[2026] CWSP-208 Answers CWSP-208 Free Demo Are Based On The Real Exam
CWSP-208 [Apr-2026 Newly Released] Exam Questions For You To Pass
CWNP CWSP-208 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 46
Given: A WLAN consultant has just finished installing a WLAN controller with 15 controller-based APs.
Two SSIDs with separate VLANs are configured for this network, and both VLANs are configured to use the same RADIUS server. The SSIDs are configured as follows:
SSID Blue - VLAN 10 - Lightweight EAP (LEAP) authentication - CCMP cipher suite SSID Red - VLAN 20 - PEAPv0/EAP-TLS authentication - TKIP cipher suite The consultant's computer can successfully authenticate and browse the Internet when using the Blue SSID.
The same computer cannot authenticate when using the Red SSID.
What is a possible cause of the problem?
- A. The consultant does not have a valid Kerberos ID on the Blue VLAN.
- B. The Red VLAN does not use server certificate, but the client requires one.
- C. The client does not have a proper certificate installed for the tunneled authentication within the established TLS tunnel.
- D. The TKIP cipher suite is not a valid option for PEAPv0 authentication.
Answer: C
Explanation:
PEAPv0/EAP-TLS is a tunneled EAP method that requires:
The server to present a certificate for TLS tunnel establishment.
The client to present a valid client certificate within the tunnel (in the case of EAP-TLS).
If the client does not have a valid X.509 certificate installed, authentication will fail.
Incorrect:
A). The server certificate is required for the TLS tunnel, and it is typically present; the issue here lies with the client cert.
B). TKIP is technically compatible with PEAPv0, although AES-CCMP is preferred.
D). Kerberos is unrelated to EAP authentication and VLAN use.
References:
CWSP-208 Study Guide, Chapter 4 (PEAP and EAP-TLS Authentication)
IEEE 802.1X and TLS Frameworks
NEW QUESTION # 47
Given: In a security penetration exercise, a WLAN consultant obtains the WEP key of XYZ Corporation's wireless network. Demonstrating the vulnerabilities of using WEP, the consultant uses a laptop running a software AP in an attempt to hijack the authorized user's connections. XYZ's legacy network is using 802.11 n APs with 802.11b, 11g, and 11n client devices.
With this setup, how can the consultant cause all of the authorized clients to establish Layer 2 connectivity with the software access point?
- A. A higher SSID priority value configured in the Beacon frames of the consultant's software AP will take priority over the SSID in the authorized AP, causing the clients to reassociate.
- B. If the consultant's software AP broadcasts Beacon frames that advertise 802.11g data rates that are faster rates than XYZ's current 802.11b data rates, all WLAN clients will reassociate to the faster AP.
- C. When the RF signal between the clients and the authorized AP is temporarily disrupted and the consultant's software AP is using the same SSID on a different channel than the authorized AP, the clients will reassociate to the software AP.
- D. All WLAN clients will reassociate to the consultant's software AP if the consultant's software AP provides the same SSID on any channel with a 10 dB SNR improvement over the authorized AP.
Answer: C
Explanation:
Clients seek connectivity when their connection is lost. If the attacker broadcasts a matching SSID on a different channel and the client is disconnected (via RF jamming or deauthentication), the client will often reassociate with the stronger signal or first-responding AP broadcasting the same SSID, even if it's rogue.
Incorrect:
A). SNR alone doesn't force reassociation-clients consider multiple factors.
B). SSID priority is not a standardized field influencing client behavior.
D). Clients won't reassociate based purely on advertised data rates unless connectivity is disrupted and other AP parameters are more attractive.
References:
CWSP-208 Study Guide, Chapter 5 (Hijacking and Evil Twin Attacks)
CWNP Roaming Behavior and Signal Loss Analysis
IEEE 802.11-2016 Standard (Association and Reassociation Behavior)
NEW QUESTION # 48
Given: The Aircrack-ng WLAN software tool can capture and transmit modified 802.11 frames over the wireless network. It comes pre-installed on Kali Linux and some other Linux distributions.
What are three uses for such a tool? (Choose 3)
- A. Auditing the configuration and functionality of a WIPS by simulating common attack sequences
- B. Transmitting a deauthentication frame to disconnect a user from the AP.
- C. Probing the RADIUS server and authenticator to expose the RADIUS shared secret
- D. Cracking the authentication or encryption processes implemented poorly in some WLANs
Answer: A,B,D
Explanation:
Aircrack-ng is a versatile toolset commonly used for WLAN penetration testing and security auditing. Its capabilities include:
A). Injecting deauth frames to simulate or test disconnection scenarios.
B). Testing WIPS responsiveness by simulating common attack frames.
D). Performing dictionary and brute-force attacks against weakly protected networks (e.g., WPA2-PSK with a weak passphrase).
Incorrect:
C). Aircrack-ng does not probe or test RADIUS shared secrets.
References:
CWSP-208 Study Guide, Chapter 7 (Tools and Wireless Attacks)
Aircrack-ng Documentation (https://www.aircrack-ng.org/)
CWNP Attack Simulation Labs
NEW QUESTION # 49
Given: XYZ Company has recently installed a controller-based WLAN and is using a RADIUS server to query authentication requests to an LDAP server. XYZ maintains user-based access policies and would like to use the RADIUS server to facilitate network authorization.
What RADIUS features could be used by XYZ to assign the proper network permissions to users during authentication? (Choose 2)
- A. RADIUS can send a DO-NOT-AUTHORIZE demand to the authenticator to prevent the STA from gaining access to specific files, but may only employ this in relation to Linux servers.
- B. RADIUS attributes can be used to assign permission levels, such as read-only permission, to users of a particular network resource.
- C. RADIUS can reassign a client's 802.11 association to a new SSID by referencing a username-to-SSID mapping table in the LDAP user database.
- D. The RADIUS server can support vendor-specific attributes in the ACCESS-ACCEPT response, which can be used for user policy assignment.
- E. The RADIUS server can communicate with the DHCP server to issue the appropriate IP address and VLAN assignment to users.
Answer: B,D
Explanation:
Comprehensive Detailed Explanation:
B). Vendor-Specific Attributes (VSAs) allow integration with WLAN vendors' controllers to assign roles, VLANs, QoS levels, etc., during user authentication.
E). Standard or vendor-specific RADIUS attributes can dynamically assign permission levels based on group membership, department, or role.
Incorrect:
A). RADIUS does not directly manage DHCP functions.
C). SSID is selected by the user's device, not by the RADIUS server.
D). RADIUS uses ACCESS-REJECT, not "DO-NOT-AUTHORIZE," and it is not OS-specific.
References:
CWSP-208 Study Guide, Chapter 4 (RADIUS and Policy Assignment)
CWNP RADIUS Deployment Best Practices
NEW QUESTION # 50
Which of the following security attacks cannot be detected by a WIPS solution of any kind? (Choose 2)
- A. Social engineering
- B. Rogue APs
- C. DoS
- D. Eavesdropping
Answer: A,D
Explanation:
Wireless Intrusion Prevention Systems (WIPS) are excellent for detecting on-air threats such as rogue APs, DoS attacks, spoofing, and misconfigured devices. However, WIPS cannot detect:
C). Eavesdropping - Passive listening on wireless transmissions cannot be detected because no signal is transmitted by the attacker.
D). Social engineering - Human-based attacks like phishing or pretexting fall outside the scope of wireless monitoring.
Incorrect:
A). Rogue APs can be detected via MAC address comparison, frame analysis, and signal triangulation.
B). DoS attacks, such as deauth floods or RF jamming, can be detected with appropriate WIPS sensors.
References:
CWSP-208 Study Guide, Chapter 5 (WLAN Threats and Attacks)
CWNP WIPS Implementation Guidelines
CWNP Whitepapers on Wireless Threat Detection Capabilities
NEW QUESTION # 51
Given: Many computer users connect to the Internet at airports, which often have 802.11n access points with a captive portal for authentication.
While using an airport hot-spot with this security solution, to what type of wireless attack is a user susceptible? (Choose 2)
- A. Wi-Fi phishing
- B. IGMP snooping
- C. UDP port redirection
- D. Man-in-the-Middle
- E. Management interface exploits
Answer: A,D
Explanation:
Open networks with captive portals do not provide link-layer encryption, so:
A). Man-in-the-Middle (MitM): Attackers can intercept or modify traffic between the user and the legitimate network (especially before HTTPS negotiation).
B). Wi-Fi phishing: Evil twin APs may mimic the legitimate hotspot and show a fake captive portal, stealing user credentials or prompting malicious downloads.
Incorrect:
C). Management interface exploits target device admin panels, not typical client users.
D). UDP port redirection and
E). IGMP snooping are network-layer behaviors, not common user-targeted attacks.
References:
CWSP-208 Study Guide, Chapter 5 (Hotspot Vulnerabilities)
CWNP Wi-Fi Phishing and Evil Twin Defense Strategies
NEW QUESTION # 52
Given: You have a Windows laptop computer with an integrated, dual-band, Wi-Fi compliant adapter. Your laptop computer has protocol analyzer software installed that is capable of capturing and decoding 802.11ac data.
What statement best describes the likely ability to capture 802.11ac frames for security testing purposes?
- A. The only method available to capture 802.11ac frames is to perform a remote capture with a compatible access point.
- B. Laptops cannot be used to capture 802.11ac frames because they do not support MU-MIMO.
- C. All integrated 802.11ac adapters will work with most protocol analyzers for frame capture, including the Radio Tap Header.
- D. Integrated 802.11ac adapters are not typically compatible with protocol analyzers in Windows laptops.
It is often best to use a USB adapter or carefully select a laptop with an integrated adapter that will work. - E. Only Wireshark can be used to capture 802.11ac frames as no other protocol analyzer has implemented the proper frame decodes.
Answer: D
Explanation:
Most integrated Wi-Fi adapters in Windows laptops are not capable of entering "monitor mode" or capturing
802.11ac frames properly. Compatibility with protocol analyzers like Wireshark or Omnipeek requires special drivers or specific USB adapters. Therefore, it is recommended to use a USB adapter known to support monitor mode and frame capture on 802.11ac for accurate and complete data capture.
Incorrect:
A). Not all adapters support protocol analyzer features.
C). MU-MIMO support is irrelevant for frame capture.
D). Other analyzers besides Wireshark can decode 802.11ac (e.g., Omnipeek).
E). Remote capture is not the only method-local USB adapters are effective too.
References:
CWSP-208 Study Guide, Chapter 7 (WLAN Analysis Tools)
CWNP Protocol Analyzer Guide
Vendor documentation: Riverbed, Omnipeek, Wireshark Adapter Support Lists
NEW QUESTION # 53
Given: The ABC Corporation currently utilizes an enterprise Public Key Infrastructure (PKI) to allow employees to securely access network resources with smart cards. The new wireless network will use WPA2- Enterprise as its primary authentication solution. You have been asked to recommend a Wi-Fi Alliance-tested EAP method.
What solutions will require the least change in how users are currently authenticated and still integrate with their existing PKI?
- A. EAP-TLS
- B. LEAP
- C. EAP-FAST
- D. EAP-TTLS/MSCHAPv2
- E. PEAPv0/EAP-TLS
- F. PEAPv0/EAP-MSCHAPv2
Answer: A
Explanation:
ABC Corporation already uses PKI and smart cards. EAP-TLS:
Is a certificate-based authentication protocol.
Integrates seamlessly with PKI infrastructure.
Is supported and certified by the Wi-Fi Alliance.
Incorrect:
A). EAP-FAST uses PACs, not certificates.
C). PEAPv0/EAP-MSCHAPv2 does not use certificates on the client side and is less secure.
D). LEAP is deprecated and insecure.
E). PEAPv0/EAP-TLS is not a standardized combination.
F). EAP-TTLS/MSCHAPv2 requires password-based authentication inside a tunnel, not certificate-based authentication.
References:
CWSP-208 Study Guide, Chapter 4 (EAP-TLS and PKI)
CWNP WPA2-Enterprise Integration Guidelines
NEW QUESTION # 54
What policy would help mitigate the impact of peer-to-peer attacks against wireless-enabled corporate laptop computers when the laptops are also used on public access networks such as wireless hot-spots?
- A. Require Port Address Translation (PAT) on each laptop.
- B. Require WPA2-Enterprise as the minimal WLAN security solution.
- C. Require secure applications such as POP, HTTP, and SSH.
- D. Require VPN software for connectivity to the corporate network.
Answer: D
Explanation:
EAP-TLS requires both server and client-side digital certificates, which adds complexity in client certificate management.
EAP-TTLS uses a server certificate to establish a secure TLS tunnel, after which user credentials (e.g., username/password) are sent inside the encrypted tunnel. No client certificate is needed.
Incorrect:
A). EAP-TLS also encrypts credentials using TLS.
B). EAP-TLS supports client certificates (it's the core requirement).
C). Both EAP methods require an authentication server.
References:
CWSP-208 Study Guide, Chapter 4 (EAP Methods Comparison)
CWNP EAP-TTLS Deployment Guide
NEW QUESTION # 55
The IEEE 802.11 standard defined Open System authentication as consisting of two auth frames and two assoc frames. In a WPA2-Enterprise network, what process immediately follows the 802.11 association procedure?
- A. RADIUS shared secret lookup
- B. 802.1X/EAP authentication
- C. 4-Way Handshake
- D. Group Key Handshake
- E. Passphrase-to-PSK mapping
- F. DHCP Discovery
Answer: B
Explanation:
In WPA2-Enterprise:
After successful Open System authentication and 802.11 association, the next step is 802.1X/EAP authentication via EAPOL frames.
This phase establishes user identity and derives the PMK.
Incorrect:
A). Group Key Handshake comes after the 4-Way Handshake.
C). DHCP occurs after authentication and key negotiation.
D). 4-Way Handshake follows successful 802.1X authentication.
E). PSK mapping applies to WPA2-Personal, not Enterprise.
F). The RADIUS shared secret is pre-configured between authenticator and RADIUS server-not part of real- time negotiation.
References:
CWSP-208 Study Guide, Chapter 3 (Authentication and Association Flowchart) IEEE 802.11-2012 Standard
NEW QUESTION # 56
What security vulnerabilities may result from a lack of staging, change management, and installation procedures for WLAN infrastructure equipment? (Choose 2)
- A. Authentication cracking of 64-bit Hex WPA-Personal PSK
- B. Management interface exploits due to the use of default usernames and passwords for AP management
- C. WIPS may not classify authorized, rogue, and neighbor APs accurately
- D. The WLAN system may be open to RF Denial-of-Service attacks
- E. AES-CCMP encryption keys may be decrypted
Answer: B,C
Explanation:
Without proper staging, change management, and installation procedures, significant vulnerabilities may arise:
(B) WIPS relies on a known database of authorized APs and clients. If devices are deployed without proper registration and staging, WIPS cannot accurately classify devices as authorized, rogue, or neighbor.
(D) If APs are installed without changing default credentials, attackers can exploit them through common web or SNMP-based management interfaces.
This undermines both operational visibility and network security posture.
References:
CWSP-208 Study Guide, Chapter 8 - WLAN Security Design and Architecture CWNP CWSP-208 Official Objectives: "Security Design and Policy Implementation"
NEW QUESTION # 57
The IEEE 802.11 Pairwise Transient Key (PTK) is derived from what cryptographic element?
- A. Group Master Key (GMK)
- B. Pairwise Master Key (PMK)
- C. Group Temporal Key (GTK)
- D. Key Confirmation Key (KCK)
- E. Phase Shift Key (PSK)
- F. PeerKey (PK)
Answer: B
Explanation:
The PTK (Pairwise Transient Key) is derived during the 4-Way Handshake using:
PMK (from PSK or EAP authentication)
ANonce and SNonce (nonces from authenticator and supplicant)
MAC addresses of client and AP
The PTK is then split into keys used for encryption and integrity protection.
Incorrect:
A). PSK can derive the PMK, but not the PTK directly.
B). GMK is used to derive the GTK, not PTK.
D). GTK is for group traffic encryption.
E & F. PK and KCK are components of PTK or alternate key usage-not used to derive PTK.
References:
CWSP-208 Study Guide, Chapter 3 (PTK Derivation and Usage)
IEEE 802.11i-2004 Key Hierarchy
NEW QUESTION # 58
Which one of the following describes the correct hierarchy of 802.1X authentication key derivation?
- A. The MSK is generated from the 802.1X/EAP authentication. The PMK is derived from the MSK. The PTK is derived from the PMK, and the keys used for actual data encryption are a part of the PTK.
- B. If passphrase-based client authentication is used by the EAP type, the PMK is mapped directly from the user's passphrase. The PMK is then used during the 4-way handshake to create data encryption keys.
- C. The PMK is generated from a successful mutual EAP authentication. When mutual authentication is not used, an MSK is created. Either of these two keys may be used to derive the temporal data encryption keys during the 4-way handshake.
- D. After successful EAP authentication, the RADIUS server generates a PMK. A separate key, the MSK, is derived from the AAA key and is hashed with the PMK to create the PTK and GTK.
Answer: A
Explanation:
In 802.1X/EAP authentication:
The EAP method (e.g., EAP-TLS, PEAP) results in the generation of a Master Session Key (MSK).
The Pairwise Master Key (PMK) is derived from the MSK.
The Pairwise Transient Key (PTK) is derived from the PMK using nonces and MAC addresses during the 4- Way Handshake.
The PTK includes the actual keys used for data encryption.
Incorrect:
B). This applies to WPA/WPA2-Personal, not 802.1X/EAP.
C). The RADIUS server sends the MSK, not the PMK directly.
D). The MSK is always derived during EAP authentication, mutual or not.
References:
CWSP-208 Study Guide, Chapter 3 (Key Hierarchy)
IEEE 802.11i Specification
NEW QUESTION # 59
When monitoring APs within a LAN using a Wireless Network Management System (WNMS), what secure protocol may be used by the WNMS to issue configuration changes to APs?
- A. SNMPv3
- B. TFTP
- C. 802.1X/EAP
- D. IPSec/ESP
- E. PPTP
Answer: A
Explanation:
A Wireless Network Management System (WNMS) often uses SNMP to manage APs. SNMPv3 is the secure version of SNMP because it supports authentication, encryption, and message integrity. Unlike SNMPv1 and SNMPv2c, which transmit data (including community strings) in plaintext, SNMPv3 provides secure management communications.
References:
CWSP-208 Study Guide, Chapter 8 - Secure WLAN Management
CWNP CWSP-208 Objectives: "WLAN Management Security Protocols"
NEW QUESTION # 60
Given: ABC Corporation is evaluating the security solution for their existing WLAN. Two of their supported solutions include a PPTP VPN and 802.1X/LEAP. They have used PPTP VPNs because of their wide support in server and desktop operating systems. While both PPTP and LEAP adhere to the minimum requirements of the corporate security policy, some individuals have raised concerns about MS-CHAPv2 (and similar) authentication and the known fact that MS-CHAPv2 has proven vulnerable in improper implementations.
As a consultant, what do you tell ABC Corporation about implementing MS-CHAPv2 authentication?
(Choose 2)
- A. When implemented with AES-CCMP encryption, MS-CHAPv2 is very secure.
- B. MS-CHAPv2 is subject to offline dictionary attacks.
- C. MS-CHAPv2 is only appropriate for WLAN security when used inside a TLS-encrypted tunnel.
- D. LEAP's use of MS-CHAPv2 is only secure when combined with WEP.
- E. MS-CHAPv2 uses AES authentication, and is therefore secure.
- F. MS-CHAPv2 is compliant with WPA-Personal, but not WPA2-Enterprise.
Answer: B,C
Explanation:
MS-CHAPv2 is a widely used authentication protocol, but it has notable weaknesses:
B). MS-CHAPv2 is vulnerable to offline dictionary attacks. Attackers can capture authentication exchanges and attempt password guesses offline due to predictable hashing behavior.
D). The only secure use of MS-CHAPv2 is inside a secure tunnel (e.g., EAP-TTLS or PEAP), where credentials are protected during transmission.
Incorrect:
A). MS-CHAPv2 is used in WPA2-Enterprise, not WPA-Personal, and it is allowed under WPA2-Enterprise via PEAP.
C). WEP does not enhance LEAP's security; it compounds vulnerabilities.
E and F. MS-CHAPv2 does not use AES for authentication. Using AES-CCMP for encryption does not fix MS-CHAPv2's weaknesses.
References:
CWSP-208 Study Guide, Chapter 4 (EAP Methods and Authentication Protocols) CWNP MS-CHAPv2 and PEAP Implementation Guidelines Microsoft MS-CHAPv2 Vulnerability Advisories
NEW QUESTION # 61
Wireless Intrusion Prevention Systems (WIPS) are used for what purposes? (Choose 3)
- A. Preventing physical carrier sense attacks
- B. Performance monitoring and troubleshooting
- C. Classifying wired client devices
- D. Enforcing wireless network security policy
- E. Detecting and defending against eavesdropping attacks
- F. Security monitoring and notification
Answer: B,D,F
Explanation:
WIPS provides multiple functionalities:
B). Policy enforcement - detects and responds to wireless threats such as rogue APs and misconfigurations.
D). Security monitoring - alerts staff when threats like deauth attacks or malware-hosting APs are detected.
A). Performance monitoring - supports diagnostics by capturing information on channel conditions, interference, and device behavior.
Incorrect options:
C). Detecting eavesdropping isn't feasible-passive listening cannot be identified by sensors.
E). Carrier sense DoS and F. Wired device classification are outside WIPS's scope.
References:
CWSP#207 Study Guide, Chapters 5-6 (WIPS Capabilities)
NEW QUESTION # 62
Given: A WLAN protocol analyzer trace reveals the following sequence of frames (excluding the ACK frames):
1) 802.11 Probe Req and 802.11 Probe Rsp
2) 802.11 Auth and then another 802.11 Auth
3) 802.11 Assoc Req and 802.11 Assoc Rsp
4) EAPOL-KEY
5) EAPOL-KEY
6) EAPOL-KEY
7) EAPOL-KEY
What security mechanism is being used on the WLAN?
- A. WEP-128
- B. WPA-Enterprise
- C. EAP-TLS
- D. WPA2-Personal
- E. 802.1X/LEAP
Answer: D
Explanation:
The key clue in this sequence is the four EAPOL-Key frames, which indicate a 4-way handshake - a hallmark of WPA and WPA2 authentication processes. There is no EAP exchange preceding the 4-way handshake, which eliminates WPA/WPA2-Enterprise and 802.1X/EAP methods. This points directly to WPA2-Personal, where PSK (Pre-Shared Key) is used and there is no EAP exchange before key generation.
Also, the second "Auth" frame suggests Open System Authentication was used, which is typical for RSN- based networks (not Shared Key as in WEP).
References:
CWSP-208 Study Guide, Chapter 6 - Frame Analysis and 4-Way Handshake
CWNP CWSP-208 Objectives: "Identify WPA/WPA2 Operation from Frame Traces"
NEW QUESTION # 63
Given: A network security auditor is preparing to perform a comprehensive assessment of an 802.11ac network's security.
What task should be performed at the beginning of the audit to maximize the auditor's ability to expose network vulnerabilities?
- A. Identify the manufacturer of the wireless intrusion prevention system.
- B. Identify the IP subnet information for each network segment.
- C. Identify the wireless security solution(s) currently in use.
- D. Identify the skill level of the wireless network security administrator(s).
- E. Identify the manufacturer of the wireless infrastructure hardware.
Answer: C
Explanation:
Before conducting a security audit of an 802.11ac WLAN, it is essential to know the current security implementations-such as the use of WPA2-Enterprise, 802.1X, or MAC filtering. This helps the auditor tailor tests to identify gaps, weaknesses, or misconfigurations in the existing system. Understanding the security solutions provides the most immediate insight into potential vulnerabilities.
NEW QUESTION # 64
You are implementing a wireless LAN that will be used by point-of-sale (PoS) systems in a retail environment. Thirteen PoS computers will be installed. To what industry requirement should you ensure you adhere?
- A. HIPAA
- B. PCI-DSS
- C. Directive 8500.01
- D. ISA99
Answer: B
Explanation:
PCI-DSS (Payment Card Industry Data Security Standard) applies to all entities that process, store, or transmit credit card data. Since Point-of-Sale (PoS) systems handle such transactions in retail environments, the wireless network supporting them must comply with PCI-DSS. This includes encrypting wireless transmissions, segmenting network traffic, and implementing WIPS for rogue detection and logging.
References:
CWSP-208 Study Guide, Chapter 3 - WLAN Policy & Regulatory Compliance
CWNP CWSP-208 Objectives: "Industry Standards & Compliance (e.g., PCI-DSS, HIPAA)"
NEW QUESTION # 65
After completing the installation of a new overlay WIPS for the purpose of rogue detection and security monitoring at your corporate headquarters, what baseline function MUST be performed in order to identify security threats?
- A. Upstream and downstream throughput thresholds must be specified to ensure that service-level agreements are being met.
- B. Authorized PEAP usernames must be added to the WIPS server's user database.
- C. Separate security profiles must be defined for network operation in different regulatory domains
- D. WLAN devices that are discovered must be classified (rogue, authorized, neighbor, etc.) and a WLAN policy must define how to classify new devices.
Answer: D
Explanation:
After deploying a WIPS, an essential baseline activity is to classify all detected devices in the RF environment. These classifications allow the system to enforce security policies and detect policy violations.
Classifications include:
Authorized (managed devices)
Rogue (unauthorized, possibly dangerous)
Neighbor (not part of your network but legitimate)
External or Ad hoc devices
Without this initial classification, WIPS cannot properly assess threats or trigger alarms.
References:
CWSP-208 Study Guide, Chapter 7 - WIPS Classification and Threat Management CWNP CWSP-208 Objectives: "Device Classification and Policy Enforcement"
NEW QUESTION # 66
Given: XYZ Hospital plans to improve the security and performance of their Voice over Wi-Fi implementation and will be upgrading to 802.11n phones with 802.1X/EAP authentication. XYZ would like to support fast secure roaming for the phones and will require the ability to troubleshoot reassociations that are delayed or dropped during inter-channel roaming.
What portable solution would be recommended for XYZ to troubleshoot roaming problems?
- A. WIPS sensor software installed on a laptop computer
- B. Spectrum analyzer software installed on a laptop computer
- C. Laptop-based protocol analyzer with multiple 802.11n adapters
- D. An autonomous AP mounted on a mobile cart and configured to operate in monitor mode
Answer: C
Explanation:
For troubleshooting fast roaming (e.g. 802.11r) across channels, a portable protocol analyzer with dual- or multi-band 802.11n adapters enables:
Simultaneous packet capture on different channels
Capturing handoff-related frames and timing analysis in roaming scenarios This setup allows detailed capture of reassociation, authentication, and 4-Way Handshake processes, essential for diagnosing roaming delays.
Other options (WIPS, spectrum analyzer, autonomous AP) do not support detailed 802.11 frame capture across multiple channels during roaming events.
References:
CWSP#207 Study Guide, Chapter 6 (Roaming Troubleshooting)
NEW QUESTION # 67
Given: When the CCMP cipher suite is used for protection of data frames, 16 bytes of overhead are added to the Layer 2 frame. 8 of these bytes comprise the MIC.
What purpose does the encrypted MIC play in protecting the data frame?
- A. The MIC is a random value generated during the 4-way handshake and is used for key mixing to enhance the strength of the derived PTK.
- B. The MIC provides for a cryptographic integrity check against the data payload to ensure that it matches the original transmitted data.
- C. The MIC is used as a first layer of validation to ensure that the wireless receiver does not incorrectly process corrupted signals.
- D. The MIC is a hash computation performed by the receiver against the MAC header to detect replay attacks prior to processing the encrypted payload.
Answer: B
Explanation:
The Message Integrity Code (MIC) is:
A cryptographic checksum applied to the data payload.
It ensures the payload was not modified in transit and guards against tampering.
With AES-CCMP, the MIC is generated as part of the encryption process and verified upon decryption.
Incorrect:
A). Signal integrity is validated at the physical layer, not through the MIC.
C). The MIC protects data payload integrity, not just MAC headers.
D). The MIC is not generated during the 4-Way Handshake.
References:
CWSP-208 Study Guide, Chapter 3 (CCMP and Frame Protection)
IEEE 802.11i-2004 Specification
NEW QUESTION # 68
Given: AAA is an architectural framework used to provide three separate security components in a network.
Listed below are three phrases that each describe one aspect of the AAA framework.
Option-1 - This AAA function is performed first and validates user identify prior to determining the network resources to which they will be granted access.
Option-2 - This function is used for monitoring and auditing purposes and includes the collection of data that identifies what a user has done while connected.
Option-3 - This function is used to designate permissions to a particular user.
What answer correctly pairs the AAA component with the descriptions provided above?
- A. Option-1 - Access Control
Option-2 - Authorization
Option-3 - Accounting - B. Option-1 - Authentication
Option-2 - Accounting
Option-3 - Authorization - C. Option-1 - Authorization
Option-2 - Access Control
Option-3 - Association - D. Option-1 - Authentication
Option-2 - Accounting
Option-3 - Association
Answer: B
Explanation:
AAA stands for:
Authentication: Validates user identity (Option 1).
Authorization: Grants access to specific resources based on policy (Option 3).
Accounting: Tracks user activity (Option 2).
This ordering matches standard network security architecture:
Who are you? # Authentication
What are you allowed to do? # Authorization
What did you do? # Accounting
Incorrect:
A-C. Misplace or mislabel AAA functions.
References:
CWSP-208 Study Guide, Chapter 4 (AAA Framework)
CWNP AAA and WLAN Policy Documents
NEW QUESTION # 69
......
New 2026 Realistic Free CWNP CWSP-208 Exam Dump Questions and Answer: https://www.passleadervce.com/CWNP-CWSP/reliable-CWSP-208-exam-learning-guide.html
CWNP CWSP-208 Exam: Basic Questions With Answers: https://drive.google.com/open?id=1N0MfieSzczS_Mxrth0r5Xbzl-nYAjrc7