CWNP Certified wireless analusis professional(cwap) Sample Questions:

1. When using a protocol analyzer to capture conversations over a wireless LAN, you may often see that the traffic is encrypted. Most wireless LAN protocol analyzers have a feature that allows the analyst to save and reload the captured frames into memory at a later time.
Using this functionality, what tasks can be performed?

A) An analyst can search through the captured frames looking for a RADIUS EAPoL frames that will disclose the user password.
B) If a user name and password for an 802.1X/EAP-TTLS security implementation can be obtained through social engineering tactics, the user name and password can be entered into the analyzer to decrypt the frames from a saved trace file.
C) Encrypted frames may be decrypted offline, after they are captured, by entering a WEP key or WPA-PSK passphrase into the analyzer.
D) When 802.1X/EAP-MD5 is being used as the wireless LAN security mechanism, the authentication response frame can be replayed from a saved trace file at a later time to successfully authenticate a hacker.

2. Given the 802.11 frame decode shown, which of the following statements are true.

A) The MSDU was successfully encrypted with WEP
B) The frame in the decode is an MMPDU.
C) The frame is a layer 2 broadcast.
D) The frame is the last fragment in a sequence of 3 fragments.
E) The 44 ec duration value is sufficient to cover the SIFS and ACK to follow

3. Some protocol analyzers have the ability to capture only MAC frame headers (sometimes called packet slicing), and others have the ability to update the capture display without saving the frames permanently (sometimes called stumbling mode). What are advantages of using these two features of a wireless protocol analyzer?

A) Analyzers can use DRAM to store captured frames instead of storing files on a hard drive.
B) Analyzers can be left running for long periods of time without running out of frame buffer space.
C) Analyzers can capture traffic on more channels simultaneously due to decreased overhead per channel.
D) Analyzers with a small amount of frame buffer memory can be used.
E) Capturing, analyzing, and discarding headers allows more CPU cycles for real-time decoding and analysis.

4. Referencing this decode of an 802.11b frame, choose the statement that could be true.

A) This frame was sent from one access point to another access point along a wireless distribution system.
B) This frame was the first fragment in a series of 3 fragments (as part of a fragment burst) sent from a wireless client station to a station on the wired network.
C) This frame was sent from a wireless client station to request information about BSSs within range.
D) This frame was sent to a wireless client station from a node on the wired segment and WEP was not used.
E) This frame was sent from a wireless client station to an access point for the purpose of managing the access point's configuration.

5. Given the 802.11 frame decode shown, which of the following statements are true.

A) No mobile stations in this BSS have traffic queued at the access point
B) The TIM is also a DTIM
C) This screenshot was taken from a Probe Response frame.
D) This screenshot was captured in an Ad Hoc (IBSS) network
E) The Beacon Interval is 100 milliseconds

Solutions: