Check Real CWNP CWAP-404 Exam Question for Free (2026)
Get Ready to Boost your Prepare for your CWAP-404 Exam with 184 Questions
NEW QUESTION # 68
Given the IEEE 802.11 Beacon frame decode shown, determine which statement is definitively true.
- A. This Beacon frame came from an ERP or HT access point.
- B. The access point has both 1 Mbps and 2 Mbps configured as basic rates.
- C. ERP mobile stations must use the RTS/CTS protocol before Data transmissions.
- D. The SSID value in this Beacon is null.
- E. The access point is operating on channel 3.
Answer: A
NEW QUESTION # 69
You are troubleshooting a connection problem with a client STA. Regardless of the AP to which it attempts to connect, the connection fails.
Using a wired protocol analyzer, you determine that the problem is with the 802.1X/EAP authentication to the RADIUS server.
What layer or range of layers of the OSI model revealed this information?
- A. Layer 3
- B. Layer 2
- C. Below Layer 3
- D. Above Layer 4
Answer: A
NEW QUESTION # 70
The IEEE 802.11 Dynamic Frequency Selection (DFS) service is capable of performing what functions? (Choose 2)
- A. Suspending operations on a channel with high IEEE 802.11 co-channel interference
- B. Requesting and reporting of measurements in the current and other channels
- C. Testing channels for radar before using a channel and while operating in a channel
- D. Establishing an interference baseline on all 2.4 GHz channels
- E. Using modulation switching techniques to avoid interfering with radar systems
Answer: B,C
NEW QUESTION # 71
What is encrypted within the fourth frame of the 4-Way Handshake?
- A. PMK
- B. PTK
- C. GTK
- D. GMK
Answer: C
Explanation:
The GTK (Group Temporal Key) is encrypted within the third message of the 4-Way Handshake.
The 4-Way Handshake is a process that establishes a secure connection between a STA (station) and an AP (access point) using WPA2 (Wi-Fi Protected Access 2), which is a security protocol that uses AES- CCMP (Advanced Encryption Standard-Counter Mode CBC-MAC Protocol) as its encryption algorithm. The 4-Way Handshake consists of four messages that are exchanged between the STA and the AP. The first message is sent by the AP to the STA, containing the ANonce (Authenticator Nonce), which is a random number generated by the AP.
The second message is sent by the STA to the AP, containing the SNonce (Supplicant Nonce), which is a random number generated by the STA, and the MIC (Message Integrity Code), which is a value that verifies the integrity of the message. The third message is sent by the AP to the STA, containing the GTK, which is a key that is used to encrypt and decrypt multicast and broadcast data frames, and the MIC. The GTK is encrypted with the KEK (Key Encryption Key), which is derived from the PTK (Pairwise Temporal Key). The PTK is a key that is used to encrypt and decrypt unicast data frames, and it is derived from the PMK (Pairwise Master Key), the ANonce, and the SNonce. The fourth message is sent by the STA to the AP, containing only the MIC, to confirm the completion of the 4-Way Handshake. The other options are not correct, as they are not encrypted within the third message of the 4-Way Handshake. The PMK is a key that is derived from a passphrase or obtained from an authentication server, and it is not transmitted in any message of the 4-Way Handshake. The PTK is a key that is derived from the PMK, the ANonce, and the SNonce, and it is not transmitted in any message of the 4-Way Handshake. The GMK (Group Master Key) is a key that is generated by the AP and used to derive the GTK, and it is not transmitted in any message of the 4-Way Handshake.
NEW QUESTION # 72
The PHY layer provides framing by adding a header to create what type of data unit?
- A. PSDU
- B. MPDU
- C. PPDU
- D. MSDU
Answer: C
Explanation:
Explanation
The PHY layer provides framing by adding a header to create a PPDU. A PPDU (PHY Protocol Data Unit) is the data unit that is transmitted or received over the wireless medium by the PHY layer. A PPDU consists of a PSDU (PHY Service Data Unit) and a PHY header, which contains information such as modulation, coding, and data rate. The PHY layer adds the PHY header to the PSDU to create a PPDU for transmission, or removes the PHY header from the PPDU to extract the PSDU for reception. The other options are not correct, as they are not created by adding a header at the PHY layer. An MPDU (MAC Protocol Data Unit) is created by adding a MAC header and FCS to an MSDU (MAC Service Data Unit) at the MAC layer. An MSDU is the data unit that is passed from the LLC sublayer to the MAC sublayer or vice versa. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 4: 802.11 Physical Layer, page 97-98
NEW QUESTION # 73
In the analyzer trace shown, the TBTT is nominally 102.5 milliseconds.
Why does the Beacon transmission interval vary?
- A. Beacon frames vary in size, and therefore some take slightly longer to send than others.
- B. The access point must arbitrate to gain access to the RF medium in order to transmit a Beacon.
- C. The DCF Interframe space (DIFS) is nominally 50 ms, but typically varies by as much as 10 ms, which causes delays in Beacons.
- D. This trace shows an HT network where HR/DSSS nodes are active on the network. The access point is changing slot times from short to long as needed.
Answer: B
NEW QUESTION # 74
Given: There are many differences between analyzing wireless and wired networks. In a wireless network, there is no guarantee that one station can hear another station's transmissions.
If no corrective actions are taken nor corrective mechanisms implemented when a "hidden node" problem exists, which measurable statistics parameter will likely increase in a wireless protocol analyzer?
- A. Duration value
- B. Contention Window
- C. Retransmission Count
- D. ACK Timeout
- E. Authentication Failure
- F. BlockAck Reset
Answer: C
NEW QUESTION # 75
You are considering the performance of a BSS based on different PHY types used. In the BSS, one device must use ERP as it does not support HT in its 2.4 GHz band.
What is the duration of the interframe space for this ERP device for standard data frame transmissions?
- A. 16 microseconds
- B. 28 microseconds
- C. 10 microseconds
- D. 9 microseconds
Answer: B
NEW QUESTION # 76
Given: The Frame Check Sequence (FCS) is a 32 CRC used for error detection. The CRC is calculated over what?
- A. PHY Header, MAC Header and Frame Body
- B. PHY Header and MAC Header only
- C. Frame Body only
- D. Mac Header and Frame Body only
Answer: D
Explanation:
The CRC is calculated over the MAC Header and Frame Body only. The CRC (Cyclic Redundancy Check) is a 32-bit value that is used for error detection in wireless transmissions.
The CRC is calculated over the MAC Header and Frame Body of a PSDU, which are the parts of the data unit that contain information such as source and destination addresses, frame type, frame control, sequence number, payload, etc. The CRC is appended to the end of the PSDU as a FCS (Frame Check Sequence) field. The CRC is not calculated over the PHY Header or PHY Preamble, which are parts of the PPDU that contain information such as modulation, coding, data rate, etc. The PHY Header and PHY Preamble are added or removed by the PHY layer during the conversion between PSDU and PPDU.
NEW QUESTION # 77
You have been asked to recommend a solution for protocol capture of 802.11 frames consisting of 3x3:3 802.11ac communications. The requirement specifies that you gain a general view of a coverage area and does not require that you capture from specific user locations. The solution must be the least expensive practical solution possible that does not disrupt user access to the WLAN and it must be based on enterprise WLAN hardware.
What solution would you recommend so that any coverage area could be monitored on demand?
- A. Install Wireshark on the Aps natively to allow dynamic capture while serving clients
- B. Install laptop-based protocol analyzer near each AP
- C. Install sufficient Aps so that an AP can be taken offline to perform protocol analysis as needed
- D. Install the minimum number of Aps required for coverage and use these Aps for protocol analysis as needed
Answer: C
NEW QUESTION # 78
Recently, three rogue APs have been connected to the network and later discovered. You want to prevent future rogue AP installations as much as possible.
What is the first step to eliminating or reducing rogue APs on the network?
- A. Create a hash of the MAC addresses of all authorized devices and continually scan for non- matching hashes
- B. Define a direct policy that stipulates the ramifications of installing unauthorized devices
- C. Use IPSec between every AP and the network infrastructure
- D. Enable rogue detection in the existing authorized APs
Answer: D
NEW QUESTION # 79
You have captured 802.11 traffic using an adapter that includes the radio tap header. You see several frames often called announcement frames in the capture.
What best describes these types of frames?
- A. They only include beacon and probe response frames
- B. They are used to allow a STA to awake from sleep and for no other reason
- C. They are meant to provide information to the network that may result in state changes, but they are not open for rejection
- D. They only include beacon and probe request frames
Answer: A
NEW QUESTION # 80
Which one of the following statements is not true concerning DTIMs?
- A. Every Beacon frame must contain a DTIM
- B. The DTIM interval can dictate when an STA will wake up to listen to beacon frames
- C. DTIM stands for Delivery Traffic Indication Map
- D. Buffered Broadcast and Multicast traffic will be transmitted following a DTIM
Answer: A
Explanation:
Every Beacon frame must contain a DTIM is not a true statement concerning DTIMs. DTIM stands for Delivery Traffic Indication Message, and it is a subfield within the TIM (Traffic Indication Map) element in a Beacon frame. The DTIM indicates how many Beacon frames (including the current one) will appear before the next DTIM. For example, if the DTIM interval is set to 3, it means that every third Beacon frame will contain a DTIM. Buffered broadcast and multicast traffic will be transmitted following a DTIM, so that STAs in power save mode can wake up and receive them. The DTIM interval can also dictate when an STA will wake up to listen to Beacon frames, as some STAs may choose to only listen to Beacon frames that contain a DTIM.
NEW QUESTION # 81
You are troubleshooting throughput problems for a WLAN cell. The cell is provisioned with an
802.11ac dual-band AP. Users connected with both 5 GHz and 2.4 GHz connections are reporting performance problems. The AP settings are properly optimized. No interface issues have been detected (either co- channel interference or non-Wi-Fi interference) and the number of associated users is low.
What should you analyze to resolve the issue?
- A. The 5 GHz radio configuration
- B. The antennas used on the client devices
- C. The 2.4 GHz radio configuration
- D. the Ethernet uplink and the network infrastructure
Answer: D
NEW QUESTION # 82
Given: The Frame Check Sequence (FCS) is a 32 CRC used for error detection.
The CRC is calculated over what?
- A. PHY Header, MAC Header and Frame Body
- B. Frame Body only
- C. Mac Header and Frame Body only
- D. PHY Header and Mac Header only
Answer: C
Explanation:
Explanation
The CRC is calculated over the MAC Header and Frame Body only. The CRC (Cyclic Redundancy Check) is a 32-bit value that is used for error detection in wireless transmissions. The CRC is calculated over the MAC Header and Frame Body of a PSDU, which are the parts of the data unit that contain information such as source and destination addresses, frame type, frame control, sequence number, payload, etc. The CRC is appended to the end of the PSDU as a FCS (Frame Check Sequence) field. The CRC is not calculated over the PHY Header or PHY Preamble, which are parts of the PPDU that contain information such as modulation, coding, data rate, etc. The PHY Header and PHY Preamble are added or removed by the PHY layer during the conversion between PSDU and PPDU. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 4: 802.11 Physical Layer, page 97-98
NEW QUESTION # 83
ABC Company's WLAN administrator is getting complaints from one user that his WLAN throughput is sluggish compared to other users in his area. The administrator takes his diagnostics laptop, which has a wireless protocol analyzer installed, to the area where the complaining user works. The administrator uses the PING utility to test connectivity from the complaining user's wireless client station to another wireless client station across the closest access point, while capturing the wireless frames.
The administrator sees what is displayed in this screenshot.
From this screenshot, which statements can you conclude to be TRUE that are related to the complaining user's throughput problem? (Choose 2)
- A. The complaining user's station is retransmitting fragments many times likely due to nearby RF interference.
- B. The access point and other stations are using ERP-OFDM modulation, and the complaining user's wireless client station is using HR/DSSS modulation.
- C. The complaining user's wireless client station should be using RTS/CTS as a protection mechanism, but it is not.
- D. The complaining user's WLAN client utilities are configured with a small fragmentation threshold.
- E. The access point is not signaling for protection (Protection = no) in the Beacons, but it should be.
Answer: B,D
NEW QUESTION # 84
In which 802.11 frames is the SSID present, provided the SSID is not removed through proprietary software configuration by an administrator? (Choose 3)
- A. Disassociation
- B. Probe Response
- C. Association Request
- D. Authentication
- E. Association Response
- F. Reassociation Request
Answer: B,C,F
NEW QUESTION # 85
You have implemented an AP at a remote office. It is a single-band AP supporting 802.11ac.
Several users complain that their laptops cannot connect to the WLAN. These laptops are from multiple vendors and range in age from 2 to 4 years. The SSID and security profile settings are correct. All default settings were used on the AP with the exception of the SSID and security settings. What is the most likely issue preventing these STAs from connecting to the AP?
- A. They are 2.4 GHz-only devices
- B. They are 5 GHz-only devices
- C. They do not support VHI and only support OFDM
- D. They do not support the basic data rates
Answer: A
Explanation:
Since the AP is a single-band AP supporting 802.11ac, it operates only on the 5 GHz band. If the laptops are 2.4 GHz-only devices, they will not be able to connect because they do not support the 5 GHz band that the AP is operating on. This is likely the issue preventing these older devices from connecting to the WLAN.
NEW QUESTION # 86
Which common feature of a Spectrum Analyzer would be the best to help you locate a non-802.11 interference source?
- A. Max hold
- B. Location filter
- C. Min hold
- D. Device finder
Answer: D
Explanation:
Explanation
The device finder is a common feature of a spectrum analyzer that helps locate a non-802.11 interference source. The device finder uses a directional antenna to measure the signal strength of a specific frequency or signal source. By pointing the antenna in different directions, the device finder can indicate the direction and distance of the interference source. The device finder can also filter out other signals that are not related to the interference source. The other options are not correct, as they do not help locate a non-802.11 interference source. Max hold and min hold are features that show the maximum and minimum RF power levels over time,respectively. Location filter is a feature that filters out signals that are not from a specific location or area. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 3: Spectrum Analysis, page 77-78
NEW QUESTION # 87
As a wireless network consultant you have been called in to troubleshoot a high-priority issue for one of your customers. The customer's office is based on two floors within a multi-tenant office block. On one of these floors (floor 5) users cannot connect to the wireless network. During their own testing the customer has discovered that users can connect on floor 6 but not when they move to the floor 5. This issue is affecting all users on floor 5 and having a negative effect on productivity.
To troubleshoot this issue, you perform both Spectrum and Protocol Analysis. The Spectrum Analysis shows the presence of Bluetooth signals which you have identified as coming from wireless mice. In the protocol analyzer you see the top frame on the network is Deauthentication frames. On closer investigation you see that the Deauthentication frames' source addresses match the BSSIDs of your customers APs and the destination address is FF:FF:FF:FF:FF:FF:FF.
What do you conclude from this troubleshooting exercise?
- A. The users on floor 5 are being subjected to a denial of service attack, as this is happening across the entire floor it is likely to be a misconfigured WIPS solution belonging to the tenants on the floor below
- B. The CCI from the APs on the floor 4 is the problem and you need to ask the tenant below to turn down their APs Tx power
- C. The customers APs are misbehaving and a technical support case should be open with the vendor
- D. The customer should replace all their Bluetooth wireless mice as they are stopping the users on floor 5 from connecting to the wireless network
Answer: A
Explanation:
Explanation
The users on floor 5 are being subjected to a denial of service attack, as this is happening across the entire floor it is likely to be a misconfigured WIPS solution belonging to the tenants on the floor below. This is because the Deauthentication frames have a source address that matches the BSSIDs of the customer's APs and a destination address that is a broadcast address (FF:FF:FF:FF:FF:FF). This indicates that someone is sending spoofed Deauthentication frames to all STAs associated with the customer's APs, causing them to disconnect from the wireless network. This is a common type of DoS attack on wireless networks, and it could be caused by a rogue device or a WIPS solution that is configured to protect the wireless network of another tenant on the floor below12. References: CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 13: Troubleshooting Common Wi-Fi Issues, page 4961; CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 14: Troubleshooting Tools, page 5272.
NEW QUESTION # 88
In the frame decode shown, there are two sets of supported data rates. 1, 2, 5.5, and 11 Mbps are all shown as "basic" data rates, and 6, 9, 12, 18, 24, 36, 48, and 54 Mbps are shown simply as supported data rates.
What is true of "basic" data rates in this context?
- A. Basic rates are optional data rates for the BSS, often used for assuring connectivity for legacy stations.
- B. Basic rates are defined in an AP's service set to specify mandatory data rates for all retry frames.
- C. Basic rates are only used for multicast traffic, and do not affect unicast traffic.
- D. The AP requires all client stations to support Basic rates in order to associate to its BSS.
- E. The highest data rate set to Basic is automatically used to send broadcast traffic such as Beacon frames.
Answer: D
NEW QUESTION # 89
Which statements are true regarding frame acknowledgement in an IEEE 802.11 WLAN? (Choose 3)
- A. A client station's Reassociation Request frames are only acknowledged with a Reassociation Response from the access point and not with an ACK frame.
- B. In an EDCA BSS, encrypted Data frames are only acknowledged by client stations, never by access points.
- C. Probe request acknowledgement (sending of a Probe Response frame) is configurable in the access point and is always linked to SSID broadcast configuration in Beacons.
- D. The RA field of ACK frames is always obtained from the Address 2 field in the corresponding frame being acknowledged.
- E. Data frame fragments are acknowledged individually (with an ACK frame).
- F. Following non-QoS Data frames with the More Fragments bit set to 1, the Duration/ID field of the ACK frame is set to a value equal to two SIFS plus the next Data fragment and its ACK.
Answer: D,E,F
NEW QUESTION # 90
......
Use Free CWAP-404 Exam Questions that Stimulates Actual EXAM : https://examcollection.actualcollection.com/CWAP-404-exam-questions.html