE (Simultaneous Authentication of Equals) as their authentication protocol, which replaces PSK (Pre- Shared Key) or EAP (Extensible Authentication Protocol). SAE consists of two frames: an SAE Commit frame sent by both parties to exchange elliptic curve parameters and nonces, and an SAE Confirm frame sent by both parties to verify each other's identities and generate a PMK. Therefore, when WPA3-Enterprise is not used, and a passphrase is used instead in the 6 GHz band, only two frames are exchanged for 802.11 authentication: an SAE Commit frame and an SAE Confirm frame. References: [Wireless Analysis Professional Study Guide CWAP-405], Chapter 8: Security Analysis, page 220-221
NEW QUESTION # 69
You have installed a new 802.1 lac WLAN configured with 80 MHz channels. Users in one area are complaining about poor performance. This area is currently served by a single AP. You take a spectrum analysis capture in the poor performing area. While examining the waterfall plot you notice the airtime utilization is higher on the first 20 MHz of the 80 MHz channel when compared to the rest of the channel.
What do you conclude?
- A. The first 20 MHz is the AP's primary channel and higher airtime utilization on the primary channel is normal when an AP is configured for 80 MHz operation
- B. RRM is enabled and has dynamically picked a 20 MHz channel
- C. Non-Wi-Fi interference is preventing the APs 80 MHz operation
- D. The AP is misconfigured and needs to be reconfigured to 80 MHz operation
Answer: C
Explanation:
The most likely cause of higher airtime utilization on the first 20 MHz of the 80 MHz channel is non-Wi-Fi interference. Non-Wi-Fi interference can prevent an AP from using its full channel width, as it will degrade the signal quality and increase the noise floor on some parts of the channel. This will force the AP to fall back to a narrower channel width, such as 20 MHz or 40 MHz, to maintain communication with its clients. The waterfall plot can help identify non-Wi-Fi interference by showing spikes or bursts of RF energy on specific frequencies or sub-channels. The other options are not correct, as they do not explain why only the first 20 MHz of the channel has higher airtime utilization. References: [Wireless Analysis Professional Study Guide], Chapter 3: Spectrum Analysis, page 74-75
NEW QUESTION # 70
You need to determine RF activity over time in a spectrum analyzer. It is to be able to see the activity and the amplitude of that activity.
What kind of view should be used?
- A. Channel listing
- B. Device listing
- C. Real-time FFT
- D. Swept spectrogram
Answer: D
Explanation:
The FFT shows spectral activity in the frequency domain, while waterfall or swept spectrogram views attempt to represent RF activity over time
NEW QUESTION # 71
When performing protocol analysis, you capture an 802.1 lac data frame on channel 52, transmitted at MCS 8.
At what data rate was the PHY Preamble transmitted?
- A. 54 Mbps
- B. 78 Mbps
- C. 6 Mbps
- D. 86.7 Mbps
Answer: C
Explanation:
The data rate at which the PHY preamble was transmitted is 6 Mbps. The PHY preamble is a part of the PPDU that is transmitted before the PHY header and the PSDU. The PHY preamble consists of a series of training fields that help the receiver to detect and synchronize with the signal. The PHY preamble is always transmitted at a fixed data rate that depends on the type of PPDU (e.g., OFDM, HT, VHT, HE). For an 802.1 lac data frame on channel 52, which uses VHT PPDUs, the data rate for the PHY preamble is 6 Mbps. This data rate does not depend on MCS (Modulation and Coding Scheme), which only affects the data rate for the PSDU. References: [Wireless Analysis Professional Study Guide CWAP-405], Chapter 4: 802.11 Physical Layer, page 99-100
NEW QUESTION # 72
You are troubleshooting a connection problem with a client STA. Regardless of the AP to which it attempts to connect, the connection fails. Using a wired protocol analyzer, you determine that the problem is with the
802.1X/EAP authentication to the RADIUS server.
What layer or range of layers of the OSI model revealed this information?
- A. Below Layer 3
- B. Above Layer 4
- C. Layer 3
- D. Layer 2
Answer: C
NEW QUESTION # 73
Where would you look in a packet trace file to identify the configured Minimum Basic Rate (MBR) of a BSS?
- A. Supported Rates & Extended Supported Rates elements in a Beacon frame
- B. In the MBR Action frame
- C. In the MBR Information Element in an Association Response frame
- D. In the Minimum Basic Rate Element in a Beacon frame
Answer: A
Explanation:
The configured Minimum Basic Rate (MBR) of a BSS can be identified by looking at the Supported Rates and Extended Supported Rates elements in a Beacon frame. A Beacon frame is a type of management frame that is transmitted by an AP to advertise its presence and capabilities to potential clients. A Beacon frame contains various information elements (IEs) that provide details about the BSS configuration and operation.
The Supported Rates and Extended Supported Rates IEs list the data rates that are supported by the AP for data transmission. The MBR is the lowest data rate among these supported rates that is required for all clients to join and communicate with the BSS. The MBR is usually marked with a flag bit in these IEs to indicate its mandatory status. The other options are not correct, as they do not exist or do not indicate the MBR of a BSS. References: [Wireless Analysis Professional Study Guide CWAP-405], Chapter 5: 802.11 MAC Sublayer, page 123-124
NEW QUESTION # 74
What should the To DS and From DS flags be to set to in an Association Response frame?
- A. To DS - 1, From DS = 0
- B. To DS - 0, From DS = 0
- C. To DS = 1, From DS = 1
- D. To DS = 0, From DS = 1
Answer: D
Explanation:
The To DS and From DS flags should be set to 0 in an Association Response frame. An Association Response frame is a type of management frame that is transmitted by an AP to accept or reject an association request from a STA. The To DS (To Distribution System) and From DS (From Distribution System) flags are two bits in the Frame Control field of the MAC header that indicate whether a frame is destined for or originated from the DS (Distribution System), which is a system that connects multiple BSSs together. The To DS and From DS flags can have four possible combinations: 00, 01, 10, or 11. For an Association Response frame, which is sent from an AP to a STA within a BSS, both flags should be set to 0. References: [Wireless Analysis Professional Study Guide CWAP-405], Chapter 5: 802.11 MAC Sublayer, page 121-122
NEW QUESTION # 75
A client is operating in an unstable RF environment. Out of five data frames transmitted to the client it only receives four. The client sends a Block Ack to acknowledge the receipt of these four frames but due to frame corruption the Block Ack is not received by the AP. Which frames will be retransmitted'
- A. All data frames
- B. Both the corrupted data and Block Ack
- C. Only the Block Ack
- D. Only the data frame which was corrupted
Answer: A
Explanation:
All data frames will be retransmitted in this scenario. This is because the AP uses a Block Ack (BA) mechanism to acknowledge the receipt of multiple data frames from a client in a single frame. The BA contains a bitmap that indicates which data frames were received correctly and which were not. If the BA is not received by the AP due to frame corruption, the AP will assume that none of the data frames were received by the client and will retransmit all of them. The other options are not correct, as they do not account for the loss of the BA or the use of the bitmap. References: [Wireless Analysis Professional Study Guide CWAP-405], Chapter 6: 802.11 Frame Exchanges, page 167-168
NEW QUESTION # 76
......
Latest Questions CWAP-405 Guide to Prepare Free Practice Tests: https://www.testsdumps.com/CWAP-405_real-exam-dumps.html
CWAP-405 Practice Exam - 120 Unique Questions: https://drive.google.com/open?id=1JRSHJu88D6kKG2kV0HIrg5GkM9miCSae
