CWAP-404 Revolutionary Guide To Exam CWNP Dumps
CWAP-404 Free Study Guide! with New Update 190 Exam Questions
CWNP CWAP-404 Exam Topics:
| Section | Objectives |
|---|---|
Protocol Analysis - 15% | |
| Capture 802.11 frames using the appropriate methods | - Select capture devices
- Install monitor mode drivers |
| Understand and apply the common capture configuration parameters available in protocol analysis tools | - Save to disk - Packet slicing - Event triggers - Buffer options - Channels and channel widths - Capture filters - Channel scanning and dwell time |
| Analyze 802.11 frame captures to discover problems and find solutions | - Use appropriate display filters to view relevant frames and packets - Use colorization to highlight important frames and packets - Configure and display columns for analysis purposes - View frame and packet decodes while understanding the information shown and applying it to the analysis process - Use multiple adapters and channel aggregation to view captures from multiple channels - Implement protocol analyzer decryption procedures - View and use a capture’s statistical information for analysis - Use expert mode for analysis - View and understand peer maps as they relate to communications analysis |
| Utilize additional tools that capture 802.11 frames for analysis and troubleshooting | - WLAN scanners and discovery tools - Protocol capture visualization and analysis tools - Centralized monitoring, alerting, and forensic tools |
| Ensure appropriate troubleshooting methods are used with all analysis types | - Define the problem - Determine the scale of the problem - Identify probable causes - Capture and analyze the data - Observe the problem - Choose appropriate remediation steps - Document the problem and resolution |
Spectrum Analysis - 10% | |
| Capture RF spectrum data and understand the common views available in spectrum analyzers | - Install, configure, and use spectrum analysis software and hardware - Capture RF spectrum data using handheld, laptop-based, and infrastructure spectrum capture solutions - Understand and use spectrum analyzer views
|
| Analyze spectrum captures to identify relevant RF information and issues | - RF noise floor in an environment - Signal-to-Noise Ratio (SNR) for a given signal - Sources of RF interference and their locations - RF channel utilization - Non-Wi-Fi transmitters and their impact on WLAN communications - Overlapping and non-overlapping adjacent channel interference - Poor performing or faulty radios |
| Analyze spectrum captures to identify various device signatures | - Identify various 802.11 PHYs
- Identify non-802.11 devices based on RF behaviors and signatures
|
| Use centralized spectrum analysis solutions | - AP-based spectrum analysis - Sensor-based spectrum analysis |
PHY Layers and Technologies - 10% | |
| Understand and describe the functions of the PHY layer and the PHY protocol data units (PPDUs) | - DSSS (Direct Sequence Spread Spectrum) - HR/DSSS (High Rate/Direct Sequence Spread Spectrum) - OFDM (Orthogonal Frequency Division Multiplexing) - ERP (Extended Rate PHY) - HT (High Throughput) - VHT (Very High Throughput) - HE (High Efficiency)
|
| Apply the understanding of PHY technologies, including PHY headers, preambles, training fields, frame aggregation, and data rates, to captured data | |
| Identify and use PHY information provided within pseudo-headers in protocol analyzers | - Pseudo-Header formats
- Key pseudo-header content
|
| Recognize the limits of protocol analyzers to capture PHY information including NULL data packets and PHY headers | |
| Use appropriate capture devices based on proper understanding of PHY types | - Supported PHYs - Supported spatial streams |
MAC Sublayer and Functions - 25% | |
| Understand frame encapsulation and frame aggregation | - Frame aggregation (A-MSDU and A-MPDU) |
| Identify and use MAC information in captured data for analysis | - Management, Control, and Data frames - MAC frame formats and contents
- 802.11 Management frame formats
- Data and QoS Data frame formats
|
| Validate BSS configuration through protocol analysis | - Country code - Minimum basic rate - Supported rates and coding schemes - Beacon interval - WMM settings - RSN settings - HT/VHT/HE operations - Channel width - Primary channel - Hidden or non-broadcast SSIDs |
| Identify and analyze CRC error frames and retransmitted frames | |
WLAN Medium Access - 10% | |
| Understand 802.11 contention algorithms in-depth and know how they impact WLANs | - Distributed Coordination Function (DCF)
- Enhanced Distributed Channel Access (EDCA)
- Wi-Fi Multimedia (WMM)
|
| Analyze QoS configuration and operations | - Verify QoS parameters in capture files - Ensure QoS is implemented end-to-end |
NEW QUESTION # 60
When performing protocol analysis, you capture an 802.11ac data frame on channel 52, transmitted at MSC 8.
At what data rate was the PHY Preamble transmitted?
- A. 6 Mbps
- B. 86.7 Mbps
- C. 78 Mbps
- D. 54 Mbps
Answer: A
Explanation:
The transmitter sends the preamble at 1 Mbps (802.11 or 802.11b DSSS) or 6 Mbps (802.11a or
802.11g ERP-OFDM).
Reference: http://mediA.techtarget.com/searchMobileComputing/downloads/CWAP_ch8.pdf
NEW QUESTION # 61
What is the function of 802.11 Management frames?
- A. Manage the flow of data
- B. Prioritize network administration traffic
- C. Manage the BSS
- D. Communicate configuration changes between WLAN controller and APs
Answer: C
Explanation:
The function of 802.11 management frames is to manage the BSS. A BSS (Basic Service Set) is a group of STAs (stations) that share a common SSID (Service Set Identifier) and communicate with each other through an AP (access point) or directly in an ad hoc mode. Management frames are one of the three types of 802.11 frames, along with control and data frames. Management frames are used to establish, maintain, and terminate associations between STAs and APs, as well as to advertise and discover BSSs, exchange security information, report errors, and perform other management functions. The other options are not correct, as they are not functions of
802.11 management frames. Prioritizing network administration traffic, communicating configuration changes between WLAN controller and APs, and managing the flow of data are functions of other types of frames or protocols.
NEW QUESTION # 62
What two IEEE 802.11 entities may be used to separate successful transmissions within an EDCA TXOP? (Choose 2)
- A. ACK
- B. PIFS
- C. CAP
- D. AIFS
- E. RIFS
- F. SIFS
- G. EIFS
Answer: E,F
NEW QUESTION # 63
Using a portable analyzer you perform a packet capture next to a client STA and you can see that the STA is associated to a BSS. You observe the STA sending packets to the AP and the AP sending packets to the STA. Less the 2% of all packets are retransmissions. You move to capture packets by the AP and, while the retry rate is still very low, you now only see unidirectional traffic from the AP to the client. How do you explain this behavior?
- A. The portable analyzer has a lower receive sensitivity than the AP and while it can't capture the packets from the client STA, the AP can receive them OK.
- B. The portable analyzer is too close to the AP causing CCI, blinding the AP to the client's packets
- C. There is a transmit power mismatch between the client and the AP and while the client can hear the Aps traffic, the AP cannot hear the client.
- D. The STA is transmitting data using more spatial streams than the potable analyzer can support
Answer: A
Explanation:
Receive sensitivity is the minimum signal level that a receiver can detect and decode. Different devices may have different receive sensitivity levels depending on their hardware specifications and antenna configurations. In this scenario, the portable analyzer has a lower receive sensitivity than the AP, meaning that it requires a stronger signal to capture the packets from the client STA.
The AP, on the other hand, has a higher receive sensitivity and can receive the packets from the client STA even if they have a weaker signal. This explains why the portable analyzer can only see unidirectional traffic from the AP to the client when capturing near the AP.
NEW QUESTION # 64
According to the 802.11n-2009 amendment, what security requirement is specified for HT BSSs?
- A. TKIP cannot be supported in an HT BSS.
- B. HT BSSs are prevented from supporting WEP.
- C. HT BSSs must mandatorily support 802.11r FT.
- D. In an RSN, HT stations may not communicate with one another using TKIP.
- E. All unicast traffic transmitted by an HT station and destined to an HT station must use AES- CCMP.
Answer: D
NEW QUESTION # 65
Which one of the following is not an 802.11 Management frame?
- A. Authentication
- B. Action
- C. PS-Poll
- D. Beacon
Answer: C
Explanation:
Explanation
A PS-Poll (Power Save Poll) frame is not an 802.11 management frame. A PS-Poll frame is a type of control frame that is used by a STA in power save mode to request data frames from an AP. A STA in power save mode can conserve battery power by periodically sleeping and waking up. When a STA sleeps, it cannot receive any data frames from the AP, so it informs the AP of its power save status by setting a bit in its MAC header. The AP then buffers any data frames destined for the sleeping STA until it wakes up. When a STA wakes up, it sends a PS-Poll frame to the AP, indicating its association ID and requesting any buffered data frames. The AP thenresponds with one or more data frames, followed by an ACK or BA frame from the STA.
The other options are not correct, as they are types of 802.11 management frames. An Action frame is used to perform various management actions, such as spectrum management, QoS management, radio measurement, etc. A Beacon frame is used to advertise the presence and capabilities of an AP or BSS. An Authentication frame is used to establish or terminate an authentication relationship between a STA and an AP. References: [Wireless Analysis Professional Study Guide CWAP-404], Chapter 6: 802.11 Frame Exchanges, page 169-170
NEW QUESTION # 66
When evaluating modulation and coding schemes, you must determine the best coding rate available.
In 802.11 MCS tables, what is the best coding rate from the perspective of highest data rates?
- A. 1/2
- B. 3/4
- C. 2/3
- D. 5/6
Answer: D
NEW QUESTION # 67
You are attempting to determine timing information within a packet capture of a WLAN protocol analyzer.
What time is used to display the time the packet was captured based on the system clock in the computer?
- A. Arrival
- B. Relative
- C. Delta
- D. Interframe
Answer: A
NEW QUESTION # 68
What is the difference between a Data frame and a QoS-Data frame?
- A. QoS Data frames include a QoS control field
- B. QoS Data frames include an 802.1Q VLAN tag
- C. QoS Data frames include a DSCP control field
- D. QoS Data frames include a QoS information element
Answer: A
Explanation:
The difference between a Data frame and a QoS-Data frame is that QoS Data frames include a QoS control field. A Data frame is a type of data frame that is used to carry user data or upper layer protocol data between STAs and APs. A QoS Data frame is a type of data frame that is used to carry user data or upper layer protocol data between STAs and APs that support QoS (Quality of Service) features. QoS features allow different types of traffic to be prioritized and handled differently according to their QoS requirements, such as delay, jitter, throughput, etc.
QoS Data frames include a QoS control field in their MAC header, which contains information such as traffic identifier (TID), queue size (TXOP), acknowledgment policy (ACK), etc., that are used for QoS purposes. The other options are not correct, as they do not describe the difference between Data and QoS Data frames.
QoS Data frames do not include a DSCP (Differentiated Services Code Point) control field, which is part of the IP header in the network layer, not the MAC header in the data link layer. QoS Data frames do not include a QoS information element (IE), which is part of some management frames that indicate QoS capabilities or parameters, not data frames. QoS Data frames do not include an
802.1Q VLAN tag, which is part of some Ethernet frames that indicate VLAN membership or priority, not wireless frames.
NEW QUESTION # 69
According to the IEEE 802.11 standard, what is one structural difference between a MAC Protocol Data Unit (MPDU) and a MAC Management Protocol Data Unit (MMPDU)?
- A. The MPDU frame's FCS field is 4 bytes, while the MMPDU frame's FCS field is 8 bytes.
- B. An MMPDU header may only contain three address fields, but an MPDU may have four address fields.
- C. The MMPDU frame body is limited to 300 bytes, whereas the MPDU frame body can carry up to
2304 bytes. - D. Both the MPDU and MMPDU have a QoS Control (QC) field, but all bits of the MMPDU's QC field are always 0.
- E. The MPDU header always places the BSSID in the first address field, but in the MMPDU the BSSID can be found in any of the address fields.
Answer: B
NEW QUESTION # 70
Which one of the these is the most important in the WLAN troubleshooting methodology among those listed?
- A. Observe the problem
- B. Obtain detailed knowledge of the wireless vendors debug and logging options
- C. Talk to the end users about their experiences
- D. Interview the network manager about the issues being experienced
Answer: A
Explanation:
Observing the problem is the most important step in the WLAN troubleshooting methodology among those listed. This step involves capturing and analyzing the relevant data from the wireless network, such as packets, frames, spectrum, and performance metrics. Observing the problem helps to verify the existence and scope of the issue, identify the root cause and possible solutions, and validate the results of any actions taken. The other steps are also important, but they are not as critical as observing the problem.
NEW QUESTION # 71
Several users have reported WLAN network connection issues and the users connect to the same AP. These users are spread throughout a 320 square meter area. Using a spectrum analyzer, you see RF energy across the entire 2.4 GHz band at significant signal strength levels.
The users all connect using either HT or ERP devices.
What is the likely cause of this problem within this area?
- A. Microwave oven
- B. Wide-band jammer
- C. Video camera
- D. Bluetooth devices
Answer: B
NEW QUESTION # 72
Why is a high CRC error rate in L2 protocol analysis software NOT always a valid indicator of network performance? (Choose 3)
- A. If the protocol analysis radio hardware is not located in the same area as intended client devices or APs, its data sampling may not be representative of actual traffic on the network.
- B. If protocol analysis software is not properly configured with frame decryption parameters, it can't accurately calculate a CRC, which includes the encrypted frame body contents.
- C. Radio and antenna hardware used for protocol analysis may not match the receive sensitivity, diversity, MIMO, or antenna gain capabilities of the network WLAN hardware.
- D. Layer 2 protocol analysis can only collect and interpret data that is received properly at the MAC layer, and cannot quantify some PHY-layer problems.
Answer: A,C,D
NEW QUESTION # 73
The network administrator at ABC Engineering has taken a large packet capture from one of their APs running in monitor mode. She has very little knowledge of 802.11 protocols but would like to use the capture file to evaluate the overall health and performance of their wireless network.
When she asks your advice, which tool do you recommend she opens the packet capture file with?
- A. Python
- B. WLAN scanner
- C. Capture visualization tool
- D. Spectrum analyzer
Answer: C
Explanation:
A capture visualization tool is a software application that can open a packet capture file and display various graphs, charts, tables, and statistics that illustrate the characteristics and behavior of the wireless network. A capture visualization tool can help a network administrator with little knowledge of 802.11 protocols to evaluate the overall health and performance of their wireless network by providing a visual and intuitive representation of the captured data. A spectrum analyzer is a hardware device that measures the radio frequency signals in a given frequency range and displays their amplitude, frequency, and modulation. A spectrum analyzer can help identify sources of interference and noise in the wireless environment, but it cannot open a packet capture file. Python is a programming language that can be used to write scripts or applications that manipulate or analyze packet capture files, but it requires coding skills and knowledge of
802.11 protocols. A WLAN scanner is a software application that scans for available wireless networks and displays information such as SSID, BSSID, channel, signal strength, security type, and vendor. A WLAN scanner can help discover wireless networks and their basic parameters, but it cannot open a packet capture file.
NEW QUESTION # 74
When would you expect to see a Reassociation Request frame'
- A. Only when a STA roams back to an AP it has previously been associated with
- B. Every time a STA associates to an AP to which it has previously been associated
- C. Only when a STA is using FT roaming
- D. Every time a STA roams
Answer: D
Explanation:
Explanation
A Reassociation Request frame is sent every time a STA roams from one AP to another within the same ESS.
A Reassociation Request frame is similar to an Association Request frame, but it also contains the BSSID of the current AP that the STA is leaving. This allows the new AP to coordinate with the old AP and transfer the STA's context information, such as security keys, QoS parameters, and buffered frames. This way, the STA can maintain its connectivity and session continuity during roaming . References: CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 195;CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 196.
NEW QUESTION # 75
......
Get up-to-date Real Exam Questions for CWAP-404: https://www.testkingpass.com/CWAP-404-testking-dumps.html
Pass CWAP-404 Exam Latest Practice Questions: https://drive.google.com/open?id=1glrfvE3-ngKlR4F8H8ibEmHtEWHpvXI9