CWAP-405 Exam Questions Get Updated [2026] with Correct Answers [Q30-Q47]

NO.30 Which piece of information is not transmitted in an HT PPDU header?

Number of Spatial Streams

PPDU length

MCS index

Channel number

NO.31 When evaluating modulation and coding schemes, you must determine the best coding rate available. In
802.11 MCS tables, what is the best coding rate from the perspective of highest data rates?

5/6

3/4

2/3

1/2

NO.32 You have captured 802.11 traffic using an adapter that includes the radio tap header. You see several frames often called announcement frames in the capture.
What best describes these types of frames?

They only include beacon and probe request frames

They are used to allow a STA to awake from sleep and for no other reason

They only include beacon and probe response frames

They are meant to provide information to the network that may result in state changes, but they are not open for rejection

NO.33 Which one of the following is not an 802.11 Management frame?

PS-Poll

Action

Beacon

Authentication

NO.34 You are using a laptop-based protocol analyzer to scan all channels and determine the basic configuration of the WLAN Basic Service Set in your facility. You are scanning all channels. All configured with default settings.
What can you change to cause the scan to run faster while still APs are capturing beacon frames on all the channels?

Configure the RBW to more than 120 kHz

Configure the scan time for channels to 300-500 ms

Configure the fragmentation threshold to 1500 bytes

Configure the scan time for channels to <100 ms

NO.35 How many frames make up the Group Key Handshake excluding any Ack frames that may be required?

1

2

3

4

NO.36 You work as an SE for a value-added reseller. A client has an existing deployment of 802.11n Aps and wants to upgrade several BSSs to 802.11ac.
What hardware feature of some enterprise Aps may allow for this without a forklift upgrade?

Adding an 802.11ac module to the existing APs

Simply check the Enable 802.11ac checkbox in the web-based configuration interface

Replace the antennas with 802.11ac antennas

Converting the 802.11n radio to an 802.11ac radio through software

NO.37 Which one of the following portions of information is communicated by bits in the PHY Header?

SNR

Noise

Data rate

Signal strength

NO.38 You are concerned with management overhead in your WLAN. When evaluating the network, you note that each dual-band AP provides for 4 SSIDs in each band with three secure SSIDs and one Open System SSID.
The network runs only 802.11ac APs and uses 20 MHz channels in 2.4 GHz and 400 MHz channels in 5 GHz.
What can you do to reduce the impact of beacon frames on CCI and channel utilization?

Increase the beacon interval

Use only 40 MHz channels

Use the same security across all SSIDs

Disable SSID broadcasting

NO.39 ABC International has installed a new smart ZigBee controlled lighting system. However, the network team is concerned that this new system will interfere with the existing WLAN and has asked you to investigate the impact of the two systems operating simultaneously in the 2.4 GHz band. When performing Spectrum Analysis, which question could you answer by looking at the FFT plot?

Do the ZigBee channels used by the lighting system overlap with the WLAN channels?

Is the ZigBee system using more than 50% of the available airtime?

Is the WLAN corrupting ZigBee system messages?

Is the ZigBee system causing an increase in WLAN retries?

NO.40 You require 802.11ac capture solution. You want to capture using native operating system tools if possible.
What operating system has built-in ability to capture 802.11ac frames assuming it is running on the appropriate laptop hardware?

Windows 10

Mac OS X

Windows 7

Windows 8.1

NO.41 A PHY Header is added to the PSDU at which layer?

LLC

Network

PHY

MAC

NO.42 How many frames are exchanged for 802.11 authentication in the 6 GHz band when WPA3-Enterprise is not used, and a passphrase is used instead?

1

2

3

4

Two frames are exchanged for 802.11 authentication in the 6 GHz band when WPA3-Enterprise is not used, and a passphrase is used instead. Authentication is a process that establishes an identity relationship between a STA (station) and an AP (access point) before joining a BSS (Basic Service Set). There are two types of authentication methods defined by 802.11: Open System Authentication and Shared Key Authentication.
Open System Authentication does not require any credentials or security information from a STA to join a BSS, and it consists of two frames: an Authentication Request frame sent by the STA to the AP, and an Authentication Response frame sent by the AP to the STA. Shared Key Authentication requires a shared secret key from a STA to join a BSS, and it consists of four frames: two challenge-response frames in addition to the request-response frames. However, Shared Key Authentication uses WEP (Wired Equivalent Privacy) as its encryption algorithm, which is insecure and deprecated. In the 6 GHz band, which is a newly available frequency band for WLANs, Shared Key Authentication is prohibited by the 802.11 standard, as it poses security and interference risks for other users and services in the band. The 6 GHz band requires all WLANs to use WPA3-Personal or WPA3-Enterprise encryption methods, which are more secure and robust than previous encryption methods such as WPA2 or WEP. WPA3-Personal uses a passphrase to derive a PMK (Pairwise Master Key), while WPA3-Enterprise uses an authentication server to obtain a PMK. Both methods use SAE (Simultaneous Authentication of Equals) as their authentication protocol, which replaces PSK (Pre- Shared Key) or EAP (Extensible Authentication Protocol). SAE consists of two frames: an SAE Commit frame sent by both parties to exchange elliptic curve parameters and nonces, and an SAE Confirm frame sent by both parties to verify each other’s identities and generate a PMK. Therefore, when WPA3-Enterprise is not used, and a passphrase is used instead in the 6 GHz band, only two frames are exchanged for 802.11 authentication: an SAE Commit frame and an SAE Confirm frame. References: [Wireless Analysis Professional Study Guide CWAP-405], Chapter 8: Security Analysis, page 220-221

NO.43 What is the function of 802.11 Management frames?

Prioritize network administration traffic

Communicate configuration changes between WLAN controller and APs

Manage the BSS

Manage the flow of data

NO.44 Recently, three rogue APs have been connected to the network and later discovered. You want to prevent future rogue AP installations as much as possible.
What is the first step to eliminating or reducing rogue APs on the network?

Use IPSec between every AP and the network infrastructure

Define a direct policy that stipulates the ramifications of installing unauthorized devices

Create a hash of the MAC addresses of all authorized devices and continually scan for non-matching hashes

Enable rogue detection in the existing authorized APs

NO.45 Which one of the following is an advantage of using display filters that is not an advantage of capture-time filters?

They allow for focused analysis on just the packets of interest

Once created they are reusable for later captures

They only hide the packets from view and the filtered packets can be enabled for view later

Multiple of them can be applied simultaneously

NO.46 ABC Company requires the ability to identify and quickly locate rogue devices. ABC has chosen an overlay WIPS solution with Wi-Fi sensors that use dipole antennas to perform this task. No other sensors are included. Use your knowledge of location tracking techniques to answer the question.
Which one of the following location methods is not available in the described system?

GPS Positioning

Time Difference of Arrival (TDoA)

RF Fingerprinting

Trilateration of RSSI measurements

NO.47 As a wireless network consultant you have been called in to troubleshoot a high-priority issue for one of your customers. The customer’s office is based on two floors within a multi-tenant office block. On one of these floors (floor 5) users cannot connect to the wireless network. During their own testing the customer has discovered that users can connect on floor 6 but not when they move to the floor 5. This issue is affecting all users on floor 5 and having a negative effect on productivity.
To troubleshoot this issue, you perform both Spectrum and Protocol Analysis. The Spectrum Analysis shows the presence of Bluetooth signals which you have identified as coming from wireless mice. In the protocol analyzer you see the top frame on the network is Deauthentication frames. On closer investigation you see that the Deauthentication frames’ source addresses match the BSSIDs of your customers APs and the destination address is FF:FF:FF:FF:FF:FF:FF.
What do you conclude from this troubleshooting exercise?

The customer should replace all their Bluetooth wireless mice as they are stopping the users on floor 5 from connecting to the wireless network

The users on floor 5 are being subjected to a denial of service attack, as this is happening across the entire floor it is likely to be a misconfigured WIPS solution belonging to the tenants on the floor below

The customers APs are misbehaving and a technical support case should be open with the vendor

The CCI from the APs on the floor 4 is the problem and you need to ask the tenant below to turn down their APs Tx power

Leave a Reply Cancel reply